home

icreinstall_microsoft-excel-2013-15.0.4797.1003.exe

Cagolig

Destiny Dream S.A.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_microsoft-excel-2013-15.0.4797.1003.exe, “Cagolig Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.centergiftcontent.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Huful   (signed by Destiny Dream S.A.)

Product:
Cagolig

Description:
Cagolig Setup

Version:
3.6.3.0

MD5:
5a13a83c865a7ee6b86f06eb290d4113

SHA-1:
79db0cd1ca269cef1321120a714727e3969fe17a

SHA-256:
67a26b0d622514247939a6681efb9ee907ac45e244325b69eed54ab2722aa0d9

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 12:57:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.4.11.0

File size:
989.7 KB (1,013,448 bytes)

Product version:
2.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_microsoft-excel-2013-15.0.4797.1003.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:55:11 PM

Valid to:
10/2/2016 4:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:go9v/Sb8ISdMPNf/kLkfz8HF2+7jDBVCyP39KvlDVJx:g6SkaPNXkQfziF2sjL8l/x

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_microsoft-excel-2013-15.0.4797.1003.exe has been seen being distributed by the following 16 URLs.

http://www.centergiftcontent.com/c?x=2E/ZvqHbMTEq4bgezrh58NEb/ahRK84wQMUPzNA6j60=&c=T4XRLtUrQSIjYxAoyKbWHyWDmzeG7eK7o3wNUi5MQPmaGNeuE sdfR7EhUWpnwLC0hy 2ndvrOQQ6VlO1vhNpmfwXRZ5TcXrkTjDrbiWxNOpg49SXgGAT0ZGDGw3j7K6ZcV4GrJreqWY9WrjmPjfyNICYDOPO9ct9fubJ5U/YIY=&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.flashtowerfactory.com/c?x=ZI2ONGtVUKHp DViS1YPL6JgW6RGJjzHNzJW7ttRBrQ=&c=3HP7572bppJdbG89vCNlc0DMpbBwZoTWFf4V8t1/dDiztmyhIFyy 2gAlKA6INuyrCUh/EVX4tP2aDImwxqOD9d4pxZU84TvyLGS798RbGVQN//7C55Ax9IYI3gE0uj3H7a0I3 UDteMVL7tSEHdyQ==&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.hostnewbits.com/c?x=/D3TlC2L08noxeOEIDMxrhyhVCXey13h5ELB9I1nWP0=&c=Wyo8/6LKKAeqzRfchKFiYVBdmVt7fd1sGcpy3EdPnBnbUKeYzd 2s5CvopPq52gMdBx/vBPID7FqHY/JYXlJkcWfIQySlG2Dnb4p0HOOqM3TcuFKljQaRDt2s03WUXLN5x9StloH M7Ah91NReePJ7onf4QTNvCQFkvX KeCW7Ft/AZBasSE7iX0fIbErHy3&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.presentgifttours.com/c?x=6q34Mxb3X2hGk5Vo8lsc7zf7OF8i6aO5cj29sukzf0E=&c=dk42iC1ohIBAWUqHuaiVqy/wRGSs1QDIC9LQPHvKNoqGZlAbtJhiiS/EBhbTlxicm8hTsqbn HCLKC 3oLpImKHTH68O8suyviispUG6V0DCWZGrHoGPeTgxmRWI65E5rVZNFlYmghKDWxHihs9msveupDYxRJQN qRy7rtZJATKjhvW/F3lnr4rjX0ifcnf&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.gifttowndelivery.com/c?x=4161K7bYzoKZONeUbTkulQZ7LF0XOVnq Hm46sRTB0E=&c=8tDobDWn5 sJ6RMU8kjEJ/lZVtkkSvxrH6cRUhWiGwYOt KtleD1K57W6U6JU1sMuZuTOOZJxYHrw0RHC4s2aawi4jlN35/iJc8 UJHj1QbQ2dyDieAA6 CGAfU8HtBzTYB8F0yDjoRHSOe6zq5Ls6IaYuWPUl09GrROtnquBo0=&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.centergiftcontent.com/c?x=nonTfslz1jBnMDQDskQ1PcoByAk/V FC1VqR1RYYclE=&c=x3uEKDgEnYs2iGk2IAE7WIBKL9UzQL8lt/Rg/2laiuL //aNrLbdjsb2OLaX0ztGnD9tTOlJ7qNtn1XrkSGVU7CtmQze3KqzjqED56u34Jdv90q0o/cXYc7mb G9wYITxA6MpmaW58zkOXwp/8VtCcWTHduZIgLNeISaBdUs9SQ=&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.repositoryshareflash.com/c?x=hrLOfDQKOyw4GyVVaqaW/BvkbAxuOwlAOhPbZiKkBvQ=&c=l117 Src5nOscp3uLUd4KO6e64Dee00aFEBVcbKZhiljoxCiH0f8H7QvTI18ie4SBkI1YOsSFLeyWI4EsdXcUVZIR9QPidVdhAxTZIdf7jS9xUePtE4sk6vxYZkHrL/kuyybf/ZP59BMt9ijZ/bLe/tJDZkA9bkqho2YWi4Grt2AFR j6iYDdXu0bJESr6zs&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.nowconecptcentral.com/c?x=Kw5tgl6pWN 1tFQy3rwQ8MiJ//nvamuqo/oN6RksCxk=&c=rgb oWkv48uAlzTOxHXQVget25PuKFXWQl8NU9CtEMTTJarZU3LwtvrAjaBSJDiSWs7woHU1Gmc27YpX3dnDHQbzVvAzUz3yVNVY1eFP/5m4hSXIAZECAZb6sn7v1rb4/flfQtYWLuKF6tg4PudZRA==&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.applicationbesttowers.com/c?x=ZHR2tmMR/Sn4IXWXfzBWA5zriKJGf3l3c7VvmHvOP8Y=&c=f4rpqMM g2R0AO0hlc63qfMKJmNpCS7QlHbmPtu2FTL4VDWl/HjGjI6wZ6AuQsQyVOEA4mXrd3YM5QJhOXrTe/WzWnZRLUQCmdw/wGQsfOckcyY/LnyOxrCBI/d2r4BbY9WBMzJoLQDHMWSZXZ2FWKxLm1OAf56k/KJ3/T3cL x eyGPiui87ousFX1CW9UA&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.softwarebundlebulk.com/c?x=m hxSOjk55KIIxW3Yy/vQtOYFVdsNjUoBnpkekRnWiU=&c=s7512vbyGx3KrPwNXHF/9oc0d04CH2XNWnbPvue9zLH5MHFNUFBWz2r4cQGwFWZVhxCb84LCIvGlKsLiOmgc610FggvLHNOtQE9JSDB13mES7wOgIX0Dbjh8mwW0VRFi9aqPoLov01cgJw5Epx KWLb2uFoApySBGk4ryNrN8EbKwaF4bnu0cWGrTSdeeZM1&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.sendcurrentfarm.com/c?x=Z9/HcikawuFZlp3hjdhluevVSMaNHTAhdtRLr37UmJM=&c=GzpzXMCG1YimLAWrGlo0xGRzgvL0Zq 3QwaslARSebgrQMffxeaik4K0/O6bfFMPuuQgMRIJRPoaEeOJaUDSJdxVFG Lxa FcwM2 Kg2AmvA4lJhyNgFikDv1Ct9Ro XOgyy4yoDd4NZxglhdU1movb2m937pPleVwlMqDDbsXU SXVcHEJKJzIwiUKu595Q&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.toursheartbits.com/c?x=xBiaDtUK uOb8zUW2W3p gRMLvCdRqZrqvQJYYrFodo=&c=X0SKs3PlH3yYLuM6/HYIfpVHyKyhuCSSh8foyoL0BAMmmdH9ns onYMf6JdmUDdHVi5vcwuPFbeQvzEstJd3IaQbWIaya/8gTN5qmsHXQ6mR2BLXeriL2PgIne4uEG2UdtEfI6jkp CZWTV8BGeo63G7XsMoVHuzBDy2Nr5KL7T4NQs21EENx4T9RNC3GYSg&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.applicationbesttowers.com/WVl6OTRQVTVIT1RoYVdUUklkekpNTlVWaGNqQlZaMEZRYmpKcWJFdDJNMnBwUkVGMWJrTXdRME4yT0VFMVZ6Z2xNMFFtWXoxSFRVSllORmh3YkRKWVQwdFVSMWRpVTNCbmRsRkRURzl2TkhKYU5HMTJlRkZQWTFCS04xVnNaRk5NYURJeFpqVnJlbUpXTjI4eFluVjBlR2tsTWtaSFFqTmlTMEpoVFRGcWExRTVkR3hvWW5ReFZGVlNiV0ZMYW1wMk56ZHlTVzVCUkdOS01GcDVSWFpsSlRKR1NVMVNjVTQ1T1V4bE5qZHhabWRaTlRFMlVFRkRUa1ZuU1ZOVFowTkhVV2hST0hGcFQyd3hZbUl6U0habkpUTkVKVE5FSm1VOU1DWmtiM2R1Ykc5aFpFRnpQVzFwWTNKdmMyOW1kQzFsZUdObGJDMHlNREV6TFRFMUxqQXVORGM1Tnk0eE1EQXpMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0wRWxNa1lsTWtad2NtOWtkV04wY3k1dlptWnBZMlV1WTI5dEpUSkdSVTRsTWtabGVHTmxiQT09

