home

icreinstall_microsoft-word-2010.exe

Sifufi

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_microsoft-word-2010.exe, “Sifufi Setup ” has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Sifufi

Description:
Sifufi Setup

MD5:
4f672c3c938cab675e7ce5212d0da497

SHA-1:
aa72baded081bd9afe6c6827581acc1733f80bff

SHA-256:
88a05ce1cdadd31c3c0333b7c24bd2dce0d42597c74129e497fbd2cdac28c22d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/13/2024 9:27:25 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE.Installer (M)
16.4.14.1

File size:
1015 KB (1,039,374 bytes)

Product version:
1.0.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_microsoft-word-2010.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Iqd75mBnxbenL3iNNY+wNg1Z/MlJM8eHMt/lR8ybNSoGD3EIGAI7C4Welt:IUIBnxenLyMji1ZUlOzQRmoGQAIBt

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_microsoft-word-2010.exe has been seen being distributed by the following 26 URLs.

http://www.vaultsfarmapplications.com/c?x=7ntiP0p18KYyxV/41tW294P8QUNnyv4SdfvsYzIvBrs=&c=yJO1rmLF9TX8qZkfTNTGNC8TZ1nu72ArEsFOIxQl9LcspvsnVEPPa/5vxbfYUF/7e5zZs/pwvjNR1ftalUeXyRpTcDVzEeQ/F11FestQ55HqVVjasqo5E9uWk1rck61uAYAJwbp/3cpFP39hTTRa6uYvlsdnTszDmUoOpLJEFgNE0Tx71wTuDG3RM edamtp&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=ljulsBFOVFbQiDFLDOzXHnnP3hrf4 8E0O9Yi5vMozU=&c=2dEEMBF3m97mUSJaTFoaKse6T1/1lXgTWVP/RnoHE7f34qg4m6mojD01GG2TITRiLQucHu6XrCH0WzRxI1lVD8DU4zvAsmlWUEAMHLQ0DxNZJ9zxZX3vnJ9u/uvti93hoUgGI5K78m7zC36YljnUCQrGUr0O8aYI McNH5l0/Q3PH9bJe8YdeynombsK9Pyw&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=jhV3ocqHMQqENxsAQnKJMuHW0P7vJE4 e1yiFZQcObI=&c= rOFFD17tnhABcM0Gze88gj405ZNd8f5CjfZfvUcp6kgV27lYdlOKTT B8H4cUs66E0hkdakc7ZITSAcSTdsztOYeL6aqcJU5zWJy0brTund9JUSNjDLCsr72HygmN9GaY/usllxaeM3ettp6Wo1E iumDiPQl4norOT67p7AQNarsAg5zXraHhSfcCgAoZJ&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=mSiSJI4Ge q7aZIeBeHbKUiT1PqoZS41BhUfn4Da/FU=&c=gjCY8PDAPva24DC6tLCSg9WrdFzmSZBgHKhPYrFe4LUQFJtGXcIMUKiN8Qom0fbUYYAQaUy8Z9C4ZO9xO5GFYAifC1LOcHWo77oAJqdSjDeU cXcYGEM7U7yg//OhsdrQAefw3emApN8IhdXwSj rNs0JNciK5DgMy4iFfVG61VXB2l/w0whevsk2FgnpJsb&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=cVk8DeJ8XA5Oqaqa3CvbhadeQwpVNIkgbD5SnXPO9Vg=&c=UI3VXy0jSGdTIO3Wr/k2Pgq7l92Zgvv6jtVngJoRFmAPQSRH 