home

icreinstall_firefox_setup_21.0_fr.exe

Application Installer

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_firefox_setup_21.0_fr.exe, “Application Installer Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Application Generic   (signed by MICROMAX STUDIO, S.L.)

Product:
Application Installer

Description:
Application Installer Setup

Version:
4.0.4.1

MD5:
f62703d77c973a642c96b7d558d88ae2

SHA-1:
061d7ea94ef20229845ae01d362a787e6383369a

SHA-256:
1bf45bdf18f08ec54d6a4f820681ce496b9bc81a2b131ecdaa58430c0c6b3777

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
9/27/2024 1:17:23 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAXSTUDIO.Installer (M)
16.1.12.14

File size:
916.4 KB (938,344 bytes)

Product version:
3.6.8

Copyright:
Application Generic

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_firefox_setup_21.0_fr.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Nv//uCoylpB8bnLLFKqe+PO4efJOVGykH:Nv9BBSnL4kPrEcPO

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_firefox_setup_21.0_fr.exe has been seen being distributed by the following 50 URLs.

http://www.worldvaultdelivery.com/c?x=Tf6MN1/Ynay/5ogwpfybGLCMTzQov1R xKCoRfuv6k0=&c=sJ9gsiMPFPYwyDdNvRaY6TIf6lssxjF8SpH8JrtMV0YX6tf/cWGDjy0469Gg15xfZ dNQ/B Ja92ScgxK9hzudj/a1ZQJHw9hfwHKn3BQBYLjoQdD4sNfC5/u1F0fkB1&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cleansignscapital.com/c?x=O hETN I58fbO4Jwfnfsaf1jOshy9OCKg96CB/Ah5vk=&c=L/O4OGLSlQnpupTdXgb73Oy/eDtfLqAGduzqNKm21vYH0QGYSbCbSM7pG4l4/aqqo/HSo0vuoxl01zh5dZP5nNR9HvwY7R0QbrbmJh/lxS2XNjM8p4Iwzu1 U0pOXPas&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.centersignfun.com/c?x=nY9WzKTVtKJGedeBvJJQroRSHHfTz9ZYLc4gzT s06I=&c=E/v0EZB9ZtiyzsuNIfMo5aXsVxsOJIoa926Znf56736dbwkc4jBibF6XKHt8n39B4MclwJ6FAE6 9onyRFtX34UjwFXcLZrAO3OFHmm4rLq79ilTp3BiKaFseeqknK/K&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.presentcontentcurrent.com/c?x=no4I EIOlCTX ngWmMAMaOyVM0/Oa2i0M9P/dIZSfpI=&c=eTmgA7B9IEnIbYxpuNNcxN71TNH/hosuaSDHGeSUQ4zi/m91vQoKLhRc1n9cTpVhXeRiGd7a3m6RUV/3/6t1XHPqHwxP8lSNaA3o5h2ppIOQTNKIusFTjnNtD1zIwN7q&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.appsoftwaregift.com/c?x=EnUb2laKTyQ0r6WLL69u6VrqL5sr0eKstIIJSHhqoNE=&c=nqtY54X9Uu63K5 f5bttYMe2wAixcup30vx6jiOs3HCPbbmHGCr3dWVXG8F0DflNsHllzUTzUyvPykhLQLDQR nx0XCRO4svwxi/Yi9HCONkmAvxF 9EWMLwFk5bZ Yn&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.farmsignsnew.com/c?x=h1FOl9Sy89lxAu9mMPbOnXTxww0Yxk17P8X1uq4ZPcQ=&c=NdUGxYuOZTpU1aI11bGu9ppW36CydrLe5cnKBIGVFm cS5WwlayTxxAWRmbkIAdG2XOfaW4DPI3wHkCO1VPyAEcAFSgJiR8dTBbt1nH6bcneX70UoIkdEpCdoW0xswqj&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.farmsignsnew.com/c?x=h5z47VEU8HLXDiVF2gn8Nqavo04Uic5rVYiP6BCI2rQ=&c=2ZqsEB6SQD1kODHNeN7MdiYoFBsltdEy YrWz800jgaEiB/lccQTYAQ5N7tMoscI6TktHkQPrm0Wg6qsxoTOZBIiMqVKxU/TB0YO/rPMpHqSF1KLVuajxrmeOmTTJRxu&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.towersworldbundles.com/c?x=kFVHquQgiTvp6n7jknbl79dKf