icreinstall_itunes_setup.exe

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_itunes_setup.exe has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download Apple's iTunes but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Remove icreinstall_itunes_setup.exe - Powered by Reason Core Security
MD5:
2229a5ff0b5cbf4ad03368bd5205307c

SHA-1:
a0503aa133d0436da7ef28745149c175e5478b7d

SHA-256:
9dbefd7aca1f504a694fb67c73f298b463f4abb15444e040cd20a9a04b535ee1

Scanner detections:
26 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/2/2016 5:23:29 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
7.11.141.180

avast!
Win32:Adware-gen [Adw]
140608-0

Comodo Security
Application.Win32.InstallCore.KAU
18064

Dr.Web
Adware.InstallCore.133
9.0.1.05190

ESET NOD32
Win32/InstallCore.ES (variant)
8.9646

F-Prot
W32/InstallCore.R3.gen
v6.4.7.1.166

K7 AntiVirus
Unwanted-Program
13.176.11684

K7 Gateway Antivirus
Unwanted-Program
13.176.11684

Qihoo 360 Security
Malware.QVM20.Gen
1.0.0.1015

Reason Heuristics
PUP.InstallCore.Installer.Y
14.6.10.17

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.14608

Sophos
Install Core
4.98

The Hacker
Trojan/Kryptik.bwjc
6.8.0.6.161

Vba32 AntiVirus
3.12.26.0

VIPRE Antivirus
InstallCore
28115

Remove icreinstall_itunes_setup.exe - Powered by Reason Core Security
File size:
667 KB (683,016 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_itunes_setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:jMJfsGCwFdtuvAlqWN1M5DbQcZHcBugwH7i0IAKTeJYzXngmg0LbtS3lrxD2F91t:jMJfsN+yAggkNeugqi0I11Xpg0VStwFd

Entry address:
0x98CC

Entry point:
55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
36 KB (36,864 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_itunes_setup.exe - Powered by Reason Core Security