home

icreinstall_bitzipper2015setup.exe

Internet Lite

Quality Funnel (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_bitzipper2015setup.exe, “Internet Lite Setup ” by Quality Funnel (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Quality Funnel (Fried Cookie Ltd.)  (signed and verified)

Product:
Internet Lite

Description:
Internet Lite Setup

MD5:
f7f56bf3787755eb20fcfcf6b70197ff

SHA-1:
eed46787f51866efc2faea3434a48ee7d50d4a40

SHA-256:
0ef21a003a94b3e5a6f4d7c75371864885aae723c2ad30eae45499f3f02e287d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/16/2024 5:20:36 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.25.9

File size:
1002 KB (1,026,032 bytes)

Product version:
4.2

Copyright:
Prog Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_bitzipper2015setup.exe

Digital Signature
Signed by:
Quality Funnel (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 4:54:27 AM

Valid to:
6/22/2016 8:12:52 AM

Subject:
CN=Quality Funnel (Fried Cookie Ltd.), O=Quality Funnel (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121771FCA92BA51266AB4B001FE1E840DDC

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:WEtjPF8gLTG58I2b3kDQ7DEIGL+xAYqZY3ddA0SmTAbzkv/wf:Wij98gm5+bUDQHEIPzqZYdmLgwf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9180

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_bitzipper2015setup.exe has been seen being distributed by the following 50 URLs.

