home

icreinstall_c.exe

Application Installer

Criteria Quality (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_c.exe, “Application Installer Setup ” by Criteria Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Installer   (signed by Criteria Quality (Fried Cookie Ltd.))

Product:
Application Installer

Description:
Application Installer Setup

MD5:
6c1721210d94c45259e8dd5f7217f322

SHA-1:
542ab0a1ec50b93aec6aa103241e705a72302ae9

SHA-256:
e610cb0f24eb6533c771c8473db4ca98ee456e24393675fcf5b457ac797adbae

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/29/2024 3:48:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.25.13

File size:
969.4 KB (992,656 bytes)

Product version:
1.2.7

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_c.exe

Digital Signature
Signed by:
Criteria Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 12:21:34 PM

Valid to:
6/29/2016 11:39:55 AM

Subject:
CN=Criteria Quality (Fried Cookie Ltd.), O=Criteria Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216ABCF20419312093F809F0E003C850D7

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:8N7LKXirSl5g5MYuHz9GNh6zCaWM4UEIBtot+k2G:8R2XirSXXYuT9GrMDE6Rk2G

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_c.exe has been seen being distributed by the following 9 URLs.

http://www.tourworldmeta.com/c?x=WhZ// GfVA7scmfKdyLDQvsSzay7rND 0FZVDTmosD4=&c=jiFVnMCP2DKYJAjK/wBCzJ1Yd0iTbURgHPi2UQgUUQZdXAAWJjehO7d8FKwmNRmnA/.../FXgRV2b&downloadAs=Opera Setup.exe

http://www.giftbestsafe.com/c?x=RE3ShlFVZCi2raqUH b3WY66IlJ5ZtZdGV2VDy6VbUY=&c=DdsgNspx71B8Mre3GzabkaSwFJBql5jCTescyAei JPpTGdxyTlF BZC9xkfbqVv1L xACFCu9G4hLPkrgmpdlPzC6GwPox56HIkKlkoMHlTz0 yRHrTzfq2vAMMiDqj&downloadAs=Opera Setup.exe

http://www.tourworldmeta.com/c?x=a6UBf2izBYVCrWRZxHSZ5mcAwEHPAKf45D0VVUBwAmA=&c= RLIa6k 1BvKwfSRxCAmfO7THZFE6KdtFlwMhJu4hLCKgkGYn mRkDiWVLofKb ZpPo3yt/.../tStoAaoQ6iSooKQrm368Cc1vgRWg9x&downloadAs=Opera Setup.exe

http://www.tourworldmeta.com/c?x=Dxu3G2/dXEQwNmubBkDfhrNoEmy0T0sbRN9O/zBvKfQ=&c=lBNxIve1gzEZegCI1HlE7syv662OnNeaKRjg0MGrEJYqdaICcjIEZjMgd9A6pr3I67//kkKPYetNxugBggHf9w02sBVvxRUoxfOiz5XeR9TsKPhk1tWEzHQBgZCgzNnn&downloadAs=Opera Setup.exe

http://www.giftbestsafe.com/.../yJvH8brMglgqXl8e5xQEpx7DAlGmopUA2h75YjXInHBN0FzDJV HCPZChL4m94XCI4uugS9Y2wIF&downloadAs=Opera Setup.exe

http://www.filestomes.com/c?x=YvcaJ fy1aqEiluW7k0lyDKPk7Llcf1EgMMFjOibou8=&c=vj8gs9wpPdSLeFbp2iQq U2l5PQMs94spYrq0ByvnzOxjUYL2jEDlYnB eScjLsUcp/EH26dArb4Y3870dS6rLgkjR0esbEKGtpC7DL3tLYR1D59p9A/.../&downloadAs=Opera Setup.exe

http://www.giftbestsafe.com/c?x=RVs3WcVx4iHFBHaTe5UnYsTvsAbWqXnmArldTYpw5lE=&c=ngGLcTKJJnw/9Y7x4j EWaPh0LGIexHXY6t/.../uTbvPskvgmRBguDDQLbYxYyonC7 &downloadAs=Opera Setup.exe

http://www.tourworldmeta.com/c?x=FOejqlce6T/mkwAmYRHxuP/PC9bafAbX/qLrKPbOdIw=&c=MVM9PGqNLBIuXqG46n9ZmbuO/VPhcLqJ bSWIt7mLqKDkP0rvU5pHzQeZoq44N3Ot6DIcSHcGzZMRDoX2 omiQWaD/.../5or8pOss4&downloadAs=Opera Setup.exe

http://www.giftbestsafe.com/c?x=cV3aTWQW6SPZHd/za38/oTKX2a9vPZbeb3CCthV/SNU=&c=aIU1AXaQUe pwyQp3uur8kqVQgXIUbfeY6Nq/ZHCEhMCMy6jQO4CP 9on0AJJJcGaQTXCO0Ges2qpum12b0vdARfE/Q7st0j/.../taI6G8dwJD5uSL808wNsV&downloadAs=Opera Setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.