home

icreinstall_firefox setup.exe

Nobotares

InstallFlash (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_firefox setup.exe, “Nobotares Setup ” by InstallFlash (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Tok   (signed by InstallFlash (Fried Cookie Ltd))

Product:
Nobotares

Description:
Nobotares Setup

MD5:
082f22269e428dc957ee0d88cc376b03

SHA-1:
c6d04db43732cb389fb13caf70e375d47e2268e3

SHA-256:
511e723e0b8da67d1cad07aee39e09a8ae92f4a2ea2ba00db5e4738a92a83762

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 12:39:22 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.7.18

File size:
1016.7 KB (1,041,128 bytes)

Product version:
4.3.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_firefox setup.exe

Digital Signature
Signed by:
InstallFlash (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 11:18:16 AM

Valid to:
6/2/2016 12:24:43 PM

Subject:
CN=InstallFlash (Fried Cookie Ltd), O=InstallFlash (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ACE394F39EFB26D753579A412465CB79

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:al1WWYyrac0cQ7ARnDV+4RBw+RftOqCbTtC1xcyBN:abfu97ARXRnCbwLcI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_firefox setup.exe has been seen being distributed by the following 24 URLs.

http://www.downloadsbestbundles.com/c?x=axQkUXMIme8p1fUYT4M3LP8uLUjNRjm6q60IK0wTW1s=&c=850WXIwYQJ/Ejxlwp21hcFQokxFEnPUvN6u/.../lbe8zNzjkEvQrJF1qCiCENtx8daQt5CaeeTOe9qM3dmJvzfzSjEE6KQP3YXONO0Z21gq1N0IHe2Da6fZ &downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=DN/4wzQUqZ81Uz9hj1XRu4mEi26/He2vB1804/.../UDNCt95KpXgOpJO1uXPLfGtFfiNJGamLNSUTEODNr2lG0KccQ&downloadAs=Firefox Setup.exe

http://www.towngiftchuckle.com/c?x=cubOTg7 VsS yNajBt4Uq2 mK/.../ZGQe6uz DL3U=&c=moxreW 8L1dxyVQs6WiqiZTMlIq4q3AdMO8nZEP99vAL0yGFzPXAGkJNqmnKDGozqcY4c62DHs76hO2PKzCexIp3s55YxP9TMn3zsDrE9h5k0fmmxI9jwtQ7xtuxdg0n&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=AcfLi5MobckvKgsl058XrEJBjC9k7POou0Z5p/.../uKwj1U5TiOkOQ5eyr5 SbFuvSjiZKjDC3b3dXeypVL7kd89VVEKmgdi4xlDPKChnpmM&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/.../YhMu83yi1kCLzlQOGdFfJn2r8tgt2knWTUBe jUH4F67BA4ODijUj3szxfT6rhg 27h1PbkCq2B9w1uPt3dR&downloadAs=Firefox Setup.exe

http://www.towngiftchuckle.com/c?x=6Ds8ZjEdumlSWH SV495aHuwakZ7tpEsbPh fTwr2BY=&c=9ZHgvsDoUwfFPjZmxuzt8T MIYO8a0toSvv1YgbzktZUKp4BSkXEmkyKBZ4SyggvxIa2a6nT DotP1oTJec20TpJjbuwIPQ66l7D02Wa6aTH8biAXQLUaKwJjwggabBK&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=fWAd/81W5kf8INMeMxVSwd v1tSHVmcBA p4kxEBto=&c=GsaPi9c6JXGAY Mmt3rUmV5ozaFap2brITok1A5qJAsm8WdgRmKXTyd7I22cHSUOeULd9oWWikaWMIwOqNMXasY60s6UCDtduRjFXGVAn/.../j0g65IGEF&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/.../n2fWQ5MFwyPyDsdIqgSDo58E=&c=acStr6b3CO8PHPgfg03lTsK4iUIkooE3jdgM38i7DWTS2OqQdZLP4QZ8GsdfCoNUij1pjBvZezrLzH1jH JF06Be1tJog6tSsvjaptkr1f7kbMjy HFFVI5bLrrCnFzS&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=8x1Uem8pH58mLs6RfuuLTxZYgOItdEwaufDYBN6Mi50=&c=RXMe6ahFIaTv/f6WDRfNmTOw7Cm/.../Zw GXL2axLTYIY36eb8qMgCLEeytDe0T8EVTTmjX3&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=AlyLKu /.../5bkdqA1NdYh4RE8cLgPIBI=&c=NzqfeO0oML2GWwWIQhsyQoEZu58K0 TrrGErA1B9vXMhsNiMETA3 Mtfr2pnfF7 cnT0QDUEjIzbnBzli7Z4sd0IE76A0Lu2R0JEZRxqkmQTZ86fcnJtwg0EWa5oDQ1F&downloadAs=Firefox Setup.exe

