home

icreinstall_finaltorrentsetup.exe

Deko

MaxSpeedy (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_finaltorrentsetup.exe, “Deko Setup ” by MaxSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Carero   (signed by MaxSpeedy (Fried Cookie Ltd.))

Product:
Deko

Description:
Deko Setup

MD5:
1c267a408e7be9b2092d6abb9fc263c9

SHA-1:
be9b6ff68cf7629c126089afc8ba5198c3086b10

SHA-256:
216956dc558f43a12a420083feb0c857566fb0fe0c5ef16ba03333d50d293146

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/15/2024 3:35:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.16.16

File size:
1 MB (1,081,072 bytes)

Product version:
2.1

Copyright:
Internet Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_finaltorrentsetup.exe

Digital Signature
Signed by:
MaxSpeedy (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 10:11:09 PM

Valid to:
6/9/2016 12:06:58 AM

Subject:
CN=MaxSpeedy (Fried Cookie Ltd.), O=MaxSpeedy (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112125C58A41E827F13C76AD2A1D648B8808

File PE Metadata
Compilation timestamp:
6/20/1992 7:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:gpurc/q1bLyox6DNLufhpqdMsmMdRemoCD63B4BwBolNrmSR1+v:gcQ/q1agqkdcdRExu5Ny4y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8969

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_finaltorrentsetup.exe has been seen being distributed by the following 17 URLs.