PpMQQITTRbzSrn7vQ=&c=e6wvlzcAP3//3zn Jzw/A 76mxY3tUD Jy0gIK7oMEyCtXYbn28AvTyfqlL1TSUswNGIerZWTxFR 4wiTFEBpvIMcKr2xh5YKamQWIDcXJQcFt7xeKapeCfied9RuuX2&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.worldvaultdelivery.com/c?x=q1ITvI4SOXTlh9w/PA4 K735IWPLhOvlrS9ZwqwgbD8=&c=wPil5svY3fbMV1mT a2N4eS4VKThuCIO9ATvt A1HEo3iPOqJOnKkEx2/sxnHsGIhSQ1 Wcj2ezMaIovjenVWoJfDofWP9DHyRmIKlxAZeCIgRxRjrL/vGd50OZYFqcp&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.worldvaultdelivery.com/c?x=Jodj6DFrwBtAcA7pvI7FP7bQCj2A/DJlruaDoXoZz6g=&c=7DaJh2/FdRrft46htOv8Euww7tzGc2sYxoXtjyNsELNwuU MbaPfdnK6qH9hkKdYE okzpQjU/X/kvA0g Ky 2p62ZGSVVEIqpEoysA/hYHjYJjaspwTxE5KtB7jSaL5&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.purepackagesthread.com/c?x=BNHnNlSjf4OUhk5AT0/jYGcY5hM7A/Wp2FO5lpoNtHY=&c=oCinCGW1xsm mJ9w1I0jpmSC i9Vqcey4Pl85aoAr95Z1EOQoGlKZfSJBfGhQsnstLnDNGG9zj7nZNNuruhCEjZJHHK/5vbMBsLfrow19HzncxZvGMP/ZJymf/CmLKMW&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.worldvaultdelivery.com/c?x=Tb6aQBxLYE6tQncaV0xiJCRlYsHxNQNcsQ3OlGiRmdY=&c=Db4 dwqTwDXTO9t/dHZNpVyLPgfX1qfHVK4CGK9o81jwZkgdnaei4fUWGsegkk/9B8tTAakJVomAVWX As5tobQlhnKPh3loOKiYvWIVsR7QW2wXN3ykHgjb/NSM2qjH&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.tagfuncapital.com/c?x=gZuTVKcxsYTA6xG5Sg9ZG8pvxxoGpdGkVirbrAhg5Ek=&c=U0JCZ qZ0E/P FCnzmJGdkM/jb56LbSt 6WrFUlwqe18jtBBLy7edgcqXrzeL DEJrCifVaZ/Ot8 3SpckgJowIv8ctHDhjkbBVosv21tXCErO32y/55405 hOfPj3Ms&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.centersignfun.com/c?x=x//TwlWhxLXdmgsYzoE4HKpHCseF/TS5f1ROu/gz6d8=&c=gMN8Joor9m8LlNDY4K4MxMMQf72Wt7PNHxeVIDEuHkFaHjQz56uQHC6P3LBJeshcm/u1VxLY7zMvBAT6kXZ/FThm7ag2uaMl0 S59CmoxRqDtdamvTtOi0nZMn976cjL&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.farmcapitalmega.com/c?x=9gJTdgxm3GmkG9WrCxA/H5Wmb01y8ac6Tz/ptw3qSDQ=&c=n16wnoxleBupExsRekab7LJC5FwTIktAP8Sbn83egKUGxrQ ZsWjVk9GXcaSmFglYQjLRn mcuE3agYnO5ieoCjUZmSilscYzNOA1eKIpGhs5Jx98JDvSnAE34YTc3/6&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.bundlecitybest.com/c?x=w1cWNnxmXsYOio183jFmaO1Za8LTj8ruE6Oz7TLPusk=&c=DK1b6noSjyMOmoST3cUbF4zDEDwHwwX8F20txxgQPjBw czVFBrKy3YEXpect08SOdIFU uSwe xNvXH09 gQW3TwKvLOOmLb20CP68H2S7yIlJ n5gR1hqAKwBosb1t&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.sendcurrentapp.com/c?x=KCe58IyYWUlz13r302SD0v4tglFUWNnAqR4VMUKi1C0=&c=WM3rx1a4v5xDPf4Xi6l X2hBrI3eRjgAdBGyIv5/UsC7pWQfeAvwL4QGeBK5LDIo4y6k8kpFb20FRmjRbtixS7xJ3WOz5GqNR575NBZYuAMWWBs69JscNfFyZUWfANvL&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.laboratoryheartbest.com/c?x=/6gyyA6SKm/Lsl7NTEG925T03e6/dkxuXrnd0MFNckk=&c= 3pc32Gh8Rc8vS/Brv4VxJM7jm UDoXFRzZY1Dr6Gb4Qby7iDcBc I14VkBigMfKH71xug4S9xGMI/vu40A4zxuCyUM0KnVC2/nX9M9DrhpKwIctu6BtwGiEABqmt13t&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.bundlescurrentfarm.com/c?x=xFvINhBgoYgqWnsy5vgVnay7hnM2/FVkTCiBlLKIhYM=&c=BGJGM/YdQfSl5mi6C4dPMqqCsShohVKRGRDB1P9CF6KZCZ3JiBgmf2m5Rr t x/ NXy2i1ugMWVg1OmnEOFxzMbNNhn66jRtfWAEo67wJzrn/lznRRmQtvtKQwa6jcxf&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cleansignscapital.com/c?x=0GibJbC82zMUY8m2aEQq30R