home

icytower13_install.exe

Free Lunch Design

The application icytower13_install.exe has been detected as a potentially unwanted program by 5 anti-malware scanners. The program is a setup application that uses the Wise Installer installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from hip.co.il and multiple other hosts.
Publisher:
Free Lunch Design

Description:
Icy Tower v1.3.1

Version:
v1.3.1

MD5:
7a67ebf0f87af6e8e75c1db1f21b9ea2

SHA-1:
77f802d7489330e06cc103ddb43c118781c51563

SHA-256:
e26eca1fe4a4acdf09e658932652df799f6ff5a85d6a1b513bc59874cd305097

Scanner detections:
5 / 68

Status:
Potentially unwanted

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
4/29/2024 5:54:31 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.Conduit
4.0.3.1489

Dr.Web
Adware.Conduit.37
9.0.1.0221

ESET NOD32
Win32/Toolbar.Conduit (variant)
8.10185

K7 AntiVirus
Trojan
13.182.12911

McAfee
Artemis!7A67EBF0F87A
5600.7043

File size:
4.4 MB (4,616,192 bytes)

Copyright:
Free Lunch Design

File type:
Executable application (Win32 EXE)

Installer:
Wise Installer

Language:
English (United States)

Common path:
C:\users\{user}\downloads\icytower13_install.exe

File PE Metadata
Compilation timestamp:
4/8/1999 10:24:47 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:2TzdoFx8SagDu9jlGmG9hxLYh/tQZi5m2EYsCUZ:mzdeKSagDFDYhGZcsCi

Entry address:
0x1000

Entry point:
55, 8B, EC, 81, EC, 78, 05, 00, 00, 53, 56, BE, 04, 01, 00, 00, 57, 8D, 85, 94, FD, FF, FF, 56, 33, DB, 50, 53, FF, 15, 34, 20, 40, 00, 8D, 85, 94, FD, FF, FF, 56, 50, 8D, 85, 94, FD, FF, FF, 50, FF, 15, 30, 20, 40, 00, 8B, 3D, 2C, 20, 40, 00, 53, 53, 6A, 03, 53, 6A, 01, 8D, 85, 94, FD, FF, FF, 68, 00, 00, 00, 80, 50, FF, D7, 83, F8, FF, 89, 45, FC, 0F, 84, 7B, 01, 00, 00, 8D, 85, 90, FC, FF, FF, 50, 56, FF, 15, 28, 20, 40, 00, 8D, 85, 98, FE, FF, FF, 50, 53, 8D, 85, 90, FC, FF, FF, 68, 10, 30, 40, 00, 50...
 
[+]

Packer / compiler:
Wise Installer Stub

Code size:
512 Bytes (512 bytes)

The file icytower13_install.exe has been seen being distributed by the following 7 URLs.

http://hip.co.il/Items/Download/.../icytower13_install.exe

http://icytower.cz/.../icytower13_install.exe

http://indir.gezginler.net/i/3198/.../

http://199.115.117.237/3198-icytower13_install.exe

http://www.hip.co.il/Items/Download/.../icytower13_install.exe

http://www.download-games.gr/wp-content/uploads/2009/.../icytower13_install.exe

http://www.icytower.cz/.../icytower13_install.exe

Remove icytower13_install.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.