home

icreinstall_winrar setup.exe

Beni

Darwen Marketing Inc.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_winrar setup.exe, “Beni Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Darwen Marketing Inc.  (signed and verified)

Product:
Beni

Description:
Beni Setup

MD5:
7e5ab6be4a176fc5f880648e97244dfd

SHA-1:
96c64f28be8e36a720364bee899f509d68180f7c

SHA-256:
879882e1a2a44bd3a884613cb739f77ab191ff6395c01412881523ef1a5ddf5f

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
5/16/2024 3:42:34 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.3.25.0

File size:
1007.6 KB (1,031,760 bytes)

Product version:
3.3.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_winrar setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/15/2016 10:00:00 PM

Valid to:
5/17/2017 8:59:59 PM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:5mC2dUuHKAsjmBXsvrPXxj9ddUrxnkrmeqz9+OYIws:5f3qSXxj9d2tkrVYtYh

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_winrar setup.exe has been seen being distributed by the following 11 URLs.

http://www.heartcontentvault.com/.../4rTJU9Bw556W5S4o qSvIpsM3dNivFilHpmEGTvWr7OI4uiv4HHBwcYgfgPD8iMEWsyz07VlOzcYeQLquRbFQjihNy2mJfzz9EgXPZAUPv3WQb MiHZ0m7PglAbSB6AFy0bagpmClUQsafjGssc7topi10=&e=0&downloadAs=WinRAR Setup.exe

http://www.heartcontentvault.com/c?x=fIjp0zYbzCLRhnw1Vgsme5TtIIxTvLDLALnNMhMl1Y8=&c=M6rolS rp2L1o5OAuRuHIDQupK/ GBJSOmvCIMACJAaO7/.../LnolZoX pZdukMVWrH7LS1aQhaZiBJ 0kqjNX9htAT224OKNzKh7ykKo=&e=0&downloadAs=WinRAR Setup.exe

http://www.heartcontentvault.com/.../kNVQmb2noEAyeKXytykUYqAcXEP1G1GwFVQIqDjjuS7yAv1u3rzB7RFUH10IBHSNHrWJAC3cztY8Q4YqU=&e=0&downloadAs=WinRAR Setup.exe

http://www.downloadsbundlebyte.com/WVl6OTRQVTU1WkRRMlYzRlFVa2hLYW5WNk9GZDRjVEowYkU1WmJYTTJlR05hZDBvM1ozbGpWV1JEUWt0d0pUSkNUU1V6UkNaalBXNWtaRXRETkdSVFJXSmhWbEJGT1dkbWF5VXlSbWRqVWs1NlN6WTNkMkl5SlRKQ1ptRkxOa0V4TjB4WmFsWWxNa0ptV0hJME1pVXlSbkI1UlU5dU1VWk5aazVWT0c1WFZWWlRRaVV5Um5CdU9HeFBWa1Z6SlRKQ05EaG5ibEJ6Vm14cWNrNHpkM0Y1V1hkamRYWkxkMWhRYURKRk1tNWhiekJ1ZFcxVFlsbFFSM1Y2Ym5wbmFVOVdRMkZVSm1SdmQyNXNiMkZrUVhNOVYybHVVa0ZTSzFObGRIVndMbVY0WlE9PQ==

http://www.downloadsbundlebyte.com/WVl6OTRQWGxIVW1wdVkycEVXRkYwZDFaWk1XSkVOWHBoTTFabGJ6RWxNa1lsTWtKdFZYbEZSRVJsVTBkYWRuZEJNR0ZKSlRORUptTTllazkwUkZkMFIyZHNhamt4SlRKR2VYazNSU1V5UW5CWVdWZHJNbmMxV0RCTFFrSlNiMVpDZURsaGJHRk5kek5zUjJ4WmFWSklPU1V5UW5KTkpUSkdaRTFyU3lVeVFucDVUM1ZzV0VaQmNGUlhUbkZPT1U1SWEydGhPVTFXUW5kdkpUSkNkVXhpTVhSSWJqSmlha0ZMZUVscVRHaFBjbFJMTmlVeVFqY3hWblJyYUVSRmJtRnVWMVpwVldGR2J5WmtiM2R1Ykc5aFpFRnpQVmRwYmxKQlVpdFRaWFIxY0M1bGVHVT0=

http://www.heartcontentvault.com/c?x=Mq6/4sLQHZKkyWUZ1UIJ550fqT7of FvDjbfoXtl4E4=&c=ZX0yqZ5NaCjEaSn/nHUAzy3BPw5JQE0jTl7OQUshP1JO4Z36SejPsYbZ63COIcMAQ9x5Rd5 Nm6J16jeq1HjZbtyMTm0K8GCcbuPuVVV2jatK1ziExk0OjLEGQuEwrY/.../5E1PjzIW2 qXJ Vpfis=&e=0&downloadAs=WinRAR Setup.exe

http://www.downloadsbundlebyte.com/c?x=2at/HiI6Vri cOGahA2dLBc1 GR1rnJkDS3WJzM/acw=&c=Y9XCDM7q/3oboP25sXzijy0t0hr36h6ML8MPnJJr3Ip HD27QI38kYeH55W6pXBK1d3zbFn pk94agK7LcYt1kF8YdVDhx9vY 46oAwsrAMzb4LyM0U3K51B1s7/.../xuzCd3A=&e=0&downloadAs=WinRAR Setup.exe

http://www.heartcontentvault.com/c?x=W/hn7BHgEJuUUlN6/.../koxfvrYoPssLZwQ=&c=cAIw7GsWbMjLDr6IRPrIqTq9H0XsJ3QSj0jLO69Rt6uT7YCCIOo8VKxrCUEuom0O EXy8JvugGVvhWdkTFyinedH4Ht6vGngAchHI00xbdSCofUtWOahW4XW5o0xJBdM5PZf54DjzOA4wGat9HroceukF2FAWJS1T2 qC8h7f0Y=&e=0&downloadAs=WinRAR Setup.exe

http://www.heartcontentvault.com/c?x=TTXro08gRW9i9UN0oEws/Lq2rP n6QceMnvIxuRV6Xk=&c=cUXrOdyGdiDyTNBspvtC/JIcsDyEe49wcYiow3WeUR5VdnpTow2zKAewXzsgcGgwJly5VT2dDhr5vaAR6/ 4QadVC6UjozKQLqK/.../SZK8fdc9Wa0VuYaB5DYqwzG8vzGKlbjMq30a pCfOzFD08sI=&e=0&downloadAs=WinRAR Setup.exe

http://www.downloadsbundlebyte.com/c?x=SIazIk4FDe4SGjeSqem2ROWzYNX3gIxpRY9B/QjDSHo=&c=VAGdOFsdIpaVUPE/qgFYvgEpReZl9LnlYM3KnwNl7HGuMvhsC2iROG3Sns50cPBY7KtegPAu9OL1vtA7ClT7zw16a9V7byWOMe/vPt1jVMDM4vFhFbHC1NDLhyiJwPBWIK45kn7pMxCm9 Or/.../UkiLigYw=&e=0&downloadAs=WinRAR Setup.exe

http://www.heartcontentvault.com/c?x=Cgl9VUtuKNJas00fIH fJnViaiVJkZuQz2Jd97d5ibY=&c=zstfCQ1br7gxjvBkOlSsdd2ub2oCIRS94LcpIZFyZrgiWhlUsuxs1okiHFp7tsH/.../kMdKIGDM5dZxNoK13b2znyw=&e=0&downloadAs=WinRAR Setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_winrar setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.