» icreinstall_bestplayer-12658-dp.exe
Overview
Analysis
File Details
Downloads (9)
Network (2)

icreinstall_bestplayer-12658-dp.exe

Rukimakin

Mode Beta (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_bestplayer-12658-dp.exe, “Rukimakin Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

Publisher:

Mode Beta (Fried Cookie Ltd) (signed and verified)

Product:

Rukimakin

Description:

Rukimakin Setup

Version:

3.7.4.5

MD5:

534f32b9a98e5c878094684e8a6eedf9

SHA-1:

2f69c79ce4c038c47da17544a42773d00c74b32e

SHA-256:

a317a25e392538949dcf6373f590c8c2b35d173be4d4b6a6676992cf8b982cd4

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/24/2024 12:25:16 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.6.11.0

File size:

960.6 KB (983,624 bytes)

Product version:

1.2.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\appdata\local\temp\icreinstall_bestplayer-12658-dp.exe

Digital Signature

Signed by:

Mode Beta (Fried Cookie Ltd)

Authority:

GlobalSign nv-sa

Valid from:

12/16/2015 2:37:06 PM

Valid to:

7/7/2016 6:06:18 PM

Subject:

CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:QCi46vIpWeGEvHstSIgFnM2MXLk03/hNcQQicg6pxiEW8:QrrwwXEvHstlgJM7k8DNcggxC8

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file icreinstall_bestplayer-12658-dp.exe has been seen being distributed by the following 9 URLs.

http://www.tagtowerscapital.com/WVl6OTRQV2RDZWxOWFYzUndWMHhESlRKQ1NGTkZhbVZFWm01YVNXbExRWFprWkdWNVNtY3lTVU5pZFVwT1ZWcHNTU1V6UkNaalBWWndPVkp6ZFdKQlNuRmllbmQzY25sMlQxY2xNa1owTkhWNlRFeGpZVEV4TVhOYVNtTlJNamQ2V2tkSU5VZERZMHBFWnpVMFRFSjJURmQxSlRKR1dtZDVhQ1V5UmxoWVNYZExOemg1U1dsYVJtOHhVMVIxSlRKR1NFdG9TV0ZoUldzMFdubElabWxxSlRKR2FsSnpTVkJrTm0xUFN6TmhlbWcxZFdWd2JTVXlRbE5NZUZwcFdqUlhSRTVFVVdsbGVrVXlabWhXYTNwUGEyUnBjSEpSTlVjMVVTVXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmtiREl1WW1WemRIQnNZWGxsY2k1amIyMHVjR3dsTW1ZeUxqRXpNU1V5WmtKRlUxUndiR0Y1WlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UWtWVFZIQnNZWGxsY2kweE1qWTFPQzFrY0M1bGVHVT0=

http://www.bundleflashapps.com/WVl6OTRQVVZPZUhWQmVuSmpXbmxPZEhaSFMydzVOMW8wV0dwdVQyUlpWMUZ3ZDJKR1FuQnJOSGRoV21JelJuY2xNMFFtWXoxRFlVcG9hRUVsTWtZeFJHaExTbGhETWpjemJ6WklhbEpHY1cxWmFqZGlNV0pIUjJWWmRURlBaRVl5UmpCNWMwVnpOalF4TlZCTGMyTnlaR3d6V0dwbVUwMVVjRlIzZEdseVVWSXplV3MwVEdoMmFISnVRVXRwVDNGQmN6VmtWblpLZVcwNUpUSkNhWGhKTkhwdVlVdDRUMjA1UlRneWNWbFRXWEpPVlVkSk9VRnBiRkJWVkhKMVRITjZlSGxZZURSQmVXTkRjVGhUVG5CQkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptUnNNaTVpWlhOMGNHeGhlV1Z5TG1OdmJTNXdiQ1V5WmpJdU1UTXhKVEptUWtWVFZIQnNZWGxsY2k1bGVHVW1aRzkzYm14dllXUkJjejFDUlZOVWNHeGhlV1Z5TFRFeU5qVTRMV1J3TG1WNFpRPT0=

