home

icreinstall_c.exe

Program lite

Bibado Investments, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_c.exe, “Program lite Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.towerchuckleclear.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Bibado Investments, S.L.  (signed and verified)

Product:
Program lite

Description:
Program lite Setup

MD5:
b4bb5a8b6fa87b411a05766c30e17095

SHA-1:
7ce5aa1b6739a2ed5d72a85ddbcb821992e1341b

SHA-256:
4bbfbd7c2002ea79ff2ddab46690567aab3e0c8505316680c0db3fbb064c6fe9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 2:29:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.1.23.15

File size:
995 KB (1,018,840 bytes)

Product version:
2.8.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_c.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 7:27:03 PM

Valid to:
4/2/2017 3:02:01 PM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:c4e2h0lI9AaG0ag78xGvA3nTcWNQF2vzSuN1pKm/Qvj:c1g9AahalJTcWNE2vzSM1pKm/Q7

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9284

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_c.exe has been seen being distributed by the following 32 URLs.

http://www.towerchuckleclear.com/c?x=LeXWsn5q6fgRtiarY5ShCsIV9HNm7WYkxTWbRT8cT2A=&c=SrqzxzhvmhR89LtK1zcdLObV69kZuuvpbpW6OSe0jE/jWqQsmv5t8vXU8qXAPd9WYeQSKc7cs6CP8LGs9qei9tgP0x/4sjLR6CTvhGi8wVcyXp1TZr05idTK9ybDsnjqakaVn81Ok1j57XlaP6fDxA==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=vvGOu0QqZg1A8TmpoeGwWGInc1B5taRAuP LUPmf4as=&c=zmuAD6q3T9tYSOD3498npdzspYQPRwMphPltmKxp/GiushW1RwTef9VDiWMQkwySjKExy8vOiCyVR1fBT/bPLehKn/ib2 Op/YPAT5eQypIbozG34xPr1SQWICWl86sPa3kFRw3HF8PZxZIQ5MYnzg==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingbulkbest.com/c?x=RC gMkuQQ7XFScnXMfkHe6RSm2Fpz7lLB4dszcVoMUk=&c=bgeo54S5ic6sDCWX0sY4CvAllZcYzPSEBBPVaR01AfzMo2TOxk0logeD1U668YAwIdVgO4VMj09lCUKcMFtbx5aYV0hQO0lUOcmMpW/NapbqcSWwJzcPuxeaJ0EpCR6HMYg6/OaAXnGO92YMf3w0JQ==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=rJ3suR7OxDu84cRQ4RXVpoOceSN8hLL86Bw0agbsiFs=&c=wYxtKd5HYMR3Hmxn4i3tDr32Vwh L S2c/RYTU2JdVx6X5rMCXUQ2cfJa3qn6l8NoPAoDI3zMQKSZfFBZFXciof YvpwIWjAnE39kVAL9rcA3saZVwznzM19uIonzEGBK4sZccKDaA2N1 D OXqzGQ==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=4HES2UG2lO Z0TIouRuuMaAO1s18D/HeDh9La3Oj3Gk=&c=QNwC4pT