home

icreinstall_java_update.exe

Application

GERYON ADS SL.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_java_update.exe, “Application Setup ” by GERYON ADS SL has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Oracle Java Runtime but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
program   (signed by GERYON ADS SL.)

Product:
Application

Description:
Application Setup

MD5:
09f16ea2e10fdea78e56bed1caf1e96d

SHA-1:
72569f2c92023b6f1412a2d92207c84a8574724f

SHA-256:
4642943391a9c01b6ec7dff25c1f710bc36425a40c9d6db003de482fdb74d331

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/25/2024 10:51:39 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.GERYONADS.Installer (M)
16.2.11.2

File size:
942.1 KB (964,696 bytes)

Product version:
5.3.8

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_java_update.exe

Digital Signature
Signed by:
GERYON ADS SL.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:21:05 PM

Valid to:
6/23/2016 1:17:17 PM

Subject:
CN=GERYON ADS SL., O=GERYON ADS SL., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112181D069E2BE8A14952BA745AD05847F6F

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OmtdSc2A9k2MUxfb/AWz2panOlyXori5QWqs0s5:OuV2fzsDVPnwyXqi5Xn1

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_java_update.exe has been seen being distributed by the following 26 URLs.

http://www.packagechucklegrab.com/c?x=Xq4NEhqxCYn40XOL2C2S5IFLnVtbAmwdMaz88efGr5I=&c=7illH4PTivqygtXr8g 3kCmmyyoA/4 36JNlStrmJytcXSIHN/fN3H6CmGkczgkvWEWKOfJRvrd9jcCNo/rbyVFzmf Zj6OVdq/srAR0yUbYPMv hS0Qa32wL27hSNpH&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=pGzecZqeF57VFMSirrGcRZKXs4JsfztnDYwY9SDzrto=&c=SPy0Mw1ZegP8LwqP/F2Iunj6bnUmONyiTEyvkDClAJYNCR6oWTy ToOpVcEFO5Kc jGDzBfg4GkNHn8wmKYdRRsKiRZkQ3PD9tMaKAmeKu/5/AKMSRtcGe Pegoqj8cU&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.dlstockhost.com/c?x=IsymnhuXDG/OshRW7EagyiPku1vdNGZyh2Kl9f3ljZA=&c=8KzV4Kwz2jFqQejio/dPORIs9dTpIfPYDamUcLnS yRNA2grra2AdOrw1YWqi Hll6TD4CHuuyjeD tmvyL6gQiLNwws1s /LbuAlZGpNpPyXm0MxHjTimJS/Jhook3F&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.dlstockhost.com/c?x=WxmOFqdHRr9xIhIRpOb6k1OFLEiAISyGs/IBg/sK9qQ=&c=MwzIQvkOj2Kij5l/yahKvu0xDz0gd5HnDNrCz17TlvD/EW9TQxB5FAurqMKiCR01fbvAG9WyDoWbEZU tIrob0eirD9y0msA52Z81ugVj5vGElSnO5j52y6hvMdaZlKi&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.dlstockhost.com/c?x=yzQmSCHtndORNJdvAkpqZGYUU7wG xwl/zP06C277DM=&c=6q6/05v/cpQMDIMifC7j7VV6ez0QgHBRcTov1d7P74w4ZESJ4SLKJDNmWphM6du3BoSsW4VWNwIl xmGTT4YRxpeJH5YnMhwvIc1L64bC0ZMCGyjVmro5lsjN3UMNaPZ&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.towertagbundle.com/c?x=iVKNKRiQgpnTFMSakwuxAxTsiSOkkdd