home

c.exe

Lireloful

The application c.exe, “Lireloful Setup ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.clearguardapplication.com and multiple other hosts.
Product:
Lireloful

Description:
Lireloful Setup

MD5:
55665575b0885bc8241604e57ab20ff1

SHA-1:
6746b988baae9a4bfc0d579969d54616a6c2814d

SHA-256:
d0348fbc239b4589afb313c8d41dcfcd997e7b9071e7eb79b399c5aaabf11a22

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 12:23:16 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.AGT potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.Installer.Meta (M)
16.4.26.19

File size:
948.4 KB (971,123 bytes)

Product version:
2.5.9

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:b5pl+FIEmQz5LZphiyXLRsT7ElZhG1Us/sm18J1CnyFGHVy:b5n8I3Qz5LZfxOSaUnmk1CnjHE

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file c.exe has been seen being distributed by the following 11 URLs.

http://www.clearguardapplication.com/c?x=HbkQbEA1C1F5JslzQjTk9IExBiGHbNU2NG5aGdSZL8E=&c=0sAG pc0E2yJA9PJaafi2lGznygOAxnX1qrPt7877DojHI7oyv98DVsMc giVMFNL70K1sbtlAQhg4JUWH2LlevJN5c2moIRHP3b96lWl1vcYwBQw/XK338n5ECF62To&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.appsfunbyte.com/c?x=D03nimcAIpWC//6IhwH1LQGso0n1VfZMC/5S1B7Jl38=&c=x3eXaWnGP0k0KZNicmvDUrEas6kYwK1xpHw36CYCb79Uxsot7tEydJKFTNaCThWBlEYXRTFzGUH7XNlgEck2po2DrM/TMnGQELKDhc5VN67JLC0ka4x5vN4EhjMCL30X&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.capitalsoftwaredownload.com/c?x=T/PCXlFxf f mlLVwiY8E/4uGOO9m8bcEvQZF9oLc0Q=&c=7a j6BRgSh9fJxIiSO3rPpKF0WQBqf2lrhsPeIu3wcpq/rMp7N0pjyXov duJ6knR3Z2S2P22b9KwAFdLmlobxDYP6it68uNEy0abARKa0ggMUw6PAmKQuAjI3Q2Nohb&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.citysafeapplication.com/c?x=kg3qAkVKjSDculPJmCzTAJJbAVBQc/n/gLElCw4dzAg=&c=bFpyAMdYttI6qdFbDANyMICqAoJpDsSuepYskAXVNs3BCsvMAY04XdJacozqm83OchYmHFqJKR1vTI85BYMRFF4NNMCd8yO9VCwwd27ZRxOMn 9vml8XtPCAQSt1aJ2E&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.conceptsbodysafe.com/c?x=dKVKsYcby 2ccKwobFUCm9I3WsQF/OxtdRJHuQI hrA=&c=H/Hhi 4mnGmvawWW6tNsbXKyxLaY7I7m m1oHTzc8F0/U1hWWr3u5pMCJt4Oske7OmtiXCF0zfuz 3JjfvQu6yeVEdJ6CJraZMSpbE8K zqw9k8EoRB vGtpKKQ6Qe4i&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.appsfunbyte.com/c?x=kD9VJSpPmEk zs7w6ALJURObMR43TDcvHC57mvkSlcQ=&c=1/YFe/w3QkLa2oDUC7gfHzVrY0 7qnmEZfoMSbZPzvpVw1u4RPXTMOKTyqvsbG6/pyspdMuISip/xTGzHHRdhFpw4GPK ke1KMN3n4Q 3xqv9FXUxyoVylBMjroz20DF&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.conceptsbodysafe.com/c?x=2ruV0sOeN2Z1EuA4hHg zlC 7j8v/qhLFlmqJbl0U4A=&c=2D6XDvDOzwveRkGvNnaTvx7SSYQIwmviiv2 1SOA0T6IIf1fPzpzdNcmlYNN5V9CPsOfvRIIYwrbVI/NLxfpEeMCoV7dGwRp5S4XJlCh V3FhqpiSN6Ga2eF07KaomNn&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.appsfunbyte.com/c?x=kcyVRGXjQYMSZyMtt5EgURTEMuqjbviYBtxhhfibEC8=&c=c0 uGyhBtuahGS7ANM8YH6/mXyW7wn3rNsH0ReCCVwcDKpavgm8K0yQI91G3tfm8e7eJBcizohU730sEbPecc4MP850xcChMAPZSlq8ZRu1fMJRA3xbZ82SirfWFMwQG&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.capitalsoftwaredownload.com/c?x=H86sSFnZYkPiuKStv7JcsJCFKlSIsofLZatoqgz3Vwc=&c=MhdIFEjL3wSHLB4e7IrW6YdGWfyHDt/Q6eEhipR7YdFgYQuGZErUcrGR4710p602rQGfsBjM5GQb3XDTn 5U643aAT eS1HAM5aOyMxwDN6HEDwzgu0mawcrPEsPlyQu&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.sharetodaysafe.com/c?x=GV01kFdVCBeSXtm7jBxgG7DCfUBiIykz4yCfjb1lWlA=&c=9O4RSeGbusqsyqPmVITkygd0KlLAwuT0d7xMJoX6EAiDNZaUy/0LBitfj4f3 K8GfCHU8W0iteK9geIfkKsEeU2QFwEszYe jXVYPEAa NZ9aZgBDLWIa0shdJiO8eVw&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.conceptsbodysafe.com/c?x=svyS1vrnmyUtS8v1EC /xVKiWBVsv7hoTE/lePaC1dk=&c=5qFU66yyqiPDMEel9v 3G0Q8GQptwhMQNFPowVHgtOaA6/KkICV6abcWYP/Z8ah7WwYkXhuuqNp4XPqzFHQSQGcrjrFwdpuBar2mZ5VxEICxMDKpmyWhMTgCeKV6WVdu&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/46.0/win64/.../Firefox Setup 46.0.exe&downloadAs=Firefox-13108-dp.exe

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.