http://www.chucklefactorysend.com/c?x=dALBM/sWkS8yNqCybH2XDRFexhF/91ZaJGfGhjMBas8=&c=TLNTHH7M6plZEmeIeLsC0/xPtAgueUrqVhQPWVO ZSH59XpRpURZ3YirKTJ1W0fnf8Jsm/lGG wfFM1TqQ QorVM8ZooySoeG7zNCI9qz9WQ8PhYHSX tcXl3Ojrjleh&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.tagbulkhost.com/c?x=iuDIB90l7vweuzed3wvSJI 8lKosKUNjduZHmACcrzo=&c=PUAHzWpNH//LOBgjo 1jVXl1ohrzk9VHHHwN0zCOIfm74gX lXx2 7cH5jrk33aVCFk/n1imI7D6HCBmEEVDe1sK7/ipDgjRLbrwtOIQWdOt5WvMV9evjIP9DToFsjso&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.sendcontentfarm.com/c?x=HMPqDbkk/eeBdk/XWPN CiZrUYzZOm/AyKHbQPiXgfE=&c=CJq8nYCPkWeiJLLM6ThKTgo9WmePCYu3Fo5f/chrEov9OC4Sv9epmcZlGp Pmh12ngcoQ8nhgou4RhUJaQmLlJ1jYX5I9k1yQYTvmpYoXa0S9GT7BAjcJgdLWmPJIwEi&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.cyclerepositorysigns.com/c?x=3NvpFbfUfPeerk72u0ZOPuKsLAm5oog0nDhC5ck2Hkw=&c=GQDRrGUj gM JnIZaYubS01KCUUeqQJ54TkiNx41nx//qheFh6G7OIjlYihmLIpIuM5siIhvO3YQJmNFZrE8WaY3V7 tz1RXvUqbYxilPgEq52Tlu7TRe4980z72LPmc&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.vaultbitscapital.com/c?x=41/YZ2nVNGOt2WaN4E4XsRNGXX2xh1L2kllq5kQ21PY=&c=/ot6BFgCPAT zoEYjvKnnMWFAAQOv1Uw8IUOVpNPlgKNJ1wMFALvAJGJW2DYpHy6XTjttHkpZnwAy/YFOtUEkm5OjghYT5j1Q/2hxJ9Elk4DqWn4ZciTh7wPfHGoNFno&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.hostpresentrepository.com/c?x=cFtDCmL2M1tuvgKlirGQ3PPVIVztxoY/C6j2tl2E2Qk=&c=BFBaQvXPCdDT5tkVTdg9bcLn3xpPTMzQhx0QjTwo3wrVaUJIk350SaSsZt7Wcf4o51 Aace6uNd1hZkgCPNKm2pk6A5kM4RWt4AZZw15oNfJ83fnikkRKFuzUbMrzxTX&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.packagedownloadsapp.com/c?x=txgaCWoimhc/tXqFwRWJO5Qoer4WpviITrJ6StS8kZ8=&c=j6PDLFGkcsBF411NPkmXRVNDyY/xc1UT5Wm2ot/c6Zju6twn0r/BTwdTges5y/iR8T sH1OBOvBSrqCIBuaPPhqnDPkGNnkwNuVFDPoHtfVYlYuswsxsOzpRNn8gRKXG&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.contentvaultscapital.com/c?x=Lgj75SJOKa9HsF5gWiqiG3RG/vNN5/76TDthAkHBjp4=&c=hSinkR2wNusZSvUy0MWN/G1C4hBk4xQX7r57ql1VD4M9peJtQcub8ETwj5qrmuP0Beq4wGaYp8zaJJd/WCBahulPutVJ82mu07iNZ08YOfBNoLcDOHoJIR/KJH7VpyIN&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.softwareconecptsafe.com/c?x=blj8UijYVoCFxnelXCzrlDb2x2xjKy4ZLhX6g4r9D80=&c=gMdg7gZNw5VoHFqEp1q31cg/AL2YOCf5Ja//rYFLhV3Xomq6oiivhJGbychDOiSRyqu9vYbyLqfb7d kJOjebjI9eIOHH90CYkCHWLi682TWQAa4R7DJ95IIZPlNscRq&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.cycletodayhost.com/c?x=9vSfjX6el 8l014HJSnrteQCzxFlgyxGuqXl / l1zE=&c=QVj9JhyFZWrUthYsi5Zxm7dCnCmSoKF1AQ2GuMms9Yqp7lc9SNwIoy567O8RdmjEKf8Uq/FRisaPvCIMmu1Dg8Hhy98MPY36NMHHP8Gspo2j0GKi4UKXai7qLiuaZ35t&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.packagedownloadsapp.com/c?x=mZK2rrv0bnCKNn9n5lz3cbp2BN0cXiUJxuzBNmEo3JE=&c=MTUbMqQvuUqxESwrJ8R6Yj8k BeCGlZXevTYcB3y Wk1EygplgVIBjqyJ3sXqzaAaGoM9lXVxO OAONLPfg13mca7uQliRwgHH OjGv2mx9rfrSV591FGsjEqGLY35RH&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.filesbytenow.com/c?x=Y6Vr6qWs6/ZvzS2ExKS8kdgOQ52cQz4Bq2ldn1oyG90=&c=9DldvzNTCSGLkvDgLWNtSAN4d/RLxmS7Jaf5YoPwrI1u2FQ0jqCKUJ2PwtoyGxJsKoz63rj/nBiz5m8biLzhFKB XQv9J05gpFzZwtfn6sP8v1GBIPQHdvXgUplOLjP3&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.centersafeclear.com/c?x=ERZYX8Qhr12sMqyIZhqisN2q0rmFOlTC0XE 2 9no6k=&c=TVqbtIDSqO85tvA CAuTRM4AZyJoyoactHKzTNYzqIxFJ E 6ON5WDgy GmN844y1FKwnl57PZyyDgpACcV9EddjNseYS15V3Z2b0EUM8Mg64Jz 6oPUhPhUzgEX Cg3&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.farmcenterupdate.com/c?x=aHS7Wb4LNEjZRrA4euSgO92QVJme2iXYNzFRKs1xQew=&c=wUF4iyPKTSMHBLsnzYQahBsxDMQrjAo1XnVwwk9434Pmd3s7nSEQAlaawTjQXVOtEcI DkARewjZGLBpznfGrg0EgVsC0skQsZvWM88lFtJ3JmrQJn9rauSBXHLruupL&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.hostpresentrepository.com/c?x=R/eEPljaBms1R3BhKd sExsGIm7Gq5WDMf/u0YECSoI=&c=gFGUx9l172iJVEOiOPm/QLdWZ8 S0vXpOCpHpKisgCt12EAquIMNuAxROKyTcyCigyc39eX0wDP6 DgQqyVP6SGE0n2XmeZwhG/g ZbqELSORdf3RRFqDHIaHhH 7HIK&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.giftfungrab.com/c?x=duPXXJbo72vwjBXF2nGqBu70Z2sr4mb Z6181h3nv70=&c=eD e