EbprFSJ2UdxRP7NZFvT6dgvr2 INynq7XZCsRk2 vf0iRpCfnsa2ZkgIUFXxMl1w2XO9oT7ckHwjYc3VYpk0aUhO14Sbf24KIPwyVk8OaRQyMIuxdEckvmmrUJQbdUpZgHCKt1ExaNPThw==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=jdGyfsJGBNeXjRC/dGeBORePCOSNcRj5ecXIEyyTINo=&c=fajiEh5bUi8hWyMjmpDhrRua5ImMiPTEEbfakNyUI2Srad2S LUmBCEYejeyo/VN5uwEBQiWNq6HPfVRmDNicvQbLpn M9ofGIkXIIOIM3meLZOEWhCYl3ldhn/tturK8OV1tR6WW1TV5yqCCu6F4w==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=jvH4v69LzCEsQMpLnDZe8PMIWgPSckviEwPFWhQXaO8=&c=fU3O7Hcpp/0/4V/nGuY9T6KU0OAsCQBv5OofW7zyzDfQelQPx135Smn5WFRVDW/Yxkf 5TgVYW RZf4OOY/djQoTSyNV QH62w8 6Ct3p0O7OGad8I51KIOUs7GgmCkXbCqJobaq3IqIj1V9eUywZA==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=TQanQIcIBcoZ2UUwRuMkXzG8sQA4U/mcEQo1UOJTU/U=&c=DfZjs/PP7RXV/4JqDnL2RSOfJX4m/MeZFVdMQxYvPKBIPe1ZYEePEq2MDBW9qfLN3uIJfb0ojCov7vYmGQz6U0wOIZH8Mt0fII47jNu9 gplikQu9BSiGFOC7vYOnuw8nBzdnBfY4IzIuw9vlqt5m3MUi62fVmQjcnI3lh5VqEg=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=NAE7DmQE da0uGmY04LvPIGQCTp4Nk JMZd7nE8jM7A=&c=IzTKruPRaR6F5OlK3b4AAf2HJ3gxjKZI11WwavyNzUvESbjwLilpFn0zuRdkTmbTMQK5P7Qc9G1YCnfSMRX30UnRqddH/bUVC375D7k/j/DhQGaC7XjxWBecDywXyiiXbQDUWQ94QeHydV8WCqD3Ew==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingbulkbest.com/c?x=8x0CTJi1hvnsn/aE0GgbOCWmrj7gsUJ0/B8yyXYBXU4=&c=5uR7Y7B/lXfn2zHFGWSyBVmutb7F8XZ1NlpcZO6675o6VCsAUIJ9g38XjyObyiQxqVoOpAPINqj45TqctxA3dhOESUVYBdvqpVnnqyKeL4ITJ4bWrdU/sQJ9tOPhtfCSphn9jfN34eGRb3d9Yj25pIx1HBROnvJCMSz2hDfzvlM=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=9yNQ7BuIStt2Oel2noE4OwJ89d5uaMFY2v6WudYk6rc=&c=vpDGhluM284MQPNeeRV5bae/wiWc5uAW4dqb05IorlJRIRhT0tY SE2fCLq0HFIeTr27UvXKimNYzYC3dYwj7rVgXQ6ALqPScbwInIbJoXLBbkqVxCDL738VkmE7t9WVcu9dpY9LZTWSZujl1ToXsg==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=s g3RuP2zDOi8IWWcrsVL6wS 5hurf8z6xDWUdnUVjY=&c=Dt0YabFHYrtItqe1w2PNnXryLpfrYJu/0bz5BXAKxczFEMxD2YIcM/Zd JuxS2xJjMSUppcbMgJzq/HFtsqDJ2MjBbKPsh1zTZoX5KK4vOhL7tChUtPg0cP 62JTqRmWOnlMBURa/Rb2vZvJGys0Mg==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=JA5CrdKgt5PeUDzwUm9q1IsjOQdHM84Jm2yr/2bhByw=&c=Mwm64kkrglFXruXxBzsV4 YNb24T5L14CWM4r /RDC6S9/4BrQh3RamGBTgrIMW8xoaOpQ0j/aed4BNrobsxMQ7/koQNyU8dgzauKdMuVu2CtJtuI0XjNll6UfKSnlAvdCSWotCGt4GzKrm 8PSY28ErNMyB/4TmjYi6Pg9YkQE=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=xWCS4x4QlJnngg/hK5G94SJMa00NrnJ/ mT0PLkU2xE=&c=CINuHR/h/VnW0a6ZnksfFUspl5a372/8Tx936NxTDccrwI5/oZtItLC4oyEcwCE6KMy IJHP2oDhAvEvvboSnigZMkqKIkmja6fx65MtQmFb5She7V9y4m8rbniqv2l/an9joni1o sLhUPZVStDxQ==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=KkvBknOQba6RhoJLxDue02YmNFYuURasxXkEhuG7prs=&c=Wc36PuZeaR/d1w3UmlaUWWVwkNTw43MYgGgeM9uQF8/ErbuYp22fxOwzvm0rKCDbH8oXbQSORd8ae01vWjgNdcyzYYQykXOHrEUL37LMrKj9m2XFjGstzKnex052y3E MGNIMMmMreY83W0A xGLiQ==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=d/j0Thpb9KTbeDASwjVcIE4FRp81beMzsIl1lpc1bmE=&c=iEaz3X8V5DcTjnU7 77BXtn6lzF3p8zYLG3mcR4fpUhow r3ThmiSoeh8RLtXlltIFlY0iI59ydcjE200K/c3je7MLlmRtWJtJhVS29hupIXG6GmQd8qn9vF1RnVUlgCzgiLDPfbt2f22dvZWp SIg==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=tWJt8wBUUfrxV3suGKrT9HipZuH9Yi6QkitQ28datGo=&c=MPUyMl7fWUOCTTMch3guFvsMBAF3Zv8WrRW0rqlSlcfmuFTkPP5YYLzZH3fPa NMsdK7dA7mY4tWN1A4vrli LE9xv8XJrSLSxjne9AzTEHON54kkZICSxzS1mP1 qPDutNQHcj/rVYDA4N VbvzQ==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=ywX7fhMAk24UBsYFx9Is9uYeOadH8Fr3FZUNdhND6XY=&c=4CrnRrcIICKLyaMX/VeGjt5pO9bwMa LOQ4tHI6Ro1/BTUdRtTNa/niMsNsYPm92GJ8VIvnhjhUalWAfWx1XN7U4JBYfmKLoBtXPOcsGJeQiVPjnUCCdICx i05xvVeYYcQl5GnXB6BYL9q6Uq7gDxrfJexOFcrQIs5VlQimo8k=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingbulkbest.com/c?x=j0tSRXPNfu61xFH/Lve wohQe/GLZ6J3TlVikmKWcLQ=&c=tlG49mCSN0TprB9ut/PRRKCqmqgT40NSm43gB HcznYu9eJPKXqA m7Bl4rhfWzP3EplcR4C2wQNH082ENqROeGoV31o9AJ7bCXP zvi1WoncDV3Vo2bgeXtiF1/Oqol Hx30z2gB1jB/u7aWPGFhM8/hgGHXQkm9U xZuPrZ18=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingbulkbest.com/c?x=5as7QdQE/t jO/eUnkRs6Na6AAmx40MO73rus/Lmezk=&c=MbMSCCa1Zk IewkChOYpZDhMUk3TpTVBEvLKeeGM7eLw2orZ2MQdh3SUlWWWTW4EZ4m7zia0c3in0L/0hf5/l8chsYcnI5GLTo2hj3TEoUCv3SRDC0bNg2HlnSW3dyLW83bf4P3GQyYS1Bs1A0kGIw==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=wUwEog/KzPx/H2Ln5G8Nh1OTKyAOniqRcAQeijWkfTc=&c=NNYuSohRS9ulinu7Wv4/OvP5KMKgOJwkGtSerwjY6MFhDm534bSBOQ0cXW/zWgqcL 6q313IAj6IyPrNYTdAyvBnqUpAoYRzu7JDDRSYRFH61apogwz/FdTmG4hSGMe0KacwoBB B/Cg2zy8ju2i3w==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=CnFsQ7vfj8Z/c j/NE8CasvSX7Y9nLZRAlanDEwGJ48=&c=EQO1gyUgYts/dJ hzPtC0DqyYuvzZkXvlj4f tZUSkgUhHt9dR6 kPrK6ylUIF0k4ID4/mYLLLQUjsp6rKZ2py31bquJ01opDbqKl