http://www.towngiftchuckle.com/.../LVqjiWABgRif3NBedZr47GRh2uaYlEtiEhiO0gKB31&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=gzJfiFFaAxSxNXxeCRuR1ktNRu3bjYw4VIoMfWWKDn0=&c=5OG h2F4IUfKcCTTIGTPzn9NZZFut7AapU/yclU/qfN/VReYqGSO/.../03XkgJZriMA9TSk3hArsjWodgUXnbMXLL1VmOrpgoL&downloadAs=Firefox Setup.exe

http://www.towngiftchuckle.com/c?x=FHXLTmzIbnmlCOCDYQI17Un68S2OQffyk24jS gsgqY=&c=32JzngYnhcikF0P/ODFV36lkUepxgVUfLW3N7Z7ZIJHba1u/ITUfb3ycSNzmzmd6vsCxLKS fB4/.../7r1yJVcvvPnoYZekuzTpM LFcELBCaQJJAyrDVEXW&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=AhoaIYppjs2vfdrT6aJ XoAY1EA9Gd5 19rXV3v4cuw=&c=fiexrWHOnJM0cUO0JjwvCKqEygA lRGjR WILGlZ3Mx DhGXkF5W15MUxZ66GMM98TniO f2dJFxXlDa7xWYEKjiSL55/.../ZHEL2iRr KSHBj8zfHYhJX6MgVICFbWM&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=XAwa5r8kEWdfC5YU75iQD0ZWSZtrTLt0OKL57SD34h0=&c=9TRBJw9NDrW6Rw yQhqwBdLVIEfDjF FPHHCcbM9 xKodMH7a/13OxGq8TnCJAuU/.../dHpZCHaSfIMg6OcUoft6odksh6ieJdFfy4rrc1&downloadAs=Firefox Setup.exe

http://www.towngiftchuckle.com/c?x=T4irP3Dbvs4qzhgMeIMEoPsOSqaF4LlBOFskayB9CZE=&c=I/iUIXifo6F/gHyAjvzdVjJ8y3sZaVuIkp0A BkXLTe2rEFJRmSR6L yyG ziRPqQMLpLmPDTbN/.../vvgB okfyZcE3W7uvyT8r1jzoIUoj&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=h6xn3fVJ7ooVM2yQHByCKyg1m3De6CnamKKxXcesscs=&c=ygYm1V u4dnEM9t3xvG1wpusCtexoUVFC4qC6KV9mcaiH0Koe0B21ow2AD8qlz6f6Kvk4t8LlLw941UOoTsR1kphzP5aHhAA7sFjcGYIvwzhcVzC3Ebld6qiUcf1Dmkl&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=ZqDY0720Z44xWRDS1dWDtUvmTFTLyt9S1BfTGZbKwrg=&c=h8tpdbnaPS2DusBTY AQLbohdUk9N4LFXTcxQ5zYOJtJGvSyAcL/JDP1FNGtS6QS8 YFPJqIm/2cxHXqoLHtgQaU8c/.../oWMALj9C&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=QcKe75eb8wttxY/lE36BTj1xsfRkTHCUOlf5TdgpfkY=&c=O7mtnQEH4PfLgK RVPYZQLu8Wik3EhGObg0doG7WTSOX1d1Pp/ KLiTIkCSnoiMFoBW5tYsISju PfSf1HGwMr/.../ kWsfrTm3iaHuNJuz&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=brsg1tg0v/f9X5jb24VcIqW1O4b3FEUpTkPsgE Zan0=&c=sXvF05gXQqPjmtKk1fSnHzcjqGwTQmxUnfVP PkziwiNkEfgWuFar9PHiVslEz1ErxqutcmSlcsmPUB//.../mu0Q5q1i Yl7QaulUNAt&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=UGhkQibRic7EOQTtw1E1CAEMTbab/ighcfzRavdTwZs=&c=4V2sjP1pehNuLxXf9CyOAT8R1nT 8AryVHwDQzF0HLXTJu4pc/.../vKVwMPyCVone7ORGHV0IEM&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=ycHAeGzgFBeqP3BzZILMDLrxJTcXWJj2Bdlqc/9tbyU=&c=dsRcvEusUFtMdustfnDP/YROLaZbmOHb0w/.../Mb5MhXYmxMkduHaTDnm2O7t4orrGVtsvmLCUjy5DZvznxkXPd waj MI5b&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/c?x=oKzroh3ku8XOD3GzWVZlNCcYrB3S7jPqh1oyyefMdt0=&c=zMMKNM9duPC4cCx752FdYfBCjn3WrVvUTSaKvYvqhECepe00d XRr3N6KIWShwgtgsmsLGt1OXeIYgnlrzWRzEQBNIL4N9ZlDOqIkb/.../ypolghaDA&downloadAs=Firefox Setup.exe

http://www.bundlesbitsshare.com/.../aHKcOB9amOZq8rwigsCGfReOUGMXpRtpZthSjy2XxpFCMATzmhpPQRehlDwXJVKQftS&downloadAs=Firefox Setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.