home

icreinstall_grand-theft-auto-online.exe

Cabum

Destiny Dream S.A.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_grand-theft-auto-online.exe, “Cabum Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.newsendbinaries.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Destiny Dream S.A.  (signed and verified)

Product:
Cabum

Description:
Cabum Setup

Version:
4.0.2.2

MD5:
bc1bab28d7dd7a7410130d6f7ba67e99

SHA-1:
3227cd22d531746ab6bbf5f8277e23a54a5f4601

SHA-256:
eedf040fbc55d4d232fa7d28f2b29e6e7b243d9f1bc6c9787d9665733067d3fe

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 9:24:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.5.5.16

File size:
1002.2 KB (1,026,216 bytes)

Product version:
1.2.1

Copyright:
Wizard

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_grand-theft-auto-online.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:55:11 PM

Valid to:
10/2/2016 8:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Bgvb1DA3WAmtJtxuO2uc2JiDCcFHNzwguP/KrepII2J4m:B8bd9jth2uc2M+cza/KSpI9Om

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9286

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_grand-theft-auto-online.exe has been seen being distributed by the following 13 URLs.

http://www.newsendbinaries.com/c?x=5gaeUDnh9nXDEBlrZCFqoWhXWRCy7qzAAT6W42lvjBI=&c=gnPxAYNyUwDP5UHmJkWW7SJteWskaUL1pt39e4N18ks/mT/oQfkOv65 rTozl1pwuia60Cnar9S2qRr1m3Feh2Maj1/fXDVrwXf12zXcrm6eoomOS8JTo96Vs2tmhDoSXWQkQwmnLbFeYiawiIHYhabPDlLKwj36PujnNfWO/4w=&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.towerbundleapplications.com/WVl6OTRQVUV6YjNkQ1owNVBURTF6TWtKTWNIaHBUMngxZDFveVJUVlhZWFJ6T0VKdloyODBXSE0xWXpFeGVGa2xNMFFtWXoxUWFIWkRNekJqTWt0UU5IRXpkV3BFY0UxNVRHZzJkMFpWWWxodFVFTTJVamRpWlVOVFJIWjZia3B2VW5GbE1VeEpZekpHY1ZnNGQwUnhObmxOZVd4cmRXWTJUMjVQYnpRMk1sRnFSV2RwYUVwb01HMU1hMWhuVG5scGRFOGxNa0o1UkdoeFpFMDBKVEpHVFNVeVFqWndhMjVxY1hoTkpUSkNRMEppU2xWMU1FY3dkMnczUzNaTVluTmlhbGwwVm5WdVJFTmhlVWxOZFROblpGUk1keVV6UkNVelJDWmxQVEFtWkc5M2JteHZZV1JCY3oxbmNtRnVaQzEwYUdWbWRDMWhkWFJ2TFc5dWJHbHVaUzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VjbTlqYTNOMFlYSm5ZVzFsY3k1amIyMGxNa1pXSlRKR1IxUkJUMjVzYVc1bA==

http://www.newsendbinaries.com/c?x=MOZBDe8CG5xOBTskzD3LJxljlYIfinYjBxP5XX1h9f0=&c=ucIXCnEPxUPEkaF7i4cmfL3k03Zvu5Qqf7IR5o2QrCA479/puSyZPrIxT0H8bUO6dC4WJUwPFBNaoSrAyofBjEtzNQcYvwBDhK08Yte7AAJoLneb1oVn72bGQbhFR/codbUerY/UYL1jHriuJ7REPg==&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.newsendbinaries.com/c?x=aqkUMwqC5BLlHI5Yu6kbcdMkkNdIY ylLNybl4dOBFA=&c=wXGAthceMoE63HF2YNxzZ67SlvBtP9PLSUY3LvKiwk F5Zipe8oelPAN5Dhb6dNOdOXRlg0H7mJRfqEJtCQhLLv8ly0vQM0IpZ29ByNUFezLdFQIdpuidT/6RtJhO3Jp5LGCp5B4b1x4GZoSjwtVfrQaaDtkPGaOESfookYBwz8=&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.softwaredeliverytag.com/WVl6OTRQVEJaVFVoeVRWSWxNa0pVU25aVmNEaFdRV3B2VGlVeVFsWk1ha1kwUzJwamRXUnVNaVV5UmtSd1RVaE9SU1V5UWtWS01DVXpSQ1pqUFdsUVptNVVWMkZ6ZFRoNWNWSjZNMUkySlRKQ1MwOTFkMFl4U0hkWGRVOU1lamRYTUZNbE1rSTRVVXR5VEVSNFVXRmFkV1kyZGtNeE16WndVelIwZEU1VGVXTjROemd6UkdsT2VGWnlRVmdsTWtJM1UweE9RM0JTV21OclUzaEpWMGd5UlhaVmFGY2xNa0oyUldST1JrOUxTWG8xYVd4WVdtdG1NMnRETlcwMGNHd3dXVlJ3WjAxVE5IRWxNa0p6ZUcwMmVHeGFSVVkwUlRodGRVNHhhbmNsTTBRbE0wUW1aVDB3Sm1SdmQyNXNiMkZrUVhNOVozSmhibVF0ZEdobFpuUXRZWFYwYnkxdmJteHBibVV1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbkp2WTJ0emRHRnlaMkZ0WlhNdVkyOXRKVEpHVmlVeVJrZFVRVTl1YkdsdVpRPT0=

