» icreinstall_setup_3.exe
Overview
Analysis
File Details
Downloads (90)
Network (3)

icreinstall_setup_3.exe

Conversionads

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_setup_3.exe by Conversionads has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the installCore installer. According to Microsoft Security Essentials, the software includes a bundle of the DealPly adware which is installed on a user's PC during setup using the InstallCore platform. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.moozybox.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.

File name:

Publisher:

Conversionads (signed and verified)

MD5:

0bc0d4ef01e53dbb7aa6bbadd59abad0

SHA-1:

7a2e5b0bcacb17541c9afa082b41f02b4fd3a20c

SHA-256:

638816408425b5d85599616f61e1721db22fb7cbad842795b4a2c7e8486838e7

Scanner detections:

14 / 68

Status:

Adware

Explanation:

This software bundler installs other potentially unwanted software, including DealPly. Which includes offers in a user's web browser which state they are "Powered by DealPly".

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/26/2024 2:30:09 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.121.78

AVG

Agent.F

2014.0.3608

Comodo Security

ApplicUnwnt

17478

ESET NOD32

Win32/InstallCore.BL

7.9190

F-Prot

W32/InstallCore.R2.gen

v6.4.7.1.166

IKARUS anti.virus

SoftwareBundler

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.174.10588

Malwarebytes

PUP.Optional.InstallCore.A

v2013.12.31.02

Microsoft Security Essentials

SoftwareBundler:Win32/DealPly

1.165.247.01

Reason Heuristics

PUP.Installer.Conversionads.T

14.8.7.23

Rising Antivirus

PE:Backdoor.Hupigon!6.1FD

23.00.65.131229

Sophos

Conversion Ads

4.96

SUPERAntiSpyware

PUP.InstallCore/Variant

10874

VIPRE Antivirus

Trojan.Win32.Generic

24598

File size:

624 KB (638,992 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\appdata\local\temp\icreinstall_setup_3.exe

Digital Signature

Signed by:

Conversionads

Authority:

COMODO CA Limited

Valid from:

5/30/2012 7:00:00 AM

Valid to:

5/31/2013 6:59:59 AM

Subject:

CN=Conversionads, O=Conversionads, STREET=Am Weinberg 5, L=Neubeuern, S=Neubeuern, PostalCode=83115, C=DE

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00F87F8F45F7BF3EBF80C41AFC59A6916A

File PE Metadata

Compilation timestamp:

6/20/1992 5:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:vJfsRDX3Me0ra8TSBQOwTvl8stvme4l4A1D4cyvmajeuIDnrF/:vJfsp3MrFTSBdwTdxOeq4A1D4cyNauIX

Entry address:

0x98CC

Entry point:

55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8... 
[+]

Entropy:

7.6557

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

36 KB (36,864 bytes)

The file icreinstall_setup_3.exe has been seen being distributed by the following 50 URLs.

http://www.moozybox.com/download.php?a=66&tid=4001

http://www.moozybox.com/download.php?a=46&tid=4001

http://www.anyprotect.com/dl.php?sct=NONC&data=null&anyprotect_id=1&r=ap_100_nc&pr=s&prm=dXJsPXt7aHR0cDovL2QzODltNGw1YjV3bGNiLmNsb3VkZnJvbnQubmV0L2xwNC5odG1sP2NoPWFwXzEwMCZhdXRvPTEmZHA9LV8tTkRFeE1WODBORjg0TnpoZk9EazFYMEpTWHpFNE9TNHhNREV1TXpjdU5ERmZOR1V4WHpjNE5qQmZRVVJULV8tTHFPUHRtYmZzd3R6RHdueUtSYWVvYUZHYkdoYV9GOGFEemFrLVZfX0pFYmFBZEdUdDF0MXpZNmpudGpuT1BxOWEwbjAxZ3NwcXlpblAwdTdwMXV0YWFBYUJBZ3M2SGFxbkxBaUJ1TnVpS3VwekFhYXBhQXVUZUptU3gyT0RYUW9lN3NRU1BLQ1JhM0YtQ285TGg0bWlXVWttVWY4Q000dmFNRzJjamN0dHMtYk5SWHlpdXZvMW5VajNYUU9YeVBUeC1RVUs1SzhzdXUxeDFJQldxcWsyUUNTZ3VHTTRJMlBCVHhwaWFRck1hdWVzRUQ4b2JtMTc0ZlRMWkFOWWl0UXpVVkhoREtIUi1ZMDUwd0ZSVUx6S3MzU1Rwekp4VktnU1pXeXBnakdMNEdxbXhyTmVhNlRPVVN5MWdnTWhnaXFMNmc1Qm5hbUk0OUdtcHRqZ05EbjZLUGNBek1EY24yYWx3d3dpclB4WGk1bTR6SlFlTS05aWZEaGo4MW9tRjc0c1VSWTdsbTBkd3h1UHp1MXRYbFhxNTMwVGxlTVFLeWNlS2tJdkNDbE5pVXdiM0VfLTNVbGtza0NIZWJSQ1RHR319

