home

icreinstall_google_chrome.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_google_chrome.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
c45cbef0feebf02df19b63727962c260

SHA-1:
bfc1fd57c06fda1b592ac4fde11466e5d7722581

SHA-256:
f9d8e83e4523e9dbc5c6a5c1ccc87c8a90b545aef3a2ddf8ea3a191d3867a687

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 10:16:43 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.2.10

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_google_chrome.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 5:55:15 PM

Valid to:
9/2/2016 3:40:29 PM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:15PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:1dlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_google_chrome.exe has been seen being distributed by the following 20 URLs.

http://www.grabupdatebundles.com/c?x=Os9ji3c5LlKQvUMvce6sRbGI8cBZ0SYrcs0chWiIw4w=&c=TkNOtnits6cuVSxru10e/djz9usR3DNVepi8RRB8Ek3Rq/X78H2Wkcl EmjQBY4UPvJulcx9SFwPIy/b9e01QNaJu9KtES80ubLsRc8bE/.../T8LC4q2DkhU2h7Kg==&downloadAs=Google Chrome.exe

http://www.universecontentvault.com/c?x=FW2t9D2DFczLHNo6xILCzEt iAse1Bk7q94HXNt1 VA=&c=ZqYUshwBocLE/mg1NCLudBGMyLvQ0Lx/R/J6FScGTctJIDs/1FOBNSd13WXNG/uHKLZFv3UqRmWhpfMrIL/AhMp9Eo1Kxn/.../kZHPL3OBjAfdM1Krb410Wmq4FKA==&downloadAs=Google Chrome.exe

http://www.filescleartag.com/.../KrPqmViJDM2nY9fIq7Un4ad1oukJxbWeii4b6PXJIMy0PkescjjDpXJV 9BunYxCetMbtISbEE3w==&downloadAs=Google Chrome.exe

http://www.chuckledownloadstag.com/.../anBuNLE8bej2KJcU8HDpErbIQYp1WAwHGixYJo30Xh0MtZ5UxIZ5C1XhKKBUJHbClVe6y2ETjEwpS2XA39JUioSg7KmadY7XPWxmN1fTHYJ8 hgAqNz6XmnqAfb JheM6VLbk9qDbCOqOYQ6zMt9Q==&downloadAs=Google Chrome.exe

http://www.filescleartag.com/c?x=RgMArsdzT6/38eFS1uxAnBb8jiXbaSs4/foBl7d7c6M=&c=0O9cmCIVGyP6LPtcd//W5W/.../BC3VHQmcSiMirW1Gw==&downloadAs=Google Chrome.exe

http://www.filescleartag.com/c?x=RvDX6FxbjT08FA6t00/Nr8FF XK33Bmfe8R2oc9QMDw=&c=V/t eqlmRXX37n cyQgi8RFFu1ZmDa5FYJ96G9UBhbuZV TPyhk2aNeMBzv/mZqOoRb6cLdGQfCHXzAXERRCo0JMXPjfjJ/NFBSKJcDP/.../q yPNk9OoQ==&downloadAs=Google Chrome.exe

http://www.currentbundlescontent.com/c?x=BmcmBh7oxr6lhiwd7g2JkD6OjuAqedoSr73JsNOwhsQ=&c=sHa9njuOA5HkAdPjp28kiY1ADzqnA7DVui59 BMxTzrYOMz BOSyuku dVu5uDHNaVenilN/4BnfWm4 zYYwmEPeiNlYZ23f3j9Hy2sExa61ox/.../Hpnxbj6iTj3ezKEGc2NYO9uYXBww==&downloadAs=Google Chrome.exe

http://www.grabpresentapplication.com/c?x=2GHI gNJ1tYJaElOAzGhkadeXhb6rAZWnFZqX0w69KM=&c=YEI5qGC6sP0OoSzcUQY/0/zbmPs4nrpVddYJe02FCOu6AIyCaAgFHH 5cEV5DlH9BI10ZreBgpfnX21sV8kj5W/fXvQ10q7p0tvc3/gEHx5pu/.../acWze4l7YMbxYVwalhw==&downloadAs=Google Chrome.exe

http://www.vaultsfilespackage.com/.../EZzdJNos4qEaFyDs5CbpJ 2jNA7xZIX3udxK69HKmkjQZnWJbIlyS06CmhqtipJBbBtOEdeBc3cq3yD4cBYiKmOhy1Qkg9MwOxsd7TVdmPBMIBz3C bV1i8iwoZ16YTx9A4w==&downloadAs=Google Chrome.exe

http://www.vaultsfilespackage.com/c?x=H/.../i7QZlBCEw==&downloadAs=Google Chrome.exe