http://www.bestbinariesvaults.com/c?x=YWGJoWioMchqetKF9dfKFJfhQLTJOxRe5lijCQ QFyE=&c=mbgoRM/sDdQU9xGvA/hoxXzxUpMfQWHmw5tNW8q53m ATQLrpcaGq2w8YBtK/zXBcwEZD9jTGkllszJWGPXhEoZeAfbonNUumafh82EUAb/6TCVQQOCm001K0 z7LwE6e JgR4BoqT3mUFHozxNBRFvEWDadt3tp UtygA9BPhKAECd1uw7IZcRL6lobnm3x&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.bitscontentfun.com/c?x=yfvjQ3hVsREtAKLICsDJ/08hoNX6D/z/GREJ k4bmsc=&c=OvHDZxfMz9rc6wfoRJVHbBiX4c jMurHvfl5Mf00ehZYm22XezBzJHEXHSRiHrpqji9VbKCBjTs4FEvCJBVxxyKToDPWdyFNHIPAygz6VKNx3574vK SCx5B0W7/d5xaJEl2w9SMUqvJomGeeD1VMw==&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.softwarefuncenter.com/c?x=otB4qID6xlf74 stCwVsQTHWy7O Wsv4FgunK1R0sjM=&c=m3uzISECdLf0ckMklx1hdtiGiYnb2Qu7qpeI60I7rR2eJzQQiRtSWuI4HyssWIh7SyZJD/zZGSsjnFY0jI1X/XwgEaHPLsA8O34f/OXvvf9VCHo6dXrE2diFokmcZO/kEyDSsk7DIr/fqoBGDMv yfb0RZzcUjAPmTGUzVKLU8Kdh6azDaQEzCv9dj/cgw6h&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.softwarefuncenter.com/c?x=2g64ia9GvSwrzJOKW5D31OG5koTJ3fFJVeJFMh/5uZA=&c=60jlJWEiRkXAI4Lr2HIaKv9VsXuZg3fA3e3J6YKRZS6qvgGc0ZGfMZMafOH5DrgY3jRGOdQxrT4K1CIY3p19f6NTYiSM7njYQ6JFAiTMNEyXRoM7a0ccQP2FCYH2qAO7P7HIIXBjJlSIFHIMmc/ZDPEwgcAoKL8O7QTMKLdPfhg=&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.bestbinariesvaults.com/c?x=ERRosxqfzze6ar5bK9Eypi4jI8bcnt6igqArIFYwc28=&c=Axb//dHDEina1FiPvX5vapIgQUUbsC/Tks9ao3ofIYRafbF4f5QoHtCAMadC8sKvS/9KmJQmZ6rO cvVwYDxOEySzTRFoSY6O9qdE/vROpuLl2gV5gt37zIpnTweARJ3C/PRddU M37WvV3XH60czVBKq2GB2NNuyA6JUSi0kcw=&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.softwaredeliverytag.com/c?x=mVAPD5khwYs1n6j0s3qukZe7Gv3q0e/gXgZR3KrPKmo=&c=62Z B6LzqiS9dw7oeWcjEt2LAXkXW5Ah4QNwAYwiCiwyO77DQ/w2yrp5pp4I1aGarYQr Ph1vEmBFHTWXN VZ GL/UysuUAxKAxi4MjuVvSVErUAPbTaXJvqESSPp6KlYAmyYQVW0gRrBbPxgelEEA==&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.softwaredeliverytag.com/c?x=kV6Ax8434co45ONf kxsK2HNgoarflbigCWgh6Vse00=&c=u0ZDeGfjM2Sjhq/6vO1BzPTo0ok/MwuJ2SdC7V2cHkHFBn6D38kHm4i9pix9pHmQTHb jrMnLe0oLF/adkZ30Cj1QqblWqsUVRdb0eUrl5Iyh7ZAOffuVH8wenK5oreOScW6I1JF tcpmLcZ9X6deQ==&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

http://www.towerbundleapplications.com/c?x=p6jhV85pree7v2LYFJNesN9z u7ILprJHwVYxnKDPg8=&c=zzlLQ8tajibquEhJdVgK7bKHUzlZ5rNUlpiKKcGgc7DX5w8oaog6EKkV BvF/XnHS0e16m0U5QXX4eAquuFtXgbFtD8nUwDonj2ASvI2VPE4R1rpqqappedV4XPlDdAdiHE6vx0j/1RlHDFIv F8Bq8STZ6xjGwT6VTeuSQSeuU=&e=0&downloadAs=grand-theft-auto-online.exe&fallback_url=http://www.rockstargames.com/.../GTAOnline

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_grand-theft-auto-online.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.