home

icreinstall_firefoxsetup.exe

Internet

SuperMoca (New Media Holdings Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_firefoxsetup.exe, “Internet Setup ” by SuperMoca (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Installer   (signed by SuperMoca (New Media Holdings Ltd.))

Product:
Internet

Description:
Internet Setup

Version:
4.1.5.4

MD5:
89b17a8fa46c77dae4c99cd50e0f5ddc

SHA-1:
0245aef95d229fa5ae99e153eb4458cde06d483f

SHA-256:
44c55d55a709dc84591ac078d4ce7b9ec382cc043688390b39edd6bc0ab75752

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 8:36:33 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.13.23

File size:
885.4 KB (906,608 bytes)

Product version:
3.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_firefoxsetup.exe

Digital Signature
Signed by:
SuperMoca (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:18:05 PM

Valid to:
3/23/2016 12:24:07 PM

Subject:
CN=SuperMoca (New Media Holdings Ltd.), O=SuperMoca (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DDA99F01EE6D7FC1C948433B608BFC09

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:eQ8S0DAuzck3J7JJq0a7psH0iG65wvbF+alZgOF5u:e7VMul51O7psS65wjc2ZLu

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_firefoxsetup.exe has been seen being distributed by the following 13 URLs.

http://www.tourstocksoftware.com/c?x=gwUg/X4nUX N83weXjfrt21AIccEOYraJXWVQLbVyy0=&c=WtEm2g1mPNu929ztcKQ g5rpy6bixMQAJzgA4l8G6BEfX00H8HoKrcCRQJ/Y5Sd6MyINK/7WYB7JgWih6e4MHTPeqNV3k8l391M68tSuTmWXrGSzfoLMvwcU0OJGXpmm&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.updatesoftwarelaboratory.com/c?x=QUFaaJAE6DdP5FQgidQswTD7f3e1/WMLKQTbttz0RvQ=&c=famaAUAeXFKJS/ UBb5Y3k 4niOre5wPenz MW0S i1nqkYMJSWEmqobA1 GFx3ZnFTQBRCqHjgPgoBokePRKKFIQ/oGNa05znHeWh Jym50l1SM6HvgSiR6J4cqF5d&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.conecptapplicationcurrent.com/c?x=JIinZoqjum8rj GM FqB89HXaXljTGoayGMXkyIBmZA=&c=7fK iz/M4P4cowoFzF0tNSUYjlqzMAL1GPplCB5O1CdI5Wg bt2bLiGBSGcleS3ImvGYLH6iHHBLcr8skHhVP42m1ZcWbtdPyuiO lgf2 x2UZOK5edybZ/zkP2gVZXR&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.appvaultsbody.com/c?x=4U3Rg/hdLgwDl4n8pmrxcSfcq0wkODp9DWoWHxxu4AA=&c=3SuEGaHK5L8wzBmBVAsdZoMq8g6LU0dlm62/7XDC2 zlmw9ylnE95coYRDLyZm8EWt7A7jBHeUyYsNKA93q6n1yO8LSyA7VFU49AefQkjhzGg/U1tlJB QG5VJSG3ZZ3&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.filenewfactory.com/c?x=B8oOlXnirsI8cMm8GdORi1BD5cCc97I72fMqBIv9rq0=&c=gNu44ObD2AFKTcZeS7JsP2I9CuByYeOSpnS1ZBN/AmxaprEJSyASOr8HihFq7l2XSLzRCvkE CD 8lmolUWFvOe0HA/7N30epQ8ZE/xyu QzUoOIwzcHwpZWz9cSla59&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.stocktodaybulk.com/c?x=1WdvRkyb evP517QM0525jAyfUS4xGPVmpSH1N45ZgA=&c=aT3tLOgN rVeV39Mx5Zxi312yVBlrbWd6AEYmY6L50xqxqAx rEaIucEO4/irAQZmzpVhEUmZ42tdaergVlcS8V3a5VMcj4XWo8bJCFNSaFyjcmlSlSnjzT5NsCa46CG&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.tourstockapplications.com/c?x=xJKWMAxTnOJJB1fwMeQAWOpKnFWxMH7lh6jlNk4Ijz0=&c=LaSfsJ7cJyGQ4JAutHd5OFCA9lgGktsUDJ49E/lmLsatB0rN/sJApQo5KBQNMA5GzETppswwJRqYTju7d8qcUtYORp/H46QCuAY4 zZUkHIutS5viuAaHrvwPHucHnio&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.updatesoftwarelaboratory.com/c?x=6PMmZ0mLAooi0eqW3zvzUedy4RTY9hNMO TXompaV74=&c=lG5PrNRXXxcX9MQMcmsecu9las7sOHHWGfwJZAzJTHmGzc4daMqNcbWtm/pG8IOwx0bBKKTatgPu3TrkYGHMs5vywdbcZj32DFjCHqDzcLMqhgWEhBSv8mL82IEkNhNr&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.bytedltower.com/c?x=kvyVITGgvH4E6qUk3qYQ8Kt3DCtpuwMlZEyfVBM9cOk=&c=09knJYY vra12FE3lrMtWVecU3K8StI 6lZxcSg61AAdgM/gA53Qj0bei36SCCtQez3wwi9KhM1 iUL65ZsxCcIsd72IjxU4s2UN9IWoV65Zk97m0GgVOMMoz/cBXgDd&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.filenewfactory.com/c?x=pVqIzi/Hf Ck4pQf8cL0O0cYl JFRSugV6Rrh/4GpE4=&c=oqFdG4TpO6V r6umlQ8jM994CXtEvFmJ0DuIXD5TmP1h/OeXW19MZrDY7xU59rr4GvPaUItj7VkzV9tREWV59Lr QvyAq1PIwDbTdJYdyLMHrgBV2xwEYJ5WBmm1UCo1&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.conecptapplicationcurrent.com/c?x=5LOckMnsmQWvKTd ByhpIEmaoWrKwRD3/mn0APPADBE=&c=6HnKSQwEMwsi5eMCOyEYAqMOBqIg9k/7nAfzTaQTGIQaEoj5i0scFKEfW3Z5sAsFOq6Q1RiYp5kCDAhGOWpoAj aIlMUqfEFgfgg3l67BR1AiMnsQbK8zGPmB9Wl/Sw4&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.citycleantour.com/c?x=teYLIZyAh7dVywzn1i3WfBF1X34kxhBzLrtQPNd2E/0=&c=4D9qOl/vLDwEUKyP3MsTvTlQUpthrc e RyfoUzjNped iq1 uL5NPBT rlIshpl97YlbKR4di3xb0sPh kw13kw8kafWsURqxLoYxnbv9S6cvXWHiN9S9DTSf9FnQLv&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.conecptapplicationcurrent.com/c?x=eD1IFjJbwkbCdJQM1B6Iaquiv6MmnKvk7GNT1l6aTP8=&c= PNuPb/h9Szewwlqmy63Ms u6r48w2CoJWG ExvRlez2cHyf1mDHD1agBWwfGpFDJpwcoNijchYWdXlhtsYfUzjCbcmLSGakS3ZwQku2s/aJQqyDeWGWM1bpmMK7J6OJ&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_firefoxsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.