home

icreinstall_java_update.exe

Lite application

GERYON ADS SL.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_java_update.exe, “Lite application Setup ” by GERYON ADS SL has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Oracle Java Runtime but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Application   (signed by GERYON ADS SL.)

Product:
Lite application

Description:
Lite application Setup

Version:
5.4.4.6

MD5:
475d58af03f243962ea738c03e562665

SHA-1:
a3ab2bf09a7f4db9597fb812842a2350b8491cf6

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/25/2024 2:37:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.GERYONADS.Installer (M)
16.1.13.23

File size:
926.9 KB (949,112 bytes)

Product version:
1.6.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\Documents and Settings\{user}\Local settings\temp\icreinstall_java_update.exe

Digital Signature
Signed by:
GERYON ADS SL.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 11:21:05 AM

Valid to:
6/23/2016 8:17:17 AM

Subject:
CN=GERYON ADS SL., O=GERYON ADS SL., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112181D069E2BE8A14952BA745AD05847F6F

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:SQQpB6AGlIyFqM+sD6AAiIEEQsoTT0OMR1YQjkmuVyktBaN6Xc9HXt4OSG1cj1ze:SQQ1GdF5mvXM8b1TuV3tcYOHmIAeYgz

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_java_update.exe has been seen being distributed by the following 41 URLs.

