home

icreinstall_mp3rocket_setup.exe

Cegap

SCCE Development Inc

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_mp3rocket_setup.exe, “Cegap Setup ” by SCCE Development Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.farmsharebits.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
SCCE Development Inc  (signed and verified)

Product:
Cegap

Description:
Cegap Setup

MD5:
b2945bf8c173c6f8d5f22b5e730be1ee

SHA-1:
b2d982d3bad9e425a1bb2da173a22aa6fca47598

SHA-256:
75957c1968840a1fb0277a0f129ce8662133845c99fc7337671913435f15d603

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/8/2024 10:26:19 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Win32.Generic
16.4.12.4

File size:
1.1 MB (1,181,016 bytes)

Product version:
4.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_mp3rocket_setup.exe

Digital Signature
Signed by:
SCCE Development Inc

Authority:
COMODO CA Limited

Valid from:
11/1/2015 5:00:00 PM

Valid to:
11/1/2016 4:59:59 PM

Subject:
CN=SCCE Development Inc, O=SCCE Development Inc, STREET=3051 W Maple Loop Ste 201, L=Lehi, S=Utah, PostalCode=84043, C=US

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EE6BCFEEB3DE758C0292441353CB7413

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Yt0Gti9T8s5+Wwjd+55l1It15u0qZ1wpewlPxDKB0js0f:YOGt05HIHaw1lJd

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8800

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_mp3rocket_setup.exe has been seen being distributed by the following 36 URLs.

http://www.farmsharebits.com/c?x=7eZp oXfkpeA Qs4e8fs3IPcEl6dUBlHeTuxUD2//sM=&c=cHH44G2fFEtWUZOMmQpLLyxQPBsfawdT4cbZzgHhwIi8/f4TDHPzpQOK/BH1ZmfS2elY0ln0YgWoj0xoskBEW9pdisw2SjcY8Gui3e/rzICzMpELnY18jd/kDA6kuDxe&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.vaultcapitaldownload.com/c?x=/Vbi4jnXpWkGNBXtYdo068J77s4t7VMGzUg3eceJTVE=&c=IOkgEOyX9XR6L8URyhyAHR GOB4Sh44ec4lj58E0wwyELl6Xv hY5fXZkSp3XAT g1GdVqwTofKBCyfT a ADfBlvKwAkUEeoOg1kIzSEsDKFPj5VPX5e5pHb9T7uISP&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=eEJSHonszKHQED0ZdeDqoY1EkKuwItBfIIo9gsZuIkk=&c=j s7MUBVZUKnuTJ6ERRV86k1BtlELI59GPwcifp0fu/YU/ANEEMc0KYgYsK9KKqR6jefxfIedgWLxEaaFDpMwIgtaM3uzpmnZA8iBICdHHrsMsnODO8hgPpLM5il/ZWl&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=PcebVPOn42l8paNxy5ADoaqIgrgaKHEF4BV1NSgpUGQ=&c=pBm1HQanaGFJm7HuuEThM1yo66yaERWAEbgvJe96riYH z4fdSFRy3V mPaDkDLJLJgNuP2/irrLR5fhB7/Lm1AJa1lNbtGGlSDLgUkg1u2xHwfEJ03N7c5wP9LKWxjA&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=w6H/i9dKmefCe280onVqTcdSeZkmVq1ECc SReykogs=&c=wSoEm11rSPdkN/Ka9gMfovr9/pDbA81CPJXwnIVLAodBOdQDZgtVfFk80HKi6G0en5WPYw7vlSE3utjWUqHCjteDH4HDOmr1mUf1by7jg2mtH8ZF7rxf01aq61h1Ldo &downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=g3GFoGbr50xRgGbatr8c8cXdePTIdKuEog 0nwZQZVg=&c=hh0GJCqVysQhBEfXX/MIa30TzDyrjLijDXQWCV4rVzotbFPDze2hxKhWp/yM8FRiKtReZEwoeFRwc6d96alZk02CduCknfWEyHIfYfeW lFM/f6D1LjEMoP L2o/Q2F5&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=iJ/3fiEtFGEI dZkBmqe8C1O3ve2TNY2gQAJIxNtyIA=&c=PJwgz4 FE8JJAFKu4eQw5P7GzgvG9XTwqVUYyHTUEqTgOx8n8kpWg5gEPVc21PscPXge7JsiU0VBjeTUsFuqbDS fCaOoGoM6VI6RQkx5GG1bNFJGfUQHspo4wX5MjUy&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=lST3k8a1mSRnKhHa2Z9XgP9lL38rMqvRO3Est67CwF4=&c=dHRIfSiAdTufc26ztRUnx0BIGYcARrpHiUBS6sS/NKF5ak9Wn7MCAlhKi1hOq3EXnhJb993xhPg3oW RlzDCD0 Sl2F5jOmEgY0ga3bJX H9GqnDzIBXChzPIaNGooCG&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=RSXid0kSCXTPCpT15XnCFj6JrSjP31/i4RHIdX2c9A8=&c=1NxQk78W4BuNw6JbyfFA2JSvGPIoPafdReCEgf9KfTgFPvXj83dur1oWMHX 5/zMEdOq17HyBRAMWMRsKFthvH6PVDwZE5 UMAkbPBw87cg K8XtWAW3goTVXnjWJZfT&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=C38ZPrgCKAxy1XHke7f/b2j Rl8 hvbs1uBno35a234=&c=hssGxWC3Lc sO2OL97wr/h1xz3y1pk0qpLehL/a/No0Jlp1tD9gO/g9/G2IB8R0AhikQnRDxZ1WZIobWX8BZn0AjmfsJxCGRfQSnO3 nJU6nE3ctv0H1B5wtwL6XJA8&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=7ZTLrTtfiBA pqTeQ11M4/z8iohfnfFoaCc0b3lmNv0=&c=g23ZDRs DbVbCqgb7r82OPqWhAb91e9iH h7RK2dDeC6zI/Crw3dlcLOG9 mc2MA2KzCH N8OS/YXi QRSp20lzZ4ZVuFv4d wucKGt2TzrXHjrYXa/HDMiU14aAK/o&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=HZXNc1ggXYb9wl95b4rxGeh eEQF3F4T5fa/tM7Su4k=&c=CbCaTD71zccoH ydENceN6qh3vTiAgFeIDKXh39jAkaPAbAySz0ySS79r7VDt/iz48VfAYPB0hMzRN1kZF8AhHXvWPSgjnpOkG88B9hhN3pArIm8BJq2Iwsi4 6wwyQe&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=YQkdiZR/A2slT3zVSMYvWjMScGEz/BUbN5YqQNgDedM=&c=/SMJGEHIWoDfMqWMmjHdO1h4aP7Qe39Qor6u/jzCY9slAZlDZVjnq5Lr82N4BqKteyIPoE fbmFdCLkZ9QfC2m5jabBXP3Ib5W/s6B2z1AWWpbjTo/NL2fjZZkn5Q4Ig&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=LnkTwTUbLCQr7ECa/wPHJLOezsKe162u7L6T8P2tXso=&c=9r7Ema17GzZcOkPBRgUl/IC0175YCWWwhgIEFWDDSDmeOunMAPvI/3n7CaOpBWE8z70ifVpudG2bSXijjY4iRBwfJyW3q/ yGc E6pOT5dcIil5vTn6Knb2PtO90drGX&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=WEKGl5Q1al5TsuLJ/rx7fJVvQ1JnFwJJUeKRKf4kBIs=&c=nAXfRHHYhM67xSvUmH6W5jcxmYXNWh/sh0wyucOhw05VGBGsGDrxu4 qMQTjHD2UnEJDvFwWV Z76AiGdBuBsXSUlygmaNHtmC1/QEo5CcdP5u6hnGQdWkz22qLsfLTt&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=g2Y4v0ojAki3t6km EFJfxHrmf8HKz2LNoKEDvCT9bk=&c=BBM2YBVQhy1MsOEyfjHoxEBjRcUVImRHixo9kWMGlFwH8yykcHPz4dKYJg8dAwZzwoEcFKSd6m