MW74NfGCrqBrMZa4bzhn4Uh5RnbgEZMNPLTnlZP/UpPW10YeDQzFdkJShrRNY4cbzNDi5d1kQwcgFuJpMYD0q06ZJgaNZ4vquQhREgtfwRfyKbpwG4eA7GsozDN&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.deliveryheadcentral.com/c?x=VPD5ITvtygDx/5gwMqlXzG5DKYMQeg8TNgmnz0z0WwQ=&c=hgr3ACa uHnv45PkYb2 5Lfw3dAIZ0fat1JH4BJ2FpYyDalOYIZsJxlTESM5JnqXrtyUkIbpiyg06lMaGYyrVEsUSr/s0Bwc0rVHgrhSOz2GiYIac9zU 6ErlovwDWmM&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.centralhostingworld.com/c?x=rT0E7JV43g7WXIDkA4U3jiobwJq6w3Nvou5NfwXohjs=&c=9Ge4sZDgBoh2ebZkCRs3 JRNUsvYOcpvblo0Vi3 zkHPZFW8FK46EEzwEEzwPhHBb9JcmiUzRUzaoWs4LoMH8qAnY6Tj4fxWaF050AMd7Un 5AJkkk7YqIP5fUP8k5LC&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.tourcentralstock.com/c?x=HteyOrOWdggq6LMNqqIFLU9U3szHd1HK6x KRpo/8VM=&c=CaGMKtRVsb91VSWoydZDaJFW2FEwdt5X46XLDDniOpCZ3tLCw6z74PSeZOpNOKr37M1tP7B3lJypaRIqSKMidE0U24R8x3IEbZD cHm/aDoGWO32kOBKlZskgueQJmmO&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.deliveryappscurrent.com/c?x=LcQW2bNt3kvlMlrQsPdyvn9qtPY5q8YwhSGNIGz4g2o=&c=kVg5BffFIh8/a4idhAvrqZXZ7RdkQW01W159q6IgW6k0tX4wSj0o5I4 BWdFe4JYE/DCh5EcGGeFcgaUvTbB/nv/flu53eAd2Mcrj33NOcrfUV2 jGD4hwAKSxi0bHuj&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.hostingtowercity.com/c?x=z8z13zyMCuM3tIsUXz5asV4/eaSrOwImMUFx8ic6OaY=&c=z8UXvhjDeyH/zxKhs5MBo/lHkrR0Ttwgq9dKl7yVnW81ocs2AIUkc9vC2gJsda57p42lmQezsZnsWell5n7EsjPD a9F9Fq5NM2n/eRMVnQn7pE2xI4BuuyFZwnHAzWb&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.cyclerepositorysigns.com/c?x=MxVEJNUIFXx6l4i0Q VM9vu1MUTAnPNFmtPCA f3UvI=&c=aRmuxl8200Y1ryIILMF5KczmlUzR 4BphFFXO1syEZr52vVDTLNo1ozL6k7A3z8C2 SSKDIzDFA5SlKfWB38Z/BWnVYC 8Kwga/Z VDDxO4YbvtvrpKqSfuuhR8nc TP&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.laboratorynowlaboratory.com/c?x=unvaL1z jAZQ Gg5jTcklYkr78hbi99V48yRejdTAXk=&c=FYn9ps 2Ls0m74xhqdf4O8phBb y5rj/YyhFeuNadGZKmdDwc43lks4IKAJjXGjZFO5rT haaocYBOv3Bcvli9gbmWA/1dEcuOXpgGsy9n4ng7efQlkVMUURVeF4lOzU&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.packagedownloadsapp.com/c?x=SiZgMRG3VFVqsMAKercpsrYSROi981YoKCtYK/sIWHw=&c=kQBhVJzcU69kKxIWOE4FKClnircFqov6NEzBXEEtxmZ mPeq9mjaQrlqfBbhhJb Q7K2EJbvPotrATwTaizVdsM4nk5ojpPTMkvdw6xVFmRAn5PMl4Gu9K4wiQdTrZWJ&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.filesbytenow.com/c?x=OK3npQE9Aq2AqwruN/qBbllBaPUftYCdPNKKY98p1nE=&c=pL4ocR4aiakVwu4HzkMtSYf3p87az0JG7t3l1EfvSkxboYIei2jBvVZ80PzLAFJb5JaxKaXodzfRmSYnGHS/9jy2jajyueW0vQFjEj6E8kUd O6wsCHoftH1Erg46lMv&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.cityvaultapplication.com/c?x=kUqhwcQ1gksISEvg8LPOdQK58qle1SRCcuu/HQo8yIs=&c=xyJNrYgFl77xLPHpTker79aQqBAICcbeu767WoBbiaKZXiz loQgtX1tvBJEqcp12UhRk30ujB 5a9LhTs 5qj6cCnaiWzCeOPNskiiMqoMvbeM9hDNSSBF9JDqhABwl&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.cycletodaygrab.com/c?x=MaSlj7DmtaFegtY050FN3uOoUxfevoWmIU/GSP5LOW0=&c=78o0LicTF36RXYzvpuq4rGfO6Eu3L7BN9Xaq0ECY40c0CtshdDJ8cE6K4jJWAXVSgdh7j74gwJDgscjXkjksIupwFNuMM74bpjBQCPhhKk2kSi5SsrKD Nc2iyIRKmfj&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.filesbytenow.com/c?x=ICAzdRTHr22RCuxjKYktfzUnN1ck9ozPDekyk61o1Yo=&c=SQAk0ss4v2SAhHs/0Iy2nO1F4tnWs7oNHXFHmxvyU 0gXPZlj3HXX2ouNuh0lG 6UlLT73Subdmo0OOYi00n8 jq 8XjK5Sudl95qaY9wlQZrvY43I383EJQaHTOutye&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.presenthostlaboratory.com/c?x=CJ3sZouSJo9i9ftTxv7NWVa5EmvvWCn5UafoYWclaes=&c=c5GoGQc9W7tOoRon6ocGSnGzBUOa1vrG3vioesmA8rD4cR5Txj8cPWUowkxXTk2dVHX/l7qiSj5DSshHoOyW4fgj Ne/gzfId73lt n1GW2EA5fLAKf3S644qhMFupcB&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

http://www.giftfungrab.com/c?x=BAsWfBdG sfEgJuYISjcdRkj25we5a08SJhPbDK450A=&c=cnZBL8tYbXFW0g5Z6CzHGVp3YVAnSePmDOPwzPFBWjZ4 tUh3yuhSwroAepgQRXvM5R2GzHFRqqBfWb 2Lkw9oxe3IAKlfV9yYyqRx Q5RbXenoD6xj93sdsYI7GR7QF&downloadAs=BitZipper2015Setup.exe&fallback_url=http://www.bitzipper.com/.../newest.exe

Latest 30 of 115 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_bitzipper2015setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.