uvAXH5FSqtk=&c=NXmcoAD4eIgcmGpvhXxiVazSxR1MWcqNL iDWuoeRr7pPlUKt5/ Cs47ri37/F3LgzU6JzU6c9Er6mt6WGMzJkXMr08b91J21xU3bPCIximCGwjXzvhBLR87rZgAJxp&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.towertagbundle.com/c?x=YJGEZS0ENevRmAPKpDhMsYjlF3C EzGOcwTqKXSyVZc=&c=gDHZ2bQs3KvjOa2K2Yom7hReAjW7rr/D5kJmVj 3QN9BA6e1ez8BzC99drmIEoQtYwFmGFlsAJP1oeXRVCCeLZCKZtYRsg7ZdlVv2S7ZLPRBBmaYXnbIGciXoCJ5F2MH&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=Immf0SDDX6SGA/PQK1LROHEGu6E4 3N2gbUcCudwj3o=&c=OeRg1WhbduK2oVKrRSHPoZArPlhGZVtmaEGCTw25lPCWXOJiwGZcreSgmtpP/V9t2/hOEb/DK6sNUGw2rvemEfhGfLiD aIWUQb28sMdltLsN6GDn5 6l4GGFEW3xB08&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.dlstockhost.com/c?x=nq4SptbheLwAYqJXXOrW0RQTUxdqkUmjrN8ax4zf06c=&c=34osiFisbtsTWRRLyPc3IR2rg4xgRg9HVeBBhoColLcMKqxB03gOXROmbMbJlSiQlfD46mNKxAgvrpBt88w ztIqG 7r1hATBzqv9KvEhdlosfge8Tsrib8zRvb9O4q8&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.contentnewfun.com/c?x=3ncNnJwRhYsIm2hYue9pdeQEYa0hvm9kVTRLivT22Oo=&c=k3T BOytedFW604S9mjkvsOuyh8w Of8D5Hk/0bdPYHY/CSShWhIiBuA5pgUIHMtaVQ8MzA3Oo95wXKeBriURwkZfFf5iplwbELHT8yqQzL99BGmLRo/JzernvrNXVoQ&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.heartconceptsdownload.com/c?x=63NwJurdo6JV2oFRJn2BsZjODnVr oRn cXNgiCnfxU=&c=X1RramJORjBjGDZotCVvmCgm5xktAR83NBGq7OAOI6anhFx7Vlq 97tjmeAMoPlcgQw5D8Idn1hZpZ7z5Pa1/o5oPkEOlSNzIidm7iFae 7p7 MLUmNvxof7f6Ny4Rbj&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=zBLs622eiGwZtQoSGQgq2rEtpPN75OLlno0862LqrJk=&c=bt3FUF8bxmMx28s2/kaZEpHpkhQ6MmYiMKjdwacegmZLiK82Sl24cxjQr5zVLB75pjRwKmYxL XFlKuDblg IslhY5BvWQokH5mipnYcoTKumofrDq78u0IVfDthhNR1&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=OVQh xI4G v3sXewr2n16zCcet/cYSEc4vaPSRDSlYA=&c=H0BmygM2goFlE/9dsiGoF9nKtsKoTBgpAICJqaRFQ/cmxi kBW0I5excaQcmeeT8Zy1A/r2WmUNo0ZtK7H5rkIswuRxvzg7urtlKaBiPzxRR1SJKGG wueZmqkLvPR/F&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=Sn4TPkoszlzYPKAOXv6OMQz Wdu/5QDBBsM86OZtQGU=&c=Mrwc1QNOUl8qG4M 0sEJ4dlfYC5hf4bEqATA1YlpuIfjdBGW7Phv5aPm35Qn5TfdMc3xP2UgjzTds65PPAy3ig soLdkdgYxBHY/b7VDZwADnMwgOAT4auk 1pJiDwkN&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.dlstockhost.com/c?x=nAZFz2iX0RaHh6v44lMLhLG joDRgsSOZmEMlxFGvI8=&c=NgwLR3b CjTv79pdnoj9h7SjzzchXZ1KYGZXDM46amtVU2YUYYkkA3jpi4rwMuxMR3mdIy0XhlKK3yLNZ2K1eUHk/mDWVto2FGXM WuCXBI4iKqFF 1WKVICORkPLjYy&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=e5hxRAaAznkDlm0M88Yix4iuFoZfrwz828zBRMU8PHk=&c=2Fh88P5b3fYvXx7xGTcL1cGK2f931m6EIBR0tMpo8jUy0lApEpp 9VNwC5J7vsdYd7roa2abeVjMFPHsrfO6 8csinJP0XqS6 