http://www.repositoryshareflash.com/c?x=fFP/POULT1n3IO04gB/9XT7gCA8k4FfKLS/aPvZ/evc=&c=6UkNb8pQKLFeOTsPbWB6oq6KwwlnhlNAr9v2 oyIDdAR5ngyaGkmZqwnc1qPGGqVGCjnPBPy0lwlm 4bEZEVIQNQ0iKbm24Pah1Tt9y8N71Kupy85FM5LL4TlwA3FyjPdNIYndmm08yqpC4Rcf68cw==&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.headcleancentral.com/c?x=6UaZfttCgHgPtXwAIRtKaRini7MOZZyuRuz0qnd5jYw=&c=BrZWRzv0OUccM9QhDKFAkXhb7 0VZn1ArXNhV65iP8NFGFka1kJfcWxJrriNeaicm7wywOa08zRUie8qV8I05zzWjyrbJoD1Z56HHuATwd0iTGxkRJS4 rsZEYcTZ7Vf//yKILErqyN6CLY2HE7VKfF5DNiZQ8 CaYZlC1UX1XF0lV1vvO97OTVs5n3aMceZ&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

http://www.contentsoftwarepackage.com/c?x=alkenhCQopSyonAqaaOtTwSHljYwOlh OGFTxZk3jkg=&c=Rd7MlW1gDyz3GEEIykQgAK6mSouX6QxdsSM1g94s/u4/b39ExIlpHR WIe2cF6PWUWW4OpgXS4hdqc33Zy1WXkbEpSsCYZuOoyDWS 61u483W68LA3oiPCX3R JDS/MoEaZS9wxYPrRVF J8CLd5JZ8xWfEJz03IzKQC6XqqaIm/p58HuVHWPkwB7UAReMBG&e=0&downloadAs=microsoft-excel-2013-15.0.4797.1003.exe&fallback_url=https://products.office.com/.../excel

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.