home

c.exe

Cir

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application c.exe, “Cir Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.signbundlefactory.com and multiple other hosts.
Publisher:
Minuho   (signed by Destiny Dream S.A.)

Product:
Cir

Description:
Cir Setup

MD5:
ea39c1a04efd609ceb0e37271de38784

SHA-1:
b70e45c0e0f3537713dd6bb9f351a85075910eb8

SHA-256:
5d1031262c7b95db0185f61ddce00a4ab81f59af52e3a75755b8a4e6471a4112

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/14/2025 1:59:32 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.3.29.22

File size:
1 MB (1,078,040 bytes)

Product version:
4.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\c.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 4:55:11 PM

Valid to:
10/2/2016 5:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:8bmjb2rfYLfQazIgBOg5h3bMqDyrRupNCMvE6G1NFYZVSmc8AR:8S7cazIgBOg5dbLyZMcoJu

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9068

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file c.exe has been seen being distributed by the following 7 URLs.

http://www.signbundlefactory.com/c?x=meFTo6c0Pp2uMikyreikIysV7KIJiEZ6G4iPgTNKo/w=&c=tzpG pmplAP6tJb6sgMge1G/LkkekqRMWKwhNrV23AqMVaFVmf4zm0VPai1qB2sp8hGVTQIlUW5cqP/plIrAh8WX9JL3pqpke/5UshpNtiK1bTC fMZyMyTxh31vtsOb&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.softwarefactorystock.com/c?x=aVDimsCc7Ns3iU98BRPabzvbdaPEfk9eAHoQ1Ou0C04=&c=CMrqNqtQ szQ0syQRie65G1sjSZMz6VLMzKlc27WKzXTn5ZZ3twm7/cioaIaMJvKJrJ/GOL5 SZGKeG7y3DliQuETIPkMN1aC7BpGHjFtTucSNW1q6Wo4i1R2vjOZcPK&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.vaultsdeliverycenter.com/c?x=2L7qNLpEk2TMZvb5UTKdloZW2IX GcAmAHTIDatLGGE=&c=DjO7nLRSKMZKeP6UHF4aF1gmvinrNHhE4woGRCRQzH2qKtiO5 1XqBw1uxjVwJMFw3boVkIsAU7e9oROiQxmntzElu1z6vXIRZ4CV9wBPTzOfHhsBeiLuFu5acqRNTfI&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.downloadappsbinaries.com/c?x=yWhqFfCu25EuYxWioqUItWJcKAfg6pcnE3iPunvI3Ss=&c=STN3XSpfQ/MC9GaOWflrP43BONUm/eiLYvI2dIowWrDbz4l7 FZXSz1U33G63GlZ7UVY7VRfn2XaqkMcGM9E aM2bIzBGEGOCNXT0ihqg5To/EMZiKOhnku1xrSTBVIe&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.appstowncity.com/c?x=b6Gv1OHN9UTlPyU/BoXoiNE8FKrHt8QA56DigKa 1o4=&c=4YACDVJIYOcSF7gkJXMi9ku9RogDySRlp9ARTzoMLbDveesWDAg53jst0IBWrUuYFzAdhu8A06Pv EtARmyRY1W7/hDLp35gjmLs9ENyF4f9Dlwm I zVwAtdwjESrWJ&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.signbundlefactory.com/c?x=cHVbK0ifD1k EiVRLpLy3YRoqAc /k30hOYKVT FxmI=&c=EYgEkp7ZuCV8HppQfIzOLWVqTcHcVZhvKOMcGFyzocu6emPDjG1kUPfXHyoi5aYw3l rXuMn0X cproDiLSamRTpqXjKam30duf9vMPFZ9OpOZdEWJEqlV2ItA4sKgTL&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

http://www.signbundlefactory.com/c?x=9YNcaC6bSTEnw3pLKxc5H4CMldN9V5zLevGejVuzGSY=&c=eUNC0T4m4SrBL5JvCCc9f 92gXSWWnmyYhSdIm9KNgzBJSJX7p9 ccYqgQ Ui7alnEEa/RHm1SU8pnIVhnppjpvGCN4WzZA9 Y1r QHzMqik1lMGBdI9LA9yhRIBChf1&downloadAs=the-sims-4-full-version.exe&fallback_url=http://www.thesims.com/en-us/.../product

Remove c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.