» icreinstall_vlc-2.0.5.exe
Overview
Analysis
File Details
Downloads (4)
Network (2)

icreinstall_vlc-2.0.5.exe

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_vlc-2.0.5.exe has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. According to Microsoft Security Essentials, the software includes a bundle of the DealPly adware which is installed on a user's PC during setup using the InstallCore platform.

File name:

MD5:

203f7d011b8c280dfdcde0ebca099200

SHA-1:

b2664397b16f480aa1c733036fe4efc9de74a178

SHA-256:

f08869901ba9dc925aa8c930ecb7c93448265119a324a3538fdfd8de1615df7e

Scanner detections:

26 / 68

Status:

Adware

Explanation:

This software bundler installs other potentially unwanted software, including DealPly. Which includes offers in a user's web browser which state they are "Powered by DealPly".

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/19/2024 7:04:47 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.InstallCore

7.1.1

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.119.222

avast!

Win32:Malware-gen

2014.9-150323

AVG

Adware Generic5

2016.0.3161

Bkav FE

HW32.Laneul

1.3.0.4959

Comodo Security

ApplicUnwnt

17448

Dr.Web

Adware.InstallCore.122

9.0.1.082

ESET NOD32

Win32/InstallCore.BL

9.9176

Fortinet FortiGate

W32/InstallCore.BL

3/23/2015

F-Prot

W32/InstallCore.R.gen

v6.4.7.1.166

G Data

Win32.Application.InstallCore.CJ

15.3.24

herdProtect (fuzzy)

variant of firefox_setup_20.0.exe

2015.6.28.16

IKARUS anti.virus

Backdoor.Hupigon

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.174.10530

McAfee

Artemis!203F7D011B8C

5600.6817

Microsoft Security Essentials

SoftwareBundler:Win32/DealPly

1.163.1557.0

NANO AntiVirus

Riskware.Win32.InstallCore.dfglnt

0.28.2.62440

Norman

Troj_Generic.SQONQ

11.20150323

Panda Antivirus

Trj/CI.A

15.03.23.03

Qihoo 360 Security

Win32/Virus.Adware.94c

1.0.0.1015

Reason Heuristics

PUP.InstallCore

15.3.23.15

Rising Antivirus

PE:Malware.InstallCore!6.4

23.00.65.15321

Sophos

Install Core

4.96

Trend Micro House Call

TROJ_GEN.F47V0720

7.2.82

Vba32 AntiVirus

Downware.InstallCore

3.12.24.3

VIPRE Antivirus

InstallCore

24412

File size:

1.2 MB (1,226,888 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\appdata\local\temp\icreinstall_vlc-2.0.5.exe

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:mJfsDqNYDaPaDFo7WwFINVvgFe37rzIOrhNyoMuaFXgadEu/enWVSIh:mJfsD+2vj7rsOrhNzoQadEuSW

Entry address:

0x98CC

Entry point:

55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

36 KB (36,864 bytes)

The file icreinstall_vlc-2.0.5.exe has been seen being distributed by the following 4 URLs.

http://downloader.downloadster.net/?id=b4761bffbb5f131801c2d0c9933ec754c3693655&ts=1370033309&r=L3ZsYy1tZWRpYS1wbGF5ZXIvP2t3PXZsY3BsYXllcitkb3dubG9hZCZzdWJpZD1EU1RWTEVYMSZjdXN0PXZsY3BsYXllcitkb3dubG9hZCZ0eXBlPXZsYyZscHR5cGU9MyZtZXQ9YiZnY2xpZD1DT2UxaWVXYndiY0NGVTBkM2dvZGRXMEE1QSZ1dG1fY2FtcGFpZ249RFNUVkxFWDEmZndkPTE=

http://downloader.downloadster.net/?id=b4761bffbb5f131801c2d0c9933ec754c3693655&ts=1370007962&r=L3ZsYy1tZWRpYS1wbGF5ZXIvP2t3PXZjbCttZWRpYStwbGF5ZXImc3ViaWQ9RFNUVkxFWDEmY3VzdD12Y2wrbWVkaWErcGxheWVyJnR5cGU9dmxjJmxwdHlwZT0zJm1ldD1iJmdjbGlkPUNPTHA1YTY5d0xjQ0ZVMlIzZ29kYzI4QXRRJnV0bV9jYW1wYWlnbj1EU1RWTEVYMSZmd2Q9MQ==

http://downloader.downloadster.net/?id=b4761bffbb5f131801c2d0c9933ec754c3693655&ts=1368810860&r=L3ZsYy1tZWRpYS1wbGF5ZXIvP2t3PXZsY3BsYXllcitkb3dubG9hZCZzdWJpZD1EU1RWTEVYMSZjdXN0PXZsY3BsYXllcitkb3dubG9hZCZ0eXBlPXZsYyZscHR5cGU9MyZtZXQ9YiZnY2xpZD1DTHJCaE9qUm5iY0NGY2hlM2dvZDZFOEFUZyZ1dG1fY2FtcGFpZ249RFNUVkxFWDEmZndkPTE=

http://downloader.downloadster.net/?id=b4761bffbb5f131801c2d0c9933ec754c3693655&ts=1365939514&r=L3ZsYy1tZWRpYS1wbGF5ZXIvP2t3PXZjbCttZWRpYStwbGF5ZXImc3ViaWQ9RFNUVkxFWDEmY3VzdD12Y2wrbWVkaWErcGxheWVyJnR5cGU9dmxjJmxwdHlwZT0zJm1ldD1iJmdjbGlkPUNQV1Z5WnVKeXJZQ0ZVekh0QW9kSlhVQVNRJnV0bV9jYW1wYWlnbj1EU1RWTEVYMSZmd2Q9MQ==

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to os.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdnus.solvefile.com (207.189.109.121:80)

Remove icreinstall_vlc-2.0.5.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.