http://www.sharefactorybundle.com/c?x=7UufFcOyBziUYrGIZRFRvLX0h4SyrWm0I1Kz2Lt2c8M=&c=JaLbLlyNYn0J8qboz8D2M4/wsyiLrazu l7pwBalsND1zxQw3EShEWLSyCcO1Hhg47hWXbEHzRp2MaXkP5NWW gy1r4dAEOC6HcQL4iYi4 J4Ongk6aWvJ/XeU0VetUYtsJQNwbxC SpGyvGau3CGx5/pgbbvMuw5yeAbUerAjs=&e=0&fallback_url=http://dl2.bestplayer.com.pl/.../BESTplayer.exe&downloadAs=BESTplayer-12658-dp.exe

http://www.deliveryheartconecpt.com/WVl6OTRQVlJVY2toU1duVjZZVzF0VDNGcE9FNWhkMHhYWTBZNU9YaEdjMFpOV21SWmMwcEZUMG8yWnpkMU5tc2xNMFFtWXoxYWNqZEpNbkp4T1U1MlNXZGlXbGxoT0hCWFZXNXFkeVV5UmtKNlVqTXdWM1ZqVVU5MGNXRk1Va2hqVDJWSGQxSjNUell5ZFdwSWFIVkNaRlJYT1V0RWJYZFpXWGRFZUVaT1dYUkhWVWxwUms1WVEyWmhjMko2WTNOWU9EaE5SbTFqTUVwMFVrRjBZakpSY2xRMFRubzViV1ZoU0ZOa1VtOU5iWEp6Umt4bVNtWjBRbHB3V2trbE1rSk5hV1F5YW5CVVNsb3dXa1U0TnpSM0pUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpZU1V5WmlVeVptUnNNaTVpWlhOMGNHeGhlV1Z5TG1OdmJTNXdiQ1V5WmpJdU1UTXhKVEptUWtWVFZIQnNZWGxsY2k1bGVHVW1aRzkzYm14dllXUkJjejFDUlZOVWNHeGhlV1Z5TFRFeU5qVTRMV1J3TG1WNFpRPT0=

http://www.todaymetabundle.com/c?x=rue4xpAoT6uNpGqVqpQ3jmc3orjhR3dsTjR4atigeoc=&c=mP3PC0iw/vIDZUEVSqPOPS abxETCS98xoTPPBjvw2oWtviMROeu8FBN R40 OlNWsVMlc306WgDAr8WKwvHnzKXxq5lpGXyLrxyxT7rb0ehaTrVF7ADb8saat9CzuZWsnjOS2FnqSvPuF UNIWXeqxi2zcqC tzs4IjaNOC0o=&e=0&fallback_url=http://dl2.bestplayer.com.pl/.../BESTplayer.exe&downloadAs=BESTplayer-12658-dp.exe

http://www.tagtowerscapital.com/WVl6OTRQV281TXpKbVRscHpPWHAwUzJJMldsRnFZMnR5UlhkVGVHZEVhM2RsV0hGNlFqVkVjMHhIUkNVeVFqTnZTU1V6UkNaalBXMVlSVWhVVjJaTmMyTkpibEowVDJkaFZYVkVjVWRIWTJOdlNFRkxaazkwUm05aGEyaHVaMlpCV1ZScVZrMTNaR1pPVlhSc1NGWkdNMFZhYVVwRFNIVjFiaVV5UmlVeVFteDVUV2xCTUVsUFFqbHhWMGszVkVVeVJuWnFXRm95VnpCbFYwMHlSalZNZEZSTE5TVXlSamxIVnpCbWRsSnVTRE5GVjNCNFNsWndVbmx0V2lVeVFtWmxVRWR3Ym5OQ2NqZFVVRTk0ZUcxVGJqTlZjbTluSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVellTVXlaaVV5Wm1Sc01pNWlaWE4wY0d4aGVXVnlMbU52YlM1d2JDVXlaakl1TVRNeEpUSm1Ra1ZUVkhCc1lYbGxjaTVsZUdVbVpHOTNibXh2WVdSQmN6MUNSVk5VY0d4aGVXVnlMVEV5TmpVNExXUndMbVY0WlE9PQ==