http://www.towersoftwarebundle.com/c?x=SwxFCxlZbXDuCA32F J2OzRtA1xw HHxEg 1SleabRs=&c=3/zaBCQ0PzD20jWq4904bLjxrXcWRIUnZM BUW4LanUaoab6NC8Rkj5o tZjWdsVE3Q2BtCKGBoT3Z2xyGvPqQplGqhulGXH/vRn/zlrzDNrlx9lkjQXktYg5T5N2j0h&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.stockcentralsign.com/c?x=saRnHbj5NZvaS2W6GH3joP3E2GYMh6aqnCgYOsJGdr4=&c=Xok/CIqHUfyLd 0SwVGzVGpJaOLu2u9raaEiAdWQ Nf5iLkSngTYyEwYIs0DtDUWSVvHnpSn6yYz7kRNSaNAFa9AriT4quDIGvHxqL7YfRiXk9QTKQxwPZR8xZL66H8f&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.applicationsharestock.com/c?x=4q684/ I0HHO/7mn ufK710VZTYutZJwzcDSxfN7CLE=&c=20SdcZ2BgFRtXwQPEDNEOye5OX8e1XvJgsi3Yu/c NcV7wCi nJfsNVwJ7wYfhiI0Wbk9AS 5C5jnKjXNmszK/9isLxYO4QEc3dKz0opy9/6Ermmr8naDOIS4VrjqRkp&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.conceptsbitsvaults.com/c?x=Z0UBDRAL4pio4Q/0LoTS8kXtk6Ahe3RZppkG/fs9DPU=&c=dCyouKDh1Ig8 1RzT6WHfi4NO83zeKBNvziiSo/zqx0ncrxgjZqeo0ZBkuHs/pNeVkGYp5PkOkWn0ciIiiM0Z174UzmvYVmV oXkYnZS4hJk6RfFQX0xtprt6M05KQ8l&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.bodysignsheart.com/c?x=XFYSvLta9bdwukZ2A0BKXi2hYucY5sTxi3 bLlxcZr8=&c=lc7P35biprbSDZOoVO1WB9O7T7glA6NcqJHhWqnexRSIgaiWM8ai6XLlULkpxso6ImU/GtBI3QuzJyxG9srRZMjsLMcUHW7U8qWqByJF6B2mldVufNyMrYTvZ43WpsxF&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.giftbinariestowers.com/c?x=DQngj0U/YmOCv3J8p9 n0KX8ii3VtNnCwbQHy9K 8xo=&c=fFFsdbC7Y6 96rL5MNHP/3PULBBiNyKsetsFJCYpeAXKgr3zIOvLauDCdJ4Pvog7SBrev8PPZQn0BMQxFf0dZekglOI0XD7OOpA9KxUBEf2VyKy3FMlIv/tyfX6ePwBP&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.binariesfarmsend.com/c?x=lTYqsz QJPueNPpoICYySjVUdZsgPLs4f6HTrEFdptM=&c=M8t0 saY6sSXg662k7fpMDLnilaWmzaMGd0HUkkeME90Y6BpKDyau ttM96c8IxUjOnaXt6AcpaoUlFgUNxt 4OuC jYkR4CxHUqQ9hPzRapLA9Lw0XhZqleJ70Yk269&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.cleanbyteconecpt.com/c?x=j2IPIJx3CiKKyAfa504vvRK1ICUawr/eVk8eo75K/R8=&c=DCpsWTOs mEtGWHvb8oaAlhtFT0fNULr X5G2BIz4dVRQwuw3DFyE2I/TyEV/qvocuUKndCiXjYIUK62cyg2xk8sN0hAkzi718aZuPp/v i8eh22GG4l gCKQiDojtVd&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.giftbinariestowers.com/c?x=4 G9tdtCHxaqKrp732x4PH4EJiv66u/CU6Wk4AERq/c=&c=/1Qw3dKCAMVLCoC6R7nU0v3U1BocaJHV0QT4Qm4gF0/GhT5Q91Co rtT g WG17iVPGVQdmboEN1gzprHqXt7UguE/U3yx/Zd98EAx CmY73ATiLtAMLNCfjKwcQ6422&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.safebitstowers.com/c?x=JT9 0mU/7IVZx90juj0snXdPntHktbqRKhWVr3VoOVg=&c=FIFjqGdpnX7jQXNr3FTMf2FVdVZaUut11LqnmjmKF8X/pr1eNslqDKB39dlEJXh1Rt0q5XdV10Ow4KHQqzYknoUkUBOuwBUFAk4E7bUhwLo7xRzOpJOHDCCiRl9G Qx2&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.stockcentralsign.com/c?x=no/rCT sSaNN9QbGxVed/0umNdgpvJqBlz26NdEuyYQ=&c=f3fLpLFHdeN0uRJLGDYKvVOSiRziUUmPDfjXxmZvRPbRdiKM3u1w fUgZ7JHn3Czma8Y0UWZ04CHloW1kWGilC7j2ZIo0gqjryFnOXiRb3GqS1YFz9CyJOhPySiQpIOL&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.binariesupdatehead.com/c?x=95KbeLszq95O0qq50ttR/fxZ0lFeYAd7VV/ESRwjArU=&c=bhIBZDORGEeJ FyKlLx7TmAI3G2B/CCEXWfTutMxcDb1CCu8s69p35zx qqJBH mtzwN1Kz2VsWGf/BZJvRV E0ZXBRvzDDLN4R MyH1m3opTXOssDH4HF2UTGbmcIb6&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.conecptbundlescity.com/c?x=jIZiXvu2yCSzGLihkjsCD/cMvljaIc4X3TrTa7MaY7A=&c=dnRdh7doLtM8Unyn2yMQ5xyTE33VenAlXo8gOYOriec3/zy2pCNNc0F5evIJ3euFGGPigLR3hqMIAddX6l4QCuPT6VvzwW7g6c7YeBezVkTAa/vKPrNj0Q2ErmkpTuD9&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.presentfilestag.com/c?x=Mav9ynlrQFlEvnkkTUOM8dIqRWUTR/Rp9fsVRhh3rPY=&c=JuA6E4NH6cj9 VqaX1cfMUlxXZ9sN4LV S28mGpoGi1UmRITFmAcYT0iiDYYLF6OmN0oHclmEXmzNRMiJA1b//D8kr7xpXJwZjVCyVDySQiIEOmVGWp1wTtwQT6JxWMP&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.conceptsvaultsfiles.com/c?x=HxFOAhvsAWC/P0pB/6An2RyKzlvNvJ8oYkI9DZ Vo3U=&c=N35 FfktDwW4O4iJRTrl0604t7FKTeRgXPnAigGq9e2Iio2O8xgsj nNxvg8pBvsdE3C L0H32MaYsybYuF5hqNXOXT/dyPrmCkusYTx6b8WAFpq4jDE1M87ffoOJevY&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.farmranchcentral.com/c?x=WtHHODQm64ebukNvr3OI/d0ctE q85l3pAITSGDWXu4=&c=B9KSvlsMU78fnMGJ7hwjCKr7UNV4aeVIgtjD6GdMFYuM0o87je9uUpl9SkGVEWBuQU1o9voebCA/g/CGt0CZHDzLVNtA4BA6jWqS49GPuYhRFDCi3YyFuWBdopsbXpDy&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

http://www.towersoftwarebundle.com/c?x=PORKFgBCAQZZbL9gDJC78qlUTlE Gwiq7v Lhkx9HGY=&c=VclO4FjytN PDfjTRHpFMdN4gZ1hWiy/jAjMq6ezE/rZwukyCIf6UOVpxiQlRcmnuazDMqrk1SEHhvjebgq7zthrQpkJsxKyfwlvGyn1Ln/BkzXH/ZSFMur9NBfTor21&downloadAs=FinalTorrentSetup.exe&fallback_url=http://www.finaltorrent.com/.../newest.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_finaltorrentsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.