home

icreinstall_virtual_mix_pro.exe

Cedadana

Quality Install (Alpha Criteria Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_virtual_mix_pro.exe, “Cedadana Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Kirep   (signed by Quality Install (Alpha Criteria Ltd.))

Product:
Cedadana

Description:
Cedadana Setup

Version:
5.3.4.6

MD5:
6d1325a26d50bb1a14f596093edb24a9

SHA-1:
23ec51fb7b529e48e6695273af155364c2ec36ad

SHA-256:
2a8c06357f0e256cb5774314b9aa50190c488349e12e94f8fa6afa3095db8a89

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/12/2024 9:33:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.6.23.18

File size:
1009.8 KB (1,033,992 bytes)

Product version:
3.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_virtual_mix_pro.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 7:14:15 AM

Valid to:
8/4/2016 9:59:05 AM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:JU9PeHzajLx+GdYiUnX+z4yq7eNY78f+Ij+rlVBFy6VajjeWfYFzUP:JimyxdFUXLycBHIjKlJyU+PfMC

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9300

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_virtual_mix_pro.exe has been seen being distributed by the following 16 URLs.

http://www.downloadclearbest.com/c?x=UZW3DcHzLwPQAA9lu30b2WMBANEQ97p7W9TC086mYbg=&c=fTLwvFMhX00IFiXtiUZDjtwX2trNiCB2yHU7YH8PBvhPuvVhCbYZuyq9aW5AAjl/4uR6P0QFdSh1uDGNnGMb5ZQI11YEfiZmQ/bpa2yQTePD e8EILhzzW KTV0zz174pJDY p6E2aJxNDV31oOyCK7H1NgAJb88wgxbEvn7FHc=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=RXLOkmB3sLKndN7oF2c5isogcFq/ceYw8hqmis93 So=&c=WZlA/lGt/Gy IvHGxilvVBFkSkNUPLSh9S9TRatxWrRImgs3H//OCJM7lMLAWa5C1bO/EezCqIe4GE/3MK3tWjanhD5cdqSSa7ucHj7qEYlvBTH8OfMmOfeLWQMbRaT5R5cUvaRtHNVa2TqW4APVHOsxQ/saavt/7wleqApR7sM=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=IcX1aQbmPwRoLGxgtxAc4e8f3/eFEjcXqlSx8xc1StA=&c=HlfVSq0KhCthh6m9FSWUDMe3V4c8WLIMpBnAU9 Azan90yec61apeVfiJB0 By4KcWjYbpNbiM8fFsTGDLMnRRYCuO5vY1KytTEI5r/Yjh8RVjMq3EO87R32BP2I5mWCWOSTnJGIpPthKbp/0WbFsb5wzfA6ufO8jDwkoStyKj8=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=bIkkXZAC/Xo8lnc4NTzvPh7wNGJ6F1MXE0NKGRTXBHM=&c=LK n9E73hqKDMgqdAs5wvkEjXIsV6iTEvW496e2irIGwPEA RrfQxgg6H1Pvu hzF2J62IWYLBC5Ak9opmRIHuDONYlZcwUJXCOP0OoN2z/ETrUTA8HH3ldiBuEIS1PPbnNAm71RTVvz EyjDGj1 c75X53etXiqEj5ILOKbWU=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=JSXrPAW7N9EV6ByH3oOylEDnW43KBuio6XhaDW4L28o=&c=VLNeGEwdM9Ok3qFLni3uV6r5SdeERyg9EGLui/bYDsZi/46JUlgaFEqL3Bk7YfWcWnVev0btbekRNTg1dRtFww0XjoCTVTVF6pJUxTow14knve/MaIWJ3zhtcsv5 KAajyxA23NpPf45B h txsMggCik5Yiy20gywJXFyzEfYE=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/WVl6OTRQVVZTVkhSWVZqUkhZa1ExVkRFeFdFTk1PVmQ2Y3pCd2NXbHNNRWN3T0VwdFQzWTBTWFZuTjIxRlUyc2xNMFFtWXowMGVFVnJORWsyVm5Ca1JFWnVialp6VERBME9VeHZXVzk2VFVwVGIyRldZMjVOZW1oclRFbHhTRkI0YVc1RlVHRTBjMGw0U0U4d04zbHhlU1V5UmtKTFdqQmFKVEpHWm05eWNXVXdkRlJEVTFGU2NscHlTbmtsTWtaTFMyZEtOVlJxVjI1UWQySXdWRWMzZVhFbE1rSk9WRXhyVlRSS2JqY2xNa0ptTVhaR1MyUlhOMUkxWW5sNlkzcE5OVkJOZEdoMVRWRTROVUpDT1hKcFowaEJNWHBCSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBWWnBjblIxWVd4ZlRXbDRYMUJ5Ynk1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWnpiMlowWkc5M2JteHZZV1F6TG1OdmJTVXlSbk0wYlNVeVJuTnZablFsTWtaMmFYSjBkV0ZzYldsNGNISnZMbVY0WlE9PQ==