http://www.moozybox.com/download.php?a=100&tid=4001

http://www.moozybox.com/download.php?a=28&tid=4001

http://www.moozybox.com/download.php?a=10&tid=4001

http://www.moozybox.com/download.php?a=63&tid=4001

http://www.moozybox.com/download.php?a=23&tid=400

http://www.moozybox.com/download.php?a=12&tid=4001

http://www.moozybox.com/download.php?a=64&tid=4001

http://www.moozybox.com/download.php?a=73&tid=400

http://www.moozybox.com/download.php?a=14&tid=4001

http://www.moozybox.com/download.php?a=16&tid=4001

http://www.moozybox.com/download.php?a=33&tid=4001

http://www.moozybox.com/download.php?a=96&tid=4001

http://www.moozybox.com/download.php?a=29&tid=4001

http://www.moozybox.com/download.php?a=40&tid=400

http://www.moozybox.com/download.php?a=67&tid=400

http://www.moozybox.com/download.php?a=24&tid=4001

http://www.moozybox.com/download.php?a=27&tid=4001

http://www.moozybox.com/download.php?a=53&tid=400

http://www.anyprotect.com/dl.php?sct=NONC&data=null&anyprotect_id=1&r=ap_100_nc&pr=s&prm=dXJsPXt7aHR0cDovL2QzODltNGw1YjV3bGNiLmNsb3VkZnJvbnQubmV0L2FwbHBtb3YuaHRtbD9jaD1hcF8xMDAmYXV0bz0xJmRwPS1fLU1UQXdZbDgwTkY4eE5EWXlYekUwT0RGZlFsSmZNakF4TGpFMExqYzVMakkwTVY4NE1qWmZOekkyTUY5QlJGTS1fLUxxT1B0bWJmc3d0enp3cWNCUmFXbmFGdWJHZmFfRjhhdmJhay1WRl9KLWJhQWRjWk9qWGVBdHRubjFQaGFucDBwdXV0TmdiUUlPUHp0bmdYbk9BYTlhYXFlYUdPQU9PRUFBbmFRaHVwdXBhbmJuUVV1VDJYazdvUnhaTDJFdGJBYTllMm9hOEM1eUp0ZGlaU0dJeXBaUzlScm1Ma0lhUWFRR2hJdzE2QW1XT1lMZUxiY0YzTWpMaGt2WnF5YUpwdWVKZm1PeTBKMWpTcUhva1FxbGktUEVYSUJJT0RTVDRLY09YdDdiNUhSc2RndkM3WGVxdlNVa0FONS1mbGdwUVl3Q2pBQm5SblBIcUJhamplUVJsNkd2V1JmajFaM1lSaFBub1g3Q1NHLXNXSnNFbWpMTk9aNE1uZDZhVHUzZmFZVHhEUHNxdjBZQVdhQmJQc2ZhVTJ1cUdzWEh5SURrUmFvZjlRYzRYZGduYzFNVDRvd3NtSFRNZGJBblpTZ3F3cTdhVGlhaEUxQWFXUC1MX3ozZmZqZm9xY2pLVGNhVn19

http://www.moozybox.com/download.php?a=25&tid=400

http://www.moozybox.com/download.php?a=97&tid=4001

http://www.moozybox.com/download.php?a=19&tid=4001

http://www.moozybox.com/download.php?a=38&tid=4001

http://www.moozybox.com/download.php?a=52&tid=400

http://www.moozybox.com/download.php?a=62&tid=4001

http://www.moozybox.com/download.php?a=80&tid=4001

http://www.moozybox.com/download.php?a=48&tid=4001

Latest 30 of 90 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to os.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdnus.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdneu.webfilescdn.com (65.254.40.36:80)

Remove icreinstall_setup_3.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.