Malware scan of icreinstall_epubreader_setup.exe (Pelah ) 70a0e9b636727754c225e1e5f5bc15e84e277542

File name:

icreinstall_epubreader_setup.exe

Product:

Pelah

Description:

Pelah Setup

Version:

2.0.1.1

MD5:

24789506b63c8cbea4658bfaca0f201f

SHA-1:

70a0e9b636727754c225e1e5f5bc15e84e277542

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/26/2024 12:38:13 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.Installer (M)

16.2.24.17

File size:

1.1 MB (1,171,767 bytes)

Product version:

1.4

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\Documents and Settings\{user}\Local settings\temp\icreinstall_epubreader_setup.exe

Compilation timestamp:

6/19/1992 7:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:YSlF8uRG9AbQ/hT5cqv3/XF+AoKbl6rAqchhMdbXNS0kwzC:YUeuk9SgrfFOA3Aw0tzC

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file icreinstall_epubreader_setup.exe has been seen being distributed by the following 6 URLs.

http://in4p.com/red/out.php?to=http://.../?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP+Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG+HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx+vWp43WFkmNH6mo60Oc6v/Vib2W6S+VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF+pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI+9YO15xyE7OkN5Vl+DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn+p7sdZcWwjqcB+diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr+FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/at0BB73UR7zCPB2zK6JQVE/ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFM

http://in4p.com/red/out.php?to=http://cdn.rsparkcontent.com/?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx vWp43WFkmNH6mo60Oc6v/Vib2W6S VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI 9YO15xyE7OkN5Vl DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn p7sdZcWwjqcB diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/.../ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFM

http://cdn.rsparkcontent.com/?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx vWp43WFkmNH6mo60Oc6v/Vib2W6S VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI 9YO15xyE7OkN5Vl DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn p7sdZcWwjqcB diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/.../ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFMEPFVG95SKvQ==&ic_user_id=225&js_version=0.1&fallback_url=fallback_url&downloa

http://in4p.com/red/out.php?to=http://cdn.rsparkcontent.com/?data=jI6bjdJwckDIVnDfLF8wqlK/6i/O7eP Vkak5XBFw5uFTMgY4JSuhp6Z0OgwYbQa3NDqONE0K1lOxDIG HXpRfJ6NUEqmaheMcw67Kwdc3kKYoTUFc1rlx vWp43WFkmNH6mo60Oc6v/Vib2W6S VjeGlKSkcpp37MiwGwgBSqIWJy83NOvlv3kSB4stFIpKp0LW5iF/MrL6tpPjsgrGDXoOARKjKIhCn7UMHMmDPiBhkPkt4j7Uzu2lN9FIiyXxhTWiWhF pu87gihstlE1FPz6lhKoyJTyhy44jpUK4Sndhp4pam4jIDy0zdHazE8X7ak02PcQYKAEO7FGPpI 9YO15xyE7OkN5Vl DGUJrpJWmYFL1tCqHNppXh0dMu0s3DrtBDh8dXtvOykkYB7XW0LULkfbYMSFm9lcdnowLe5puHxv4b1bn p7sdZcWwjqcB diZYmwCl/7fsqqW9bKEMJtey5woT9o1r1udQJSKNHecSm/BgAALP8rZqD6Fsfkip7U7dHDdz9wDykr FsiACENaRDCspEIZ43bmk=&key=ERzbdWCqrde34r5CtsLho/Xo7kvXaIRrKWGgBswR1l659DbgxREjpDcx7c2oCkZJQJdv74qZlK8P8EEqmE6iPglgYzyzG8qTSShkfdzK2I/nQeD2umiepPL1eFEeuaem7KpKg36Vt0pn0gTnsqfTuIt9rpEagSgEgC983zpCTira3vwX/PvR2upSGmCce9zcxgq1afqNkf2t76DpmvFrY9JSHlIHi6BGrhxOAaiM8trQDxe/GqRluiCt28PlwBjSSKS50LwZn7viQMUM/.../ySZjppHsktOaPGe4egeS7Fx5nTejCmHOUFM

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to os.solvefile.com (207.189.109.121:80)

TCP (HTTP):

Connects to cdnus.solvefile.com (207.189.109.121:80)