http://www.downloadclearbest.com/c?x=3S7RimkR8P3r8UeQlrdtFxYgwRaR9dTRqH4ra9Odrqg=&c=i7lbjUWAlYeSIjvNDuZeUnLIYSI1oX1KYaz61ul/XRlqDYEniMR/apa6QZVP8zM4xruVqj4hSJs3nB7q3 yeqeHvtiG7X1DL46L6RVpC dUgE0ovwQCBicqeFH4hy5v3RleBDMh/lAiRdacezFDbo6z4NXTWD7vbJAX0ASg9bkQ=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=Gb6YwRUz3NpZUK9csoM/Qz1QcIQx4AQbVQ0vjf821Fc=&c=Tiaj9QVktQ0AfNCS bZpxQRbx 44485HYAgVa BUPGD02AhrAV9pdy2wPpIDTToC5Jqq5CT1kKI/tYPeFUUMF/MU3qL6TKpu11SuSHPPwvptRKZczAQYeLyJNRUid6HPqJXhDfy54R9/ZPtDB mG5ZRdPAVvHV cnPP0pBxJI=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=/9hPnpraeCHtMji2pzjeuhPkOpSdid8Qje5cjaZkf1E=&c=JVgggVKchN/ufUiB2wtfLwUQbzbhQRLme5ZoXv9VgxSWOrdk0dc/U0AxYDO0pmEdGoZ1EwAzfRiyrtqhvST12Pf5j2U9QTuO27npesbPforrGCKWP1u7FNbmdGIStjFvNYEw opBRsx9GpeaMfsQHU1KmmUcA5PitKa96j4suTI=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=C38Ynesh0qA9x3g58htbJKfuE5gNXfhWEa2TX4OPY3s=&c=hD9ctJvjRrxgxYPnOV7us5Hw1UQSh7PejYNXY PQI/o0ouWg53jGRfeox3cXh1O Pg4KgbA4hHCdJI8AojwzJgPFy9aTSAuAKUUXV47EErQ6YFRgcwxW9NedASiEV9oCrdIb5uGg9 yPJB6D3OJN8g==&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=HwYVo1u8GADh6FS0dmKJvoCla9OoVyqPUFkC/l /wUY=&c=eCN05UM4nNd8fhppUhD47veO0UCqs0vMq3rqasli0YKVuZdoB3Zdt20GiuQgi5uG/y73vsVDi/7c/rb05z4tGRgmRfuUaoubbQkk7mhdf8rgZ91Zl/qWyyv0pdgrokZgMc1HbwWXPY0dggEInkKYH7wOvS8kulsy3XSiaOf4aHg=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=nLCx2rQpCIH3FutauJ7a3EdUDs1eQIpckGtCm3oZmU8=&c=TvppzIri6kcDTgUmW dg79GAXLMLa5CwYUCyBodzHyjwmHVuYAVmYUg aacQhSVRsZ4MtIagkDIKfqQU8ouZb97j7I1Jndp nitng488SbcT4tkndNYVa7JLmvZ/A6Y7S60uzDwZ Bqs49Cm3cGhSsjwkcYIRNh11f3GEMS3G8Q=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/WVl6OTRQVmRrVFVJd1YwcHdRa0pVVW0xMVNuUm1hVUZNZFVGaU5tTk5jMk51Y1c1elpsWllUeVV5UmpKMU5qQjJXU1V6UkNaalBXRTVWQ1V5Um1WVWNWUnJjbVE1YmlVeVFteElVemRPWWt4VWF6WnBhM2xSU21vM1oxaExNazlWVUc1Mk1HTnNNV1pCYUZORE9IQmFaR1JvZUcxTWJrbzRjeVV5UmtOeFpXOUNVekZXU0VkalUza3llRTVUZWxKelVtdHFWM2QzVkVOTVJ6RkRXSEJpV1hONGVqTlNPRmN3V0cwNVZqazVZMHQ0ZFVKVFNWTnhOR2hoVldnMWExRWxNa0lsTWtaa1lVdEhZMWhWVEdGTlIwOUpja2RLVWtFbE0wUWxNMFFtWlQwd0ptUnZkMjVzYjJGa1FYTTlWbWx5ZEhWaGJGOU5hWGhmVUhKdkxtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbk52Wm5Sa2IzZHViRzloWkRNdVkyOXRKVEpHY3pSdEpUSkdjMjltZENVeVJuWnBjblIxWVd4dGFYaHdjbTh1WlhobA==

http://www.downloadclearbest.com/c?x=ESnIX6O69FyUd/R/aXw1MCt/Uf2R05H5S98Lcm4dKOc=&c=U8Fg5PmK0M3ME/tvIyRCRifz5xqadYKh47 7XRip5GEqwI4LHC0FYDXFMoFDyIp3GkJjJjLOsNhB0jb2H/7oh5TFnQSS0jG9sNrHlWCs4F/2OoihBGy5h5ZCD 4GG0FqIlwWY6uBRyH2eKpUeKk8GTGU1HpkT1iwXMlpyTQ8jMk=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=Rlzs1RNiXLTVtrxQ2QyNHwFJcefQLUbfAh9h9HbyNPw=&c=eQjwsea64D0YUDDegtHKtI9qYle5Wb5P/ww/Hej0wZ5h7Cepd9HCnnPnTclsdck2545FQ840h8jIYDFudOrrCEiznaaoHxxj04RmZAE4kjX56xGM/6nNE86O2e7EX2sM zqVX2jGKqWBv0o2SJchA5HMrxQmQap5xwHBtvKTlg8=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

http://www.downloadclearbest.com/c?x=2dFKBDEmOLrwLWxc2dKcLt9Z/Hd0uSZf7PIcUie7Bpg=&c=3q9jUAiNnH3Sg7UYkOnHiO8CJYD7o8glfFKyMmuucujcDXjdnR1PRzR7SjUGajiLpJmNb6npfTTfxJBAlUj/vTykes0xuukA1QDxkPEgkDHB49Gu6RbmFuwPoEt62M939Ijqq45fBlhyCODJGTViHfknnaJCU zP rfaU2Py7RM=&e=0&downloadAs=Virtual_Mix_Pro.exe&fallback_url=http://softdownload3.com/s4m/.../virtualmixpro.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_virtual_mix_pro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.