home

icreinstall_kristen stewart.exe

Internet Soft web

AVSoftware

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_kristen stewart.exe, “Internet Soft web Setup ” by AVSoftware has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from cdn.nextadbulkranch.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Installer   (signed by AVSoftware)

Product:
Internet Soft web

Description:
Internet Soft web Setup

MD5:
a4575a779552961ac2d383f807d40919

SHA-1:
619eb1b8c27eeb026414580f2c43c2fd92473621

SHA-256:
6c12418cc1a04315940ecf7ac9a8314f84a850e44c2b317f2d119c575af72742

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 12:25:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.AVSoftware.Installer (M)
15.12.10.10

File size:
666.6 KB (682,560 bytes)

Product version:
4.5

Copyright:
Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_kristen stewart.exe

Digital Signature
Signed by:
AVSoftware

Authority:
GlobalSign nv-sa

Valid from:
3/19/2015 10:56:38 AM

Valid to:
3/19/2016 10:56:38 AM

Subject:
CN=AVSoftware, O=AVSoftware, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112124448F1FA45FB449861B311C88593985

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:tKopgr5S5jg/jY2aoEpDs2HR501mbDzyku7ulkZtSrqHTzJfImYnnl4w:tKo+M5iUZsYR50EbDzysifJgmnw

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8937

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_kristen stewart.exe has been seen being distributed by the following 3 URLs.

http://cdn.nextadbulkranch.com/c?x=Co8acg/hmrfb3SonhJXu21RKUTrll7/bkgkAt4p3ZS0=&c=wkBEEqbgx16p3oN8C Q/ECpqdQVaeaKYOhx7rDNOzS5Jfq/Z4pPuVL8Ontr/ZqHI Yd63cA3delbC0Z6EDyhpKnXryuZjiHII1Sdde2F6E0iThGHQU6J/G08hqR5/FO/&fallback_url=http://.../setup.exe&downloadAs=setup.exe

http://cdn.nextadbulkranch.com/c?x=ZBh8sJkptkovo/tOhm9JnSAwO3Zf7WXhsiWT4DI69fA=&c=3B6EE1Su4QuGa8TIZbc0HiUN1mOTsxB7qsNqFgsBo8Rs50s0cFtQ2uhQb5P XC93HPmxot6Be6vRi7fSwJeFVq84rD2YVDrdaxEdQj4ee9DzhkHk5TzKoVnDb3ObIABp&fallback_url=http://.../setup.exe&downloadAs=setup.exe

http://cdn.nextadbulkranch.com/c?x=hX/gY4PEUTOujEflaTSH8ZGBgRsOILSxZoM9CrT0UZI=&c=7Oqm/tV4BbPT1dPN8WiYl L9xVasBhDVg4XhX811ho7IfBHTIk1AtEVzokHNP8ho04nbKQ61AUcfQ uGLBVxCG 3itpIxJtKtNJO9Ngf9g2/FsJZSNffTiXsTklSNdfC&fallback_url=http://.../setup.exe&downloadAs=setup.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_kristen stewart.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.