MoP3jhwPac5vAy2Qu4E=&c=t3OBUft46qvbxUtZFwwSjobna3i71d6dDESi JVtNn6UGxx9a992MTR/7s JZo sxIAKo3aY0TP5Mr/huVNdAk5Z2qhy6WvAso9ycfBZ1s9fU6Q3VVHHeoHghOAuqPzM&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cityheartsafe.com/c?x=DV5/KThif6Xm1y2agka0htloVTGqOb1ZkjQM9WoBc1g=&c=QsKBjIeEWXyKoPSJCf5Vy95V59DyfEk3pp UL2m1OzAgtewdUTBTX4SOkpMijxI0hBshhx8NUcxK2/CKAIFGfD0CioIYTHqVcjInfaTt3PCF58Vm0P6IQjPW1PEwAyyr&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.bitsfarmnew.com/c?x=fjFuVVszXQVwBtcAwTQOGhk1cLELmEa/5eTaJfDwP2A=&c=otzbQaFZ UQhAPbxzcy2wG79Sxl7g7cRtYXLw1Uc4btctB7hfRph5vrE74iNXcFxtflvZcfc9B0WlBh6JZ/VANWcEp kkElZ6YF3mv4KJf6f6tKQun6qxwF9LPEq/iJv&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.toursstockclean.com/c?x=CTXSKsV5Oe8FgtUiINRma7906w4Hoh IKufYaXKNbHU=&c=TrajTb/T a8IQ0ChuWDcgyfeDfissGw5AvG8BWY1tl/aQPeahsUQCfLWafBKCMaU1LHOMt4EusW0unqAl1MqzPs0n46jSznwN9uf4pLO0Rl87T0RpJyTzic2nx4xAgqK&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cityheartsafe.com/c?x=qtr1tHKOjxb2OYjsPtPybC0ONV/dFJCcUfi72KgCzEU=&c=SwyYyeRo5JwCkqphnC Ca6Qyqd7nK rqBT21OnJzWW6uIrMPwSyLi05CEpXq L110iLsXF4sHdvF9o4ME69HTEXp0oXwUrR4fVg3Zh1XNN5kEQZsrg Opr F9CqUwyxM&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.apptoursbundle.com/c?x=WYADSFkYYLSjUJMDpMTA5rZQsl3Eu490QrZUKjM J Q=&c=mPsGQ/u7B8CtXsQpEYFDhixEmFt2B4gbV40KPw5tbvtz4hS4/FFjWcYiM0hPcVLGfgeZPrnDtmo/p0jIMuyvPOQW/MNdQ9y3V4838b1Drt7CX/s0hiOarSi9RPMPJKEj&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.farmcapitalmega.com/c?x=yhZT7a9e3Fm4zgufn73UR1Lr1UJkFxF8zRkvJbeopms=&c=1D05Qwzh9ae9XAftpZpnCwI7RyCUTiho7TCOr5CarkCQ7HBfXp64KKYQmVpjTEZUQE/sqCpmwOcr1j1xlM/3ji4/aVljn3taTLrytna/lif6Sifsd9Y Sk6WqWd6CLeD&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.farmcapitalmega.com/c?x=Xd3Fl7lxWQnamlxWKQRUVy0DHhPXQ5TaznJEWiZVxQo=&c=6y7iHUkxQsOMESE8ldvcMRuOFufg22EX0yXr0arrIzzi39JQdbsLxrV36pWcvGzjmA2JLdYN3lVzv4U2SoW7bp9MX5Ia3iND6wRe7GAf3gdCpppFShn8YibIrQk0lyop&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cityheartsafe.com/c?x=eX7WNhDfv lD7jKy3ztXFpQxaVKfuLsvYPFlA9egs/M=&c=L8/NG04T96Y27WZy0HtFpy1ZI7L 7NSEdVaO/KzSgIzFxEBDWxd6o A BO93mhDVRDAvDsqK8KxW/EnNaj3kBepE9MX3cnceZqnjfymzK2uJk bApIpp0UGLpn6kjcke&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.laboratoryheartbest.com/c?x=k/wd8A7Gd epj/SgC4xARCJMySGcWKojOqqzUWsSxm4=&c=nMAm97R/eDBkBkmW2ehXFpx/eOThHBjfNIG2UNAqKAm7jrNT/kS2SdcMrTf4ZnVvtxKsmGjdtnq66YSkTW6vRHspwxzW8KzlwGBYQrpmVRJzg0lhnXa85cUIHhOtpBay&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.applicationsbodybundle.com/c?x=J2o3qs 0nPbWAzQ2Fgj1/xAQoMoOKrX NJI49jKKIvM=&c= UsKnGpt1ZFNr6cIN/Ob2XCp2zAdRjwfW6POMR OnBUk/H2tYiOJPMacX44mSbtimuONs 3t3 OYkcAcAaEILlxxTis1hdHMX V6tC6TB0uJiJPL Xs4z0R28nSJ5pfD&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

Latest 30 of 92 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_firefox_setup_21.0_fr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.