tcxUPye3utPJB//xgGP4TjkjVtMJf9&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.contentnewfun.com/c?x=UnwGiVxdBZK0HjgExh/vCbbFN4oHMGQxsV25FmARGjc=&c=b/AsUCZZWcG6ct9i2O6zL3b7plC15PyD6yQsMHqxobpfiq0Ng5aElPvt23pKj4EopelAVpMo0/vQg cELsLWu4V1GZ8x9NZ4owSV/uv0X0PPFP7h3rILlYH8wcn9ftEd&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.applicationtowerspresent.com/c?x=M2mM6ydIcJ8c8tWChF0K7ckr02meqAqzRHjUsg/LHgQ=&c=xFCPTU 8RnhtVQz3mLHMPdmBrDuQ4pLmmGmhuS5PJ6EggbLJNhUPvMwZc ulmc8rVzN1f8smzylJ5RmWJEyuwbrkg1eI9Bz YLF7AKPuxZjuNws9ooI9M0HiVYqA7udR&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.towertagbundle.com/c?x=BplXGOK1qgO8uL a56CHxBw jaWuMtXwAkTV5o8sbFs=&c=QoWK7JunSORpLvtPS7ezUR5a6MoECdJGUwIlO2vzthWZVhGFXaX ss1sPmP/jn rgCuwoKrdoXYN32zGa9a/4pEQ9T9LNob6LxZfXly4TdIVhQjFmjnI6LmFnqTHm7jv&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.contentnewfun.com/c?x=H2hib9CCl9/vb4qiEh1ABN9efF0fKip3tq3meaFfR2o=&c=8doiAnx1xq8z24EfQaJkomil2xyXW7dsfKE9cTBNLQ0UU6RnZbHyUZ9EK LMlMlMKBxd1pBJ6VJCZqnjX4Y1ZWAoBgPDlb46HoJZ8TGfW2ZqqLe9vnRcuWtPqgmtwHRz&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.packagechucklegrab.com/c?x=RRn 8gAPGUD5RoxKXQJtPc6L6VwmbASBy/F62IoJ63U=&c=GYrubLDBmBhPyyLzdQtI9KlM4nq2AYKGnGPiygm6G6H0XZUUsId8S58sxbZvupdG0a6HE 4HGUxafLtafNK/m90d8LtqXj6hMbcT6QwMa41h6KNxMLCB8LML9kMSqUiu&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.clearmetafun.com/c?x=t4eJvtMcfCydzKpb58s29Hj4geM0GB3whhDsRNgux5U=&c=Q6w1GQHfb00jjAQ2UTGcJHyJlLI8D9f2qV4NtRbo3TjNAvUQg7sDKhErouVu0lKtHM1l2lPFcuQS4/ggLRefhoy/kp3L1aRHWbO3Rj l768 KmqeX2RS0RhO6DGxGbrE&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.applicationtowerspresent.com/c?x=kxyHJFz2iTEz3r0qdsGn1O13L rD5Q7gcMviYZXdgmU=&c=f4VQHQJlqVQHrmbbl1l8osVZWkF1vZGpMVg1EszuvS148Y3OWI/9JAXzF J LMmZqA2UzI2gjkGREc9XnaNNnLkEmgojjOGekTLYJdqd0VZCna0JBaKJzWawzlS0KWl2&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.towertagbundle.com/c?x=vYpKjKVD6TeVhszV77MRLTLhqfHvaIWlTTnyHZ11D14=&c=C2hvyznTY4yPapgWLDmkO9oPqsSHwVZAjV/jgSb8ODR9XxCwxIFUV8TdEdhQjvaVmk0Cr6ddFdv8E5s1YMMuRi92W3Nbt7RgR39j1Dxxu1Pnvk/4IBEbDjn17pZ1AH7 &downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.contentnewfun.com/c?x=78K1PfFW1WrRAcMic42suOlFOZ Uhfx9owWHCQUyTWU=&c=NwgJ9eFk5xoJL VdZY8oKU2IaGzoP93KjPCjgnO251FWK/OMBGUafzbxTxv68u2CHF75BDwEWFojLFnzmv25KknIT fytcU07SMnfHEtd19hVaiimcegKcZyqTUwrGmr&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.heartconceptsdownload.com/c?x=FGcg4sZuXebUHHRrW97xIVknuZYMKGeKTb/TS E/lmQ=&c=HLlFno52bzvm7Xr67aoxb/Ht7bFBBk2wzztYpmTWSrz kjoR41grn2 Q0eTMq3umkkNFhb7uFCo1IwBjSM9MFKuuzWhVOta5AwhkmGyg2gsDeQTXLfOfr0T123M4/Edy&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_java_update.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.