H4BQbg52v06t5Qj19zbCBt74OgQbZ4qjfbjSE27 mH94Q7GnTNMya&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=qxhmDpOiKmaHYYa6PEXyuQJlDHu38Ac7AVkfULkhWBI=&c=5M q8XbOJm2kjNtrVsW1/5XW3MRBcuYr2zX8IJzJLEjhNJulKks ZURlcEdLr x/oTkR/bEvgzWUSLr5gCKqW6yHQxUiDDMIg0abiAehJcA9ZATrseFmuQErUry/WUzc&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=m1nQFq0 5 yagFn8oCVbntu2qImZfSeUYqiHlDvaQ8=&c=qYKVwAVxOwoJfSZJC3o8TJWBclctTgDkOZEYaXttbvcku346mTWhAIr/fV87fhiKYb4A/WubZMquDk8mymNhr8JjcfX9tFwvW09u5xDvhyBldOUHV4SXZfzbdIdG LF/&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=UIiJMn 598v 7QnXIoBRDPUvwjirw7snFLNeXEnUDnw=&c=wW81XoLj255nKpyCXvgFxcsgHylIJ1ZOFd4dQ2Ee6LpraVu4IRuIpZ2v2is2N8H1FOp0PwllMP2bMsE8a5BOjLqiWgFYd0u5tmP7uWxQplHJww5OGbw91UayK XrwG/G&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=LgWY mGWdWJHGn7hcJrv b8 I54YowcplZ5rZ5H43SY=&c=jlQmD2BcT/1gGGJEwzu1FULuLMk4yFFMY3S5TxZjoefTHR71lAFFEwbP8jkHeEIfbqSMFp5fXIWdA0Ibdh3L9xu3nhC/0AVwzMsdOEDC6Z4O5WsZ4mFveB2eFQO kPZm&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=C1a01xyPecJ1dQsBLwFtcmDabcWMzSZZtS2GDavlZvY=&c= FnoNpWzD98wshQI/aDT2YiZQF0fgRJZWhGjFowRZHihda9CalIbSx64qFq7mU9aaDrubgaNS7v8G0jy6BaqMitZnwjcozFLVJ2VDA7nxEBaYA87kB8NtM9e8I0BWVKv&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=ybzMTj9RZ85hXcmxqz2g8BWZkYhEWd3A1T0MxsIoICg=&c=cGrzbz87Zf3S6vcYzKN1Gcna5di7hO/mFx4rkJPGB0edtnQAwRMvsOLM9nEd9zAvEm4/2OKxAs0qwlklJaHwnblLVi/700aCfa9ndvdOv4X0z6udSoUin2STOS13H/ow&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=4aSlZPE4z6gO/XD75i5D5HB6XpwrvUEt6a3MIG3myso=&c=0tp9pO6rXlugvq7p4p2eOybaXJX0a/Mcl6MGobGCAwtfgz9AmnHPNpjKqKjr0z/RD9Q1k5eNAHNxV4OoK4YenStjo4m9FT6n5HqXKLGQ0Ha9Ee37WcOgOiLLMY1CsWYO&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=LthmQ7aGO CALN7LnGTR5MJHwGfZk6UHcSR33FjOAUI=&c=fHQ43pa0x/ETPZN5MEUAMO1RQKSkgXZnT5v6ZaRCCGHd Pr7m3rUKO0LuZ6rjrGDmlDfnRESxaLsLlj5qaMS4CgsBTxF BmNgmKY0 ILXWDFkC Xu59csNpZiq2IGESp&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.imusicsearch.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=aFjuNa64VoteBXKO7w5bHIvn6obDzhQlF7XpD4a2txg=&c=Gj/SzOOrlYt uLqkhCeA3payVEKv2MCgx/pXDJlzelyMfPfhHCCbLc8SgQ fuFLTttnCBHiXOGl8MVAcY9NPznIStTwRmOtF4 h3jun WXnzy0wutteyRUuz3TdGQMkY&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=M3/gosiI h7JW1uB8QbAubWmZXilLUv7h5L3iLq7MI8=&c=WM1py8zRl4ITDRvVhWUSk0e Fke71DQWhU8IpkRZL/qv0QyNaJHYn7FeFRx9/JS4XFz55mtMPi22Yqyrmeh33hFRKAdHCjAfX6 ngbaTwFvYqsj01rwDRD8QLaPGwjOs&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=t5gIhlXnXO4wuztOlGiKr8ftuznuPZzGkB6g40zYL2c=&c=/a36W9qQAmI9IsSlI8a3KtCjjvKUj39pWiixbt9couuLY74wCdJ9xyiTQMMm3AEoGRhLUJYP5SnsLe9fUI75cxdCdbvt3PZe3H7l9SoXOYBKsbTZnv/HhHWq83VrU8oG&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=bS7DygLu1agMLPLsmU2jpgl2uTEcsnCIopFmTRPmj9o=&c=yumTa5pUvcy/f/zPxa7WdC9 /wRKcWRLpNXYyolCVmAy7ZQXTtrrWLBnsoX5zcBgXhQt3pp5UsD 1/N4b6wuWy72zTpW7KUekTAIQuu9aMoRQiNGczstAfjhTuRiDumt&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=ntbZgL/9Lsn/qcs/T0ikMWdlyTKrbuwPSCTd8fGpL3k=&c=pIhfmud9w7BROD7OgV2oi5j0OdO/F9iffmljYAiVpjyKV70PKR OzUlGzZuIzhHtSO72iDDUcvha8UsjahLOyFeJtNFQb3sZQbl00rmFV8ILaVuokRKW/R28kP4 Luk/&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

http://www.farmsharebits.com/c?x=Z31WeON0oWvbIWlhHRawLZ2L4SGMyp2Dl9pkfUPO1T4=&c=tIGCoGi9XVg2Y0zQUj56vsRBx0WMZ0AzA9tkLPU0hIFnxBGnwj3urQR78PIb3ecTbQL xUWYSN2ERD7lI1/cI6EYxHnTuH1pn0wXiWUiU8a87rn1dlkYMB4xki42/L6M&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.com/.../mp3rocket.exe

Latest 30 of 36 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_mp3rocket_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.