541/FTIQ6 I IXLGGckeIeRnx47Q8SQE/T0EewZhW 2ZxBsrz5tW CNgCEKgEMWJsTUr7 j0UgkYAMQZdquc3sdHQzeJjyO2yCERSwMMBFFMYXe ZAF I5qaOh82exGbEt6e0vJfMPUKzi9&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaultsfarmapplications.com/c?x=6odhf49dQRzt67Emq5LRvn4PHWu24LUyKDQBAmLZh4k=&c=KpA/gA29iOkq5rLZqu6OFHtUbf8qOrEQhUBIAp1nnyQVHroH/nujxBffzNMmb4ePzyd52lvh4hXcLhGdDKHaRbjsgaQGBzrVXvjj9m6OXS/xcSUmEv2KF/3A/gE4JMEy1njCGnra iluWniF06/j3AE83K4Aw8mxnb8NGqtSywpBbE9yxGfwWbGQzQarGAra&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=0Lw4d5YAyD1XyIHqt8ouKso6tbMYXhAzvv9DKdMf/EY=&c=QlMuEyuAYAnND8Yu6za3mrN3yd7LujvAX8twU4kMjk8frhkiAHv6ljGdFk7f11LzrrFMX1FmoN7eDpEHrtKgOGtvPud3ZFEUfLxR4FYjBaE4tQVdevFEDC92WFlGwyo1MNPrbcysSTWyEU7uWg 0zLKNU4nCE1JjZyLzmljdJu ztMZFMhYI5wGmqYICt7RG&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=aMn/F8yu5K5tqN9SssSuNCKJwp6vTzxtGeUbz1jjb3s=&c=hrZTbDfit3NDZwN/0XK1GrDWXp9eG0867Yx0O52nBqpiof71YPZ3Eu1rhWjXr1SGI3lhWH DpiHxgb9t10T580lSd90Xfafd7wLQp6MR2AdnoEoToVSj3L0Sq3UUnb5/AqDyZ mR99/J6fv71HRtUZi5lOeVDhAJoIqzynpw5Ou/57nQZBs885Ca5ToyrdYT&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=xosr5ppibZIRXvAv8jX0pPdsOJZHva89/KSVdM 8aO0=&c=bqDFONw PymgEMr1dYhxEihP7yS0v9XtHNIYIKGVOkrAY9gtGLYhAtyQ9SUuQQs3oWDGLdDeT90Hr4tPhIQZ DLJ7BoBy0NIcLxT7LIZt56KFW2WEg1TG/FixWKtwAw7Ae7L0JXEf JZpU1rRbfkSOO0Zt8XicPY37jabHfxGC/AyaK1y0zBwCGVLXmc20JX&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=6BZMEl5PRvAvheBP/D1BmIg9v5hEMcUAG8TfM9mO1c8=&c=TRLtq3q6k3SjmEcMBQf2WaLjW3WYTIHaar5lln8Uo8kV6DvUG43RMWqiomD8L/YTedDsto/QMzQDR8NUgUDGW7 WZbCM blYNJlu/jL9KOiCX/RLiXGaSt9JcEUhnNuOWsPsCIIGxTQ2o5xdFPO/EcOSWtkMBCbeBK3nZVwyYuzrr2FtPn9Zbhi7e/y 7u C&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaultsfarmapplications.com/c?x=ycI L1Ko6IvkifhCQK4ylAdNdSjspKkssyt9MNpDEIA=&c=QzIM1dl/mTJEXrwHOJd0XXvE3eE8uNkocaP7Pz3E8cjnFkRcc4P37jVu1i645b5CY5uY6JPTUv5HzZtkksJYXfofrLspw0Zhi28F13YmNHrJaQ31oygQWjyFHhg2TzJxqDf6HdzZtdNEgh3pn5lz4p3TR6Ig4TzJrVcX/Elw9bfF4WS3ecBkelJ5HTcE9hVj&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=ZBxVQA9dprz0z/CVlpZ/tUGNTlmPYfeNHY9JqiKhnUw=&c=J5Al2DXq/ALwRjquKlnqbfG IAibupIjI86oZP k5coTqp3VZC/x8z2riTsKni6Pmb i1nBdpM7WRlXtPzpLwtn/bWPe/L6qMirq08eIfb1 