RuoaCZQfZMPONIafJw4qP4qCv50dTM3g46jr3sJClZnZRG7Q==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=fJwGQLeTQ6Lxg0Z4UGfVF9W1Dgd7OEXojcOkBSc3Mm0=&c=33vGsMtbrbCR8P3L3gP7mvpfGT90B4HCi1hADMSGfwoDgl0OluD3g/n3G7jOKugumIF p9lX zsZXW1rD3T8Jj9RT6 wMMjxthS7QE0QeR3QWqt0GOg7JDlMqpa/Q0XScIIUvqcoFq1ihrlLM1K2KMWD3FVnoAIALdu2AP7HnbQ=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=WbaXsLIH67Ou6oYZu1EzX0QcPEhNU2fN37FKRczFhaI=&c=XwrZ0IUgksxeDDZ9KabEwA62ZOrJ/bur7U/gQkCLfaGVsz3V8F 80PbCE5SprhYDZywQm5/pluzR9N1fnfsnT3pBS3Ps9D4ERV0d7nvYaCxVNBI/ 9GBt3y0U nE Z6itBq L1XEzJJTWDnWaJE7ww==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=LLJOcVGuMXljVGsQ4nMyqsyTN1jP YBCEMmHyxTOAv0=&c=WGBOy0Mh7r3rqHOup5jRjkTo24SwX68rr0s qWaTT8dW3vb6x B TL 6NeOiFizJN hpgfZ0Oa8qHt3ro3LQgVlwluQWjCi0YdznOfVzSE oaiADdZnNrK0lH4hOpfiETJeIN0JNgaRcmplv4022C4tuOGgXqiHNzskeJ8Gl87g=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=nluTCfH6PucXmSVzuS46PkDBAq0O2wGpu8RJ8JMa7Po=&c=Qe6pi/srioRbM8Y/n9sALVvvkyuh2ghqyi3IluWT6xIgd6PWRNns8p4gIZNp82naitAkf8o7rS6wwWJnxouJVBAQue FofRkiNhb4UHqtjKBffHI4ATnKzPwlPjkml/bq77iY1FR6DRUW39/1nTT4J0vzArT 1YAkvpfxswT4l4=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=ssm xxxS jLNfmTcIgZvKQDfu/rOyT5KZoHZmHNUSsI=&c=Bj0ze wPmEcj5MFnixXp/F1Epu98zomtbxhyxvgHYdHUAH3MePBy23wCxyQi6uSLTWYWQQfCuhkU5YvW8nluRbDVmhFlNtBTIguQNTRFa4V2EKzOmhIbmrDgtgg7xekSXerAu407S5n41c8MpAdSkbISwrp0YZFTwRpxPCiQcUM=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=CEN4yo9dwBprzRMrBAYn1iazfa9h6F7eqUMlb5GapHs=&c=2a8dA/3WCTIHRJ6 IErL41ihQ7JpV/boVeZol4y7uuZX4mfwYcb4733hsN1z/Seah8ZcOi9/UW6qVNrLxR/SMKwBRapKGbzXeW6W2XxurI3eKmB8zmPsJuT2d/w7p8lJ7fiKHcuoEeyJwMmTIBOQNVf8r1rK6sZrYTWetHN jVs=&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=imuSfwVIppcxnuiny3aLDHwIHy8c08w9b3jJQ8utKLI=&c=Mjw5HzSX0ThVTY5jcnF5FhLNSGDJUlQI0A3ppU/wNa0wU5jJ8z9no46QT ZxRD31xnVWz 1AeToqefYYLoXemB2jGfO1lVaFzhnTvOByzcrVDZqST3mHLF7VanmlRIBvEZl2CKKVN1q7ND1HcaC5tQ==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=yQEy9xvytE PXR1ZcK/MsjbCJNeRKIDxTXE7aY7zMoI=&c=HIbPa0nJ7xgrQdq9NkAUkzu6WnffO53krmXKcz4fzMmnGHuszdqH930qwF3bhAh/rBO7 /HDBbWxUVhwFoStlCyZEpd1S0UZnqyy9L17HqOBmnUPxs7Zg8VDXiMo ONsfQVuCOTGbFrQ g3ggXiR6A==&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Latest 30 of 32 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.