http://www.headcycleuniverse.com/WVl6OTRQVk5oYVU1a2JtRk1aVUpTZFdnMk1HeFRVM1pLYW01UmRWQjBSa2xMVVd4V1RsaGlUbWhKVGtSMlpUQWxNMFFtWXoxTFpHbEpTM042WjBsTmEwTjNhMjltTVRKV1lYZFViSEpCTW00M1NHZHRiMWxPWkRSVFFqazRlbWhuYjJkRkpUSkdObXBLSlRKR1MwcElabTFKYmtoWGVUTmFSSGxUTUNVeVJrUkZjRUpzVW5reFVtNDFWa0pPVEhBM09VRk1hVmR3TjBrM05YRjVUMVJKYUdSNVEzaG5VVlZHZVVzbE1rSnRjblJFUVNVeVJtbFdkakJRVUdadWQxRmhhVXQxVkc1WVUwMGxNa1l5WmtWYVkwRk9ibEIzTW5jbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHd3lMbUpsYzNSd2JHRjVaWEl1WTI5dExuQnNKVEptTWk0eE16RWxNbVpDUlZOVWNHeGhlV1Z5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUpGVTFSd2JHRjVaWEl0TVRJMk5UZ3RaSEF1WlhobA==

http://www.worlddlstock.com/WVl6OTRQVVJ5TVZGNFkwWjJURWRyTkhGRVVqSXpVWHA2ZDB4UFYwMWFVbGRoTUVKU2EwWkRlVFJuWmpaak1FVWxNMFFtWXoxS01qVmhURm81ZVZwUGQxaFpNMUZpTmxvMFFVcHhNV2RSUkVkbmEzVWxNa1pIWm1Zd05uWllVbHBLTkhsemRIZzBUWEEwSlRKQ1RYZ2xNa1lsTWtJbE1rWkJNalpLT0ROU1ltMTNkMVZUUW1OcmJWcFZiVk5wTkdaVE5UZGliM2RXU2tKVlRFSWxNa0pHTkVRMVYzQTBaR2wwV25KaGVFaHZKVEpDVG1KdmNHTm5OelZJT0dwRk5VTjBSRmRzUjFaek1IRXpjMWMyUW5relEyUk1SR1l4YTNSU2R5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMkVsTW1ZbE1tWmtiREl1WW1WemRIQnNZWGxsY2k1amIyMHVjR3dsTW1ZeUxqRXpNU1V5WmtKRlUxUndiR0Y1WlhJdVpYaGxKbVJ2ZDI1c2IyRmtRWE05UWtWVFZIQnNZWGxsY2kweE1qWTFPQzFrY0M1bGVHVT0=

http://www.headcycleuniverse.com/WVl6OTRQVk5zWWxabmRGWk9XQ1V5UWtkb1VFZFZPU1V5Um5OWFVVWTBOM3AzVnpFbE1rWjFTbGRvTlUxdmFHSjNhMFJMVFZrbE0wUW1ZejAxWkZkVVFVTmFiMFJpYTJGYWFWWlljV1pQUlUxWVpqWjVTMHhKUzJaQlNqRk9RVmRXVFRkS2RqTnVZbmh0YTJkelZsbE5kVWM0Tld4RFltcEtlbWN4WTFvMGQxWkhhMGxqUkV4RWNDVXlSbWh0VVZKb2VIQjFUVnB3TUNVeVJsTXhNVkZETjNaNmIwWkthbWx5UzNadVRYTTBjV0paYm1ReE5WQkxUSGg1UVhaRFRscFJaVmh3YjFaS2NXSjNkV2xJTTNBMFpTVXlSa1JGYkZFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTmhKVEptSlRKbVpHd3lMbUpsYzNSd2JHRjVaWEl1WTI5dExuQnNKVEptTWk0eE16RWxNbVpDUlZOVWNHeGhlV1Z5TG1WNFpTWmtiM2R1Ykc5aFpFRnpQVUpGVTFSd2JHRjVaWEl0TVRJMk5UZ3RaSEF1WlhobA==

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to os.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdnus.solvefile.com (207.189.109.121:80)

Remove icreinstall_bestplayer-12658-dp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.