veHubEvXgYoi9fKv4d546mgz52d2CABHbzsJhIgGwBPAhUAru3peb6ws9VzI82i9m9h1QxCGxpimrZ7YHdZq&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaultsfarmapplications.com/c?x=1m8tDwDCoyzHUqnGIFkEUwoAugttRtFEJPdedtVFC80=&c=scFdMqmZCJFf4js6WkEknuhYOsssiV5 sirBwoe9e/JsVuytXabgvOtVbKuqbpuF KfAs0Y9hgag ls1J5Zt9CjmZo/5V7/17wmuRxmLEiJxpBG1f0BPCGwJQStVhEpg3ee5dDaEa2zhPWaFkElyW1mN9OXYjNVnGHSsu4LjURNPnFnVeZI3E OFioGIHkKs&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaultsfarmapplications.com/c?x=3MpGr1 c7bPhTbfpqEjn03knA2 D/o63V1fw69TYi1M=&c=f8Vu5FivcD3pCyI2voNC NNDot9NRHBfcdIuG4MmQlVYEafmF7POYzoIg3V6EiW4vG5RWpCr9 LZ/TJUFxxXEh75PuA/j9izcYftPBWgbn 2Jw6yqq9HKj5/CMtY6Hvya9Yejt0Ge Be0WmNLb0/lNnT o3gtkF9j/ceXgLhwpZCBrW6/89r03UUkRvWFd A&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=jjvmljUh6lXx1fJmAKP wNllVO7NYvYAy7EyoQF bgo=&c=q1826VoL72 SXSqj6Q1jzC fdT8cjka5QJL3SseTNI0pJRA9xpUOTi dsFe3S/D6MSUkNxiBaeCDeKV2HTdwARGeFvd46H UgBEyZZKHYqrS0ZTO4jjua8ycL6l/F7Wsw0QKY7lyNYxYxUeRysMisBWRkZBWrBHNBUxhpQNQBfcwx/fUtAmaL85ByyICDJmj&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=XuDwAv9Cz7see5fIKj/b0ojfqk1ylCUwe7kh2/Ew Ho=&c=sDn1Gh55QitIeNS9iOibuyUuSBaMmLbZv32NAV/M4dIJGWRqiEipF7kH5aMd/y93DRfUFRrtgSqXgGCJZBczJ8AwFZnlsVIMPWusF7K6ldhfEEt86tO4dCbCHmv5vkM8ZyXkzm2ibv/ibxrnY0g5M0W/LbbV8jzEeqIeX0OleJfgNUuu/ZWbHzZUnMpi8Hnk&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=7fZDUdKPrH2aZQ2VLQ4PlHQ9h nKJbxZC6AU1OuE5pM=&c=0NR2kvgmeQ/ LobU0IgMt/Ilivwhwa8AudBaRlRSJKhwoAE dqpXDxbIxHfAYsalONuliorQO/tChFkFKWy35lzISYJpKLlSzboxhYkGaOn DdWdpcLG3KSfy/knTFnPq96zv0A7WcCEYYDV I5YiHV6KM5MgB0l07q2VXw2KuuJkrsIi9jscfkm7GfT lzz&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=iKI5URBB0OCiobhDj fdb/0ktH39aVbv84jaAITyK6M=&c=exoYSzAdwzq6oXBiJltd2O7HWleQYfIZ6potDzK8z5QaBlo3ZazR32eWue1//ulwykiTsuFc1Vu5rbLEdVqhPIub GJqjoeryX4nmeMc2Q4KibNCycnJaUlt1qDqr/vD8bax5mUkYIUvvDJAqyVEIZ2WtoTLCdtMjxVw7H/XDWefvtSsNyed5ufAAvwt6tm&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=LLEPEiulFaBi/BDx8St1/tccfqrcoHAwnA3Z30/FmNY=&c=yfz3fEsHpC0mWv7N6YI13u3spMl6lnASKFTN362krJwOYMIKbm4U08WRWru4wJ5ZWKrI36JwYwa8PntSEIC jQ9dTmPwhfUAaGLF41S8K2Aj7QRqM5URMH20eGrWlRu0ltTaN2RlyZJpMk1ltGhnL4gSsrqxonQYH2ySdEnrDAwZez1KJQeQigt46pD eoMt&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=8nJse5RG10aBynghuf6JePu3 