home

icreinstall_microsoft-office-2010.exe

Leho

SetupSpeedy (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_microsoft-office-2010.exe, “Leho Setup ” by SetupSpeedy (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Sobodako   (signed by SetupSpeedy (Fried Cookie Ltd))

Product:
Leho

Description:
Leho Setup

MD5:
c5fce2afe90cd8fd9528d8057f779a0f

SHA-1:
88ee6f3cdbac61cce8062fb55f0c67274fbf50cb

SHA-256:
1ac87bc90d0d82764f68dc0dde2ef70d5f5bf33302f715b753bbf8d2ba961329

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 6:03:40 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.8.15

File size:
1011.4 KB (1,035,712 bytes)

Product version:
2.2.6

Copyright:
Web Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_microsoft-office-2010.exe

Digital Signature
Signed by:
SetupSpeedy (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:09:36 PM

Valid to:
6/8/2016 4:12:50 PM

Subject:
CN=SetupSpeedy (Fried Cookie Ltd), O=SetupSpeedy (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121EF8B655959B1CFE34F05FAFC8D598305

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ZxSG+tVxyzWedCCktHLrAaVTdbuvePvmU1BgPBU2B+AM0sLJ:ZMfTcpk1wauePvmMBgP1BViJ

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_microsoft-office-2010.exe has been seen being distributed by the following 26 URLs.

http://www.bitssigncurrent.com/c?x=YfPU8YZh1X37uev16d UUyrRxQEmZk9/8i8atso4e9M=&c=JxY5sihw6TYQmXUd/jPZRvh1mQgiArVjGVYsteWFajoypDok35vWMkuOKfEYy6TQLVUGvQ89GMhpHh6sqzI9/zK rdzwjsx2KGKRthUSazNTBixrEkePaHbdos8Zqtok&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=8iBkwOpnsM9a69V0FujJR b/tZqfwHe2v96O1XBjtkg=&c=k4x TsTUZ0HK2 hXoeNo5QyTx3Pr13Lvrs3OS4WzStUkOuwhCPzA7eIzn3bCtbSKfenGkhJQDgyEap0n6RZp3 kl9jO5z/Q5GKgUfzGBnY vL yr7wyE3QRrH6UTeDW4&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=xxatFn OWWxhHQZZ5SUdSaW7HxguUlAq u620PNKRlM=&c=XuNPX7XlAlWk 2eVrwxSM8vUSphsFFfCGtkopHL73yp3xgVQ3L86jYCIh m9n9FIesTSJtttFPL82GNnVCr2UjDV7WFI0GKxiXQ/UTI5Srds5MhWLtATkyYRnH8xdR1a&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=ZcXeKdPqUnfsajtWqArFp7pGZoOy9/WUftIJjPZ6 eI=&c=ZfIy6tp3lcueqVLVCTvqsHevGcRckyzsMr7fcH2oBMb3Fvetvs9iaOp80Nap2j/4bJehVlE9hLmNT