http://www.signcentralshare.com/c?x=6zeMPOsPBgDb2LcuncgMcbRQXKyTtPX461SMSImFOuI=&c=UdaRiB9C3m ZzJN2DjflrONYMvLIZqnX yBOdcvD2VYc4bjF1MvpNejsoFwT1G SUElu8PqVQGOYPbhEMc1eVJ0yoSaa5zAsHUicu6qxLCnSQR2MNGwIbeiFQHu H3Pr&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=SmJgdio2/XPkItznGF 5T lLz5pCoeVWnSAU51Z1/fM=&c=xbpBa9vo1CPhmdyvq9/yL0j45fo11BlAvhA60SVnha0DasMx0tztEtW/oTLGhr7tW/CcR283NaL9v/glIF0rLiCEbt1oT8xjVh /CuYgmbub/8q4aRbSA6CW/W4T1M/F&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=rzT7jEu34N82wGnwbzuLdxyHBKBLhu0CA8l7CkhqW38=&c=OCoE0W76a2B00Mj qpZbR7bDPGExn2De59lXshh4zVj4LOMaq78QwOLH9m5U5yhH3CeJe9ab7sdpenHziol3WdeNg7O5H3zliUcC4 OyRQBybuY0 x2pmq6CttBSxgdq&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.bundlesgrabheart.com/c?x=7gGJQD2SLn86L4CB7Qk3WiCsiE/TtCnjSi UsYbnHkI=&c=jUX/O0ztx5nVtO55esBZJ6po8ER/TmDQdwQQYgYvA5b8SJMtWeUSukg XUdsRXhpCdLayZFg Df5UtNwtHrP2L14IuUNhUE0ebL8bxTfP mwZnmM30UJTjH9FHMCY1tZ&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=9rMBAtrQvE0EWViuEX/Izrrx633UEUJVoiq/V0vI9r4=&c=DFv4gqD5DCxOi41TLyoegKOAskh6ZkVZwIzF7iBMh09wrIzPDBg5OT3smjcDem0pR21ZynafDit378Yh85qsHe1rzT3LDh1FxrgrqpDydo1WIObA2ucME1kax0wOM6r1&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=nAQBxMMfXdLMZdf0oEZzuy35oZ361uwVStU7t7vI8Gc=&c=15jZsLB3nQXsR8Rr/eN9KInHFCiM5uuKCSZHDZoxCUGnSIM0tpCya7trzNAyQLh1WaTLkUu4H xu5cZrYsZCMLZgQz6Ir8cY2Xh/mSvp05UIF0zLMkNaIrmi95cEShVF&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.repositoryconecptconcepts.com/c?x=dKq7pCQXDk3gIDrmFptnM G1 Fy8NQp0harZez6Z7ms=&c=e 4EN/hR2IZe0VYWGEvAuOYMN0fcgc4aKlqx9GuKq7JVnVbfDHWiAz3UpcVD9Rv5itMSpV41dnVwVOdShahFCK2VqktiLwrtQYUX2KSoQ4P2YKYyd8Lme68YuOHx2cMY&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.bundlesgrabheart.com/c?x=vFNRTodHjPhVW50zccSnx48I GqjaSZQHzpXREyksbI=&c=yzZPVvbUzlumVc3s0xYXrGZQI9L8cZMWDkfAYNydMfCHMm30yvPgTjtWcQCNuSm5075u0J7A7BJ067dCX6f6fSuuktBYPekvUnaYsT31tpCQqC7B12fpAbQxMyg3tQf6&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=0in20fkO3m8ZsLQBJIhLj2yc87YyEdRSTjxRoJeJoPk=&c=gXkl2j25q5bK MHuVWYBZzYZw9Y/eSFsrwu7KvXZYIUkbRn kzmq42BLiKJm6qJBJq8s1kV5xFU1jh2aoHMohGxm6Aj3glTLBl6W8rrfRsSQf/KegtHaQQu5cAHWTueT&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=znUVWY ebjHMt/qa5kaCgmvvnAheDQLe7AFCGWa6BQY=&c=Yw0 yHQqHL89it7F90QIMu8fydv5NxI695Du/qh2ekTL5V9pXburo3lIiZ12nLzfLH4Q8HnTqd1P2KabSoBN1iqKW//fLWkH0nKwWBNiMxyN2mIbUpQ1h2/BHmHbsLa3&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signcentralshare.com/c?x=menvG1ObLxoPYbNi88VPr 4xj9e3CRpQ7BNLc2veLkI=&c=E4Hu6qGUls/D28tLo2RKei/S2/O0c2jEQ23EvwoRmZ9qJlqsZBDwwfFpaPPcMxVfnXVaz0vkLwuUcsGReqRHunvVpR12kRWWGeuv7nSOgMB3FLvu0l9jgntNHOSdqya/&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x= i8d5hQaz8XS8q5LiLGaB/WI//ZGHkEBRSb4mppQrLo=&c=3VzPbtphfMgge/RoK9Hkk7ig80ezhdPrI5Moev2FQSx2WCTIqPKtuAN5Vh7/QwExv1usKNejKM4sbcDHplMWGzeVL7KRlJrsfbeEv78FvosxjzliuAoM0/oDk mr0ohJ&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=ikUXzi/XIUHeENTVJ7ti/Ot8M/ZgzVQe GCj3SaZ8Mg=&c=XeyHcqLT4v0OyJiBzSOm5k3DBCeHe6jNW7sRZdXqzMKilB2 tVDb14F95QksKTcm iqQzrcOkpV7cds6y6PfwqQpH/U8K62Aq84XfOCcHFKlpVwWqCm1oB1NbZwiT9PB&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=f9XaR46o4zil7HAB3vaUE3HKw/UeI9shnRCP4FWMyjw=&c=nYyQIOUBiNhDMzjKoxVxnSbb3aO2AfHCe6SxtSMgqJ2Kj0DcikB2qmZnvnrlc6cluLuKGHxprKzO94XAdZZ2UrYc30pwFWjnDvE3v5I1ioL7tIfYNA/FCRHGTUK2pfT6&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=L2gHNvMH/eUTXsylWhDnrW7fZ/UsDe/s6qjVX6WRz0I=&c=yaXxJzhf7ejnLGkriuT69qDvdzuhrMt1lbc0qowKGWn0c IoacpVBw3 jvH5vlYsf6D7UANKG/oJUuwzt olYZwuarbb0dfc5XFO6HsbWybAcbEhqOC YkeC7sobD1em&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=Eu5L4raQHkDJwkDP5IUppqK5S7/uzDQ2N2z9aIGMB/Q=&c=sWExMMFJRG0i67qmUwgQ MiD/Mfpgne8tnq7jC80zkem6DVYRrX0PrhJwwuY8Lh2K2neoSmPxGzuk8umrjucLwef5iKTke3A/LxfRmgtSfBC5BRI5bELpbmCUqOWNy1 &downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signcentralshare.com/c?x=iXKypyWdZKX5Ld9/8FSM3PZYcCskp9Os1Dp4Rlun1Tw=&c=vx753Klmn6laEeS9CrcTbnJ593vkEP 0W0ljmoOik EjAIAp MxgaBLnbRuMJxOVfakCbcs1oOcvM8KG7BPVk6TzLdgshLYRWvYhdu9 yYVoLLxHhJPNhRVjcLN8xzSJ&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=BsbuH9sdt9boyF6yPpmNpUp jnrkt4pH8dMQmCVS4LM=&c=NrS8zbnNbL E5g5KmBtCeVVcs2RGw2eIdS7MfKqQqiEAB9/IAYRHW4PnzBRIqDGVGIKvRcmxasdff6N9QKlkRK clW0tMQYP/iMfmuQoYj4Uzw575OviBFWfSNa4B5At&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signcentralshare.com/c?x=IlP06hK AnrvNUim4VhN799HXcavwNSI rXwiE5vSOg=&c=lSsu93D6pZ1outcFWH6XUFnieBpxK7X1JFACcXsh7ZOThqMAJ2GJc akjh7a59Lxy6EKJ0mslUoRGnkdnsestq3Af8jru5Ue9vm4jTa3fDO0AUxx9S4Z2wdJ6xoYpQTD&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=RqPcmTlKaYCg0OtghUQ5 /BiJlpy6GurKCSX/Mm3bgU=&c=qYdvFnXQgMxSSMNMOMLPrECV0h43gq7QXALKRzyewwj9gEOjMFRhKxdU96Q y7ku9SfCbFefSXfy diOy1zi/nWi3HnedfYGpF7Go7BAhHjZ8Ckr7emo6XlxxXlzuQuN&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=6Fg 3m6olAC7VjtE9NHTMrUTL/ pDAbC9SPIXaaiVZA=&c=39KTKmqOBG CBLVyUrQVi2KIckYLU JKIZy1 8Ao 0ITE48XjzN5a5mSdH5XjeuBPvtotsJlub8zDaZIjRGPMz1Uw1rEmMoUWrIYxoMAefNF0gA1aAfzxl5fghYAjH4g&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=8GaVLdnLXr9qBpyS3cNamo EChDf0l6FoXfNwRGxRhY=&c=/34JjPYUyx FfuVciRT0UEUy5vofKRZlvr3ev8bQ9nzj0FoeGQaQPD17n3S65nRjE6gdzhfzf6Z6YVVTuVEi3g79YqEmWF7dNZDfB2unYre8Cd59FzyJwtDx1BjpTlpB&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=Pwi eVvH ilhXHvVns6iHzi2bZ66WvsebWzgg0gH6tA=&c=0h8Lq6GR5RqhAObl5z0qQ98pmThPlumfToytjZG2mo1oSLjbWbu5tqp/svWkcSRSLQr77B4lWj0JJqNVwYOo0sX fSsqxc0V1Th/nksWf8I7/ScixjyMhv38WZ04/QDz&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signcentralshare.com/c?x=mkduJzzHyfW3nZZTKpt8DFU3wwMJwq07i9ER63BJ2Tk=&c=8iCzb3pvBspxGnQhJs7DoxZVawuYadpf39sdd5EvePY39205kivW1wWnRr3iTrN2KYeeWRUx8zC IJHWkasbLCmwTJA7JM05iE1jAVspv3lqbyHAwQKbrKn676m09oUf&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.bundlesgrabheart.com/c?x=5HWPQLAbP3zmRq3lqTh7xJUGYkBWAALqrMKkCJq1xV4=&c=3qSZYfAHb/bedo2jKkP4ABJV/CqN41n5AJuX/IzgDYMKQTcRFzKJcBpftRXpnF1VU0IEB3vDXAxTw0L9JszIUJYvJd0ELt6QqAh/7iiFpeH0IveOiZUKJ uF1oRdwzSl&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.signcentralshare.com/c?x=j4V61wfYhL31pgXQDam gUH5JW7n2OLWWWlmnNOiAEo=&c=eNAfLJms1AUMPopUh83rTbxm8A2gtk53vSEkaiVNNBdtW0Vj47Am8gHW21BH jm0pO0C5wIxyUG6M8JzEIugbCL/Bs7vEiJCrd3SDqAq0OS7gy7QiuP2O7XfeHA90HOt&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.repositoryconecptconcepts.com/c?x=SwYx U5Ur81rFuluTIKfWxH81UOV4EjrGb4dCuPhBU8=&c=suFdoM7nATALhPqN58eB9mLeFP6k3pt66SJAgp5zsy8Pr/JyaAHaKvquzGMLsUx KP/ieMzUpcVwSaDNd5QISmh4NOMkn/SUiOqvZ8NuOAs3P8wh2Q1ukqYOn0ftSYwG&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.hostingapplicationcontent.com/c?x=HoJ/xoc8ICb2nnSxgkaUsmY9lE /nG14 0mQ3vNH8/g=&c=rvBtcgdjIpDTaAKXd3066FpU5ysb CmGYi0271k5WiMAafFoLyB6SSZgEVFU48ruW1HqGa9cu6hi7EhlnpaP 9rpErItfOij55F q5D oFYLbzRMILrne6XBtcJPTSli&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.tourdownloadtoday.com/c?x=FTuF535sfUuLQg5A3qQpgWVSeBzcQBOVuOvbErGXnVM=&c=0 nybRGkpOzm5 q1Sbe1vDIZy0vPHM3rvjiFDb7JwZiiXg9 uzXXqoQm6ozL8ED9QPMk04tX/dzKby5Uy/4Sur16praz36lOOEU/Prd8bTlGrPy1RyAHAZiLOpykgTTZ&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.bundlesgrabheart.com/c?x=x21Mfta0TOCl9UlCcthlYuDRHbspzBpzhIyypzOn2dk=&c=t0CbX6OEItrEKp1YKwDdD9Dn5 2Z Z0S9f0cjtuTCfGOQvqYA4cMiWz2O 29NWV5uiVDfGMU8 PBiptTUP2CuMKIEGCYWzsgiYu/3oSaCjNJtWMAS9MQjkduWZRa3i6 &downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

Latest 30 of 41 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_java_update.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.