vp6mjnSkHBZQIj76EU=&c=nNRyVUQQfTtQMx6EcLdrUB7/lvYVmnYnJf6J3UD8RH/Clc6CXYEZ/BFesluiLuU1g75Yvq6/8VT5lkMmrUxUEt2o7DUleJ8BXEjzEf2ArZofT5D8x8fiM9HteZotUI7o2eO0n33/uR9ev0GFgALAboJ3LpWjf /HaH9Gpn5IraV6izu9H/rL6mqaKm5zhlUE&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaultsfarmapplications.com/c?x= y797UUP1krLty93NaUo4M4RnHSG2JucUhtiZbfcJgE=&c=Rw/xWOTtnA0i Fm7NjRTC72Re1eupU08/urpjfS9BmLD7Oe0Gw0PLMRqazmPCkeA/oBguqUB6HjzgmW3PecbodmC6vQSHHBxQliq8cF9vzjekgN51NlVp7zyrcsbOP2wZg mm0Hlz 9NC3PUcQD0O8WNIFGmdT4dP2T MClKWHVvR4FGpdZm0D/HerReI4Is&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaultsfarmapplications.com/c?x=jIGyZ8/RbaHAUF2Xz7dCNoXFKuNCPgPkU03KRyZXu34=&c=WGizlo4nL1DCD3sLpvxcs guYJYRAKmv9N4jZ3ZH7OoyLscWg4gSpu4r7goT/j/iJo1vMnPRPcVRj5lxlYwSPjztNXyrPC h2lcoWRbDU2Gu9yZVo/eDKo6GjUUqOcxpzhFuIsaPZuk3ba1d1NByPWcLKgQygYP2 iF3DQeRWL8xhhuWXKev4V4Ua pG4HqM&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=/jAHklkWjGXnT IhJsDZBvb5Y1dPV3sfvYBCNkoaodw=&c=qGRLHR/XaWKSmpq5KXeee3ochRLZdiWvXpzsAN1uBPg WegLy 3fplQDXNfoIPLmlqPMu7Yx0rSyByCFD6rbq29c39r61tBgtiFzpz6LZ6bmNluOv63T7uxDP3kJLHTIjAjynnd91x7jB9LB/qArrodqAaRSitTbsFtLmd3yDW/QwhYX5E7OjIXwBTht6Aqr&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=SP0/6VXEvU4mO/96ns4zkXAffBrrStv4MJq59zVVcT4=&c=mMuQ 4rjfuF7N/QEvcKgotRIyQi16DH7sRrdrSYUpUoUlrz8Tz NTxDRi2Ux/Cwu28mjmKznxVHDzUi/eTxVuyilQWaw9s3DtYO/uHr8vuzM2XNsLEFfISFHlbTmuRzua2KlBClqllW/osVPzLFYSn/yopk1C9GZGOeJfFAhZ4ADUqLhiPUGZD12zkehUniV&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=VnFE3xDlk094/0DDgky9IOs SAcMKVeLsBwdxPptBNU=&c=oK4fZTtbIUCoq2QQ8z6AhfCTce6gky1xl7rXMltWhN4pdLHScBjPXJ6nC8h9/wlrqN42WMozaWs/fb rbTpU4ibusossugNicg2y27ZkObEG1n5oXEcaVIe81R280/lB2UupUtXz/91TmVKd7OPm/PqQ9cAPbmPFg6uM0nhxrxTGWULNLNL ZZ nD UqHvd9&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.nowapplicationgift.com/c?x=yU5crr04AVHYCFRHXVk 9qPHMA6Mu2KGCs5Z4uELgQk=&c=fE eLggoICuGnaHu1wtn2oC gunwsUOuRRQiSFvGd98ypebLRSGbSnMyIQxFaDsp/qNszq0R7PoO/UVdWh6C2eWnTD/zfz2uA5IIvEi7uGsdA292yhmd4jFU9 qPmtR8Vhryh0WW25WgjQXZ7rVu/9R0BihnTm6JhQHt3kdNA0pWSh FSTFAjWetXk2GrZd/&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_microsoft-word-2010.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.