http://www.chuckledownloadstag.com/c?x=nAUIMVzZ3djfsscEJyDxxLs aklt4e1cw0oo0l5B JA=&c=8 768Yf0XSr2uO CSoxITosO2mj/EwYMFeTyW6WV1ehzyIQvxrya0DenfEOwVevbhBxRg5/W4vLEA2kUrD6m2I1dTh3pWfczk cxC U1gfLypSDzeA5zoJFNQCHgtj95I2TM//UNuRICCJ6MHnU0ow==&downloadAs=Google Chrome.exe

http://www.grabpresentapplication.com/c?x=VpuVSB8N2Gqig3TQsZcwgzFXtJHSlt6aAsSIm1G5pHw=&c=vzuoY48TER6ZxnDWdTzASWS5N/.../1C882OFzY 8smYxntDoO1IwXrgsfJohg207HFYjA7XbKPeVqdLaK Q==&downloadAs=Google Chrome.exe

http://www.contentbinariestown.com/c?x=qUMLWLbL6JH mzHLtqWZMtj1r/7Q6cq1aUWMZ2MqUW0=&c=uvLTV3cEkJE0BsYsaP2EpxERDOPR5fn1ArBYCj7H5Qw1dBEqHpOhH7QgS3aukbEu/.../COhRIDtbA==&downloadAs=Google Chrome.exe

http://www.grabpresentapplication.com/c?x=ow22e3NgK 8pDkdntXb4B0DP5cvqxLID1/W23CjKR9M=&c=tSG0Yurpvo2v4mxqbqQ3R4nvL/.../lubnssa8OlSAY3pcDc2Fn9PcsZQS6meIywpb9KX8RgGPjqPndIQ3rVvdRlaVw==&downloadAs=Google Chrome.exe

http://www.grabupdatebundles.com/c?x=z3Bz3jSHVhTv x97TXIm irLjSmbNRlO hJNBFZIq0M=&c=gqcZZ01bLj5sxm0Cxw OUVyiHW 5BheH5iKU1JvdDw2OA0enV/ruqesuVlr8dsAZkMy6AoLFWQgLh2Wirseo/.../IDq5odmHxVcGIqYTdP0Q5Zw==&downloadAs=Google Chrome.exe

http://www.universecontentvault.com/c?x=nt3uWfZFFP4Ss52lV3yJIqyr6S7SqsQrpE3EtvDJk9I=&c=RnpbjNzb1VHz469VxyU YvbCUB0Uqy9xfKHmO7AG3ZnyGtf4PhARJzsvAYBV9 Uz U8TWawlpJ0IRiDEoya6zHnYwZfcFCLbrxJiYxLzNVK5iHdI8Zg9fXebt7360YDzWRRdFJeoh6okZXXBiD4ZxQ==&downloadAs=Google Chrome.exe

http://www.chuckledownloadstag.com/c?x=z8egfi6IkN56l gnUWKnLT/XKOHokX5M9eUSUO7nl54=&c=u K3yJ1abOXIcwECncmmVQgZFrbGsw2Ro4gsWiIVVTrLo86FIML7TrEcmUMw6IZ 7KL/.../VFD UySB89OnXJfjrS96bsWpL0qTu0DDC4OcCB71Nn12Hgm8jzkYMu8IyDP706BV6rCaQ==&downloadAs=Google Chrome.exe

http://www.universecontentvault.com/c?x=iSaAvLbQEYPfZJoFyHdQkdJfTPnUxgS2frRHEnPCiKA=&c=zZ8lTm7Yd5yzSbe3kQFP7tj0naeAaJ/.../VTlHKG3T2ob33EpUIyLfeUNpDwYJfS5MfzxqgoF4SSzGfiRjGOJI85Ud4YLkwxJyeO5XAIK2yveNJlQ==&downloadAs=Google Chrome.exe

http://www.vaulttowerssigns.com/c?x=vzU1kSCoZmUNrCQI3EmWZsHfUObm8gAUDbRBdTBBIcQ=&c=uB5pxTPYW8NZyyeSGJhQSIUvu4MkdXs4f7TYEvieVKZe2YL0IcDKsEArmEbBy88W223aSkHDR0Z FYWoneCWF3Uk9Qa4bw0GStLLJIXpGP RsBXwRiekq5ZdTRIlSuq IejzJy5g3LXkV4PLjW0RFA==&downloadAs=Google Chrome.exe

http://www.universecontentvault.com/c?x=Rpz5Et7mt0fJKAwp5LLf5b37stYxJDkSMyaToT4hR6o=&c=O1bvjt76Ijbx6FGCOJLxJvFFzr/.../2CklZlsWB9EtNl8oPUQ==&downloadAs=Google Chrome.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_google_chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.