» icreinstall_clashroyale.exe
Overview
Analysis
File Details
Downloads (12)
Network (3)

icreinstall_clashroyale.exe

Mafelobes

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_clashroyale.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.bundlessignscurrent.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.

File name:

Publisher:

Bemadetuso (signed by MICROMAX STUDIO, S.L.)

Product:

Mafelobes

Description:

Mafelobes Setup

Version:

4.1.5.1

MD5:

66504e37f285e96acda4e0e92c60f7a0

SHA-1:

4f9238beb21cdabde2d53ed5866bbceaf883143f

SHA-256:

dab9af06082ac67319ceb4b2ba3a3bca1be2fbd5dac2d2b8a30e2263857fc40e

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/23/2024 8:41:22 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.MICROMAX.Installer (M)

16.4.15.9

File size:

942.9 KB (965,552 bytes)

Product version:

2.7

Fast

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\icreinstall_clashroyale.exe

Digital Signature

Signed by:

MICROMAX STUDIO, S.L.

Authority:

GoDaddy.com, Inc.

Valid from:

9/1/2015 11:11:38 AM

Valid to:

9/1/2016 11:11:38 AM

Subject:

CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

79A6DBFB5606456E

File PE Metadata

Compilation timestamp:

6/20/1992 12:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:sW2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:szJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file icreinstall_clashroyale.exe has been seen being distributed by the following 12 URLs.

http://www.bundlessignscurrent.com/c?x=4om3rEcyhJDNgaTQDATng880zMVWfw1X8xerHyvkp8A=&c=udp/0TZc27DuZ4KKSOjfQFLrE9BRS22qahTIP41jExtpgreqIGq r/G4ZTS0mOzHRzAQkBZbWvUHGBegixIvdwjTxAxGwjB2TAms1RcoeWnAcYaVPm7CbAARdlXgmIUM&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.hostingflashmeta.com/c?x=erD6z 0cwN0FKJzBUh6tyTp8zNC5zogHOia31ueXxjs=&c=wDKdeBnTt8ecbBNFnXdDwCsdPJ7q8zjFkNRsoTM2wXIIkCwjXi8/ks6IA3d01MchRTGxg4xKboqZ9KjYBaxlgGspnDKrPFwVRs0HE7IFpDaclobzVEPsoszQS4yxhZyp&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.packagesharebits.com/c?x=4XpxdDeM1jEwskqIOdxB2JlD8k7V4XKp9hvCdipdsFM=&c=NJuN2HVdJ4cxeP 9H1nsXomnY/hMnnPchGDd 10hpxe3Uw49Cw6LFG52FM3tv/Q543uZytmRaBscSQu/LVD2ozv4TDLdpW7bA9uXpvgvnr7oSfnL2HIG0qlEwt6uZQGf&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.signssharemeta.com/c?x=ZyHwI0Q8YQbFIHzmomD172LOPZUvOU0vW9fX0dUVKxo=&c=OyM zmR1MI8Cc/Ikzhs6ZqTP8P6c7AA1vbobMVwFDRKnhztGof5PwB3hT xwFguyMAZTr90VcezGs9OuEWEwxJm/4rYjq0QY6PA9c/94XxBA8nx69kGqP7MKBw7JPZ6&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.townchuckletours.com/c?x=zPDmslycJlCkgYhOcOeuCQNsF4oLosIjef3xIvi/2Fk=&c=XbhyBIbI5EeRBwtTMAJBIPWS4E6pE7P9ChFBE19q/HQbnq1B8zABcGQ4f6vUJ1H5V/WqOv66p2eS3Za0nWXPUWqSQrluhPzn/2SkUkpJd4jsqvEnsFc7MLhKOGDyfYaw&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.dlpresentapps.com/c?x=i6R9Arm0tcuAPgo2XSZmD3rvpi75YN Z3uX0fYQmufo=&c=88ZugBuSnR8WQIWa8Lr3YGHd16P14JUyK3e6VJlEVlFvYwDLbllEzXdu4f3LE9F18AvFn/ilVO4rQo4d8OmqEVyW0to06 mryCs6g7VQBVtouGugyta6QKzANpqmlIXB&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.bodytaggift.com/c?x=iQzUWYMolA1F/lW5B8Nug1n77ABfz2zYHgx0kT8q hI=&c=nA9zR12R7PbJb7oQ8qg8eFnxo6IxZWyFjODYAqATtPhNvnQKO9ugXrX7uqwNaxiNrsVUrPowABDP2s1LK31f8IoPSx6mw40nEfMPqaENt20ygeKqrbEDdZ7CUGjw tP7&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.contentsignssoftware.com/c?x=Vqc9Dcwj63ZE/dSpH4duABsle01eq5NGshKR23gQFIM=&c=hb1yuvKJTzIUiYLcXxm4RpRs 1weX3kHWLhWnskC CM9ZeocxzFkBlJl6LAkTvFdWZUI6DPMVNoL2aruJ5J Wkus/F1asChH8J5NqTYEcTCtuJr3AO7GCTyrj7SoBOHS&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.quicknowcontent.com/c?x=NmleQdwt4OIM4yWng11fTmpuKNoh3WKCvWzKt1s7Z3I=&c=6dWqH sU6xvVEb2wcV8sH53s 5t5rlQjzs1qEPGrRomscJ/E5K1ZcLKiLY1FsEIfwn An/oZuHuDmCaunOkXC5LdozaMT0ShEsPL RR60OYB/z42u1CXo9PmnB6JK K3&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.bundlessignscurrent.com/c?x=9a1BFutyqT3lQNM54pPrWcsEETa2uQm1hQjky1uBoNI=&c=PRhvowI1J5DIdulJLO7o4YEvSv9PfhPFAxK6DNlvHGrA3bPhBGDg7m5vknTqe/UJQBW5o8vy3 j94iU5PKXIjwGLTTsZnMplpmI9poQeNF9Pz7/5iKdxKD7fyA7fhCNr&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.bundlessignscurrent.com/c?x=mEDloRXOpQCNM7IgGLhr53iLRTOspKhP75HuBC8OsaY=&c=11p85CgR0x5T2ulcjFufzAmstENTVYbDiI78FpFfwTDRUUm81rWflZfljSxSr6vmixMl7VbQTnpoI4S/II201 xIP5B2DoGVUmopLuiw0h8YSBNdHcOCdcQZiYjyzZoS&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

http://www.bundlessignscurrent.com/c?x=X53tjK8TJRqzD/VJ6br LcuvdpukksHGyR91UHI/JlU=&c=Z54IqWugEeTvf395e3s tG7mhN/CQXynJdDRBC8vZM4moDOO2Dtg4RRG9r4PquSxugJT3PZWEnd1HIqTVHo4Lp4lg6ZFPaqWARZLLK0V/IasnzAcr1o1kKgBVl2gIetT&fallback_url=http://res.mshist.com/.../ClashRoyale.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to os.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdnus.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdneu.webfilescdn.com (65.254.40.36:80)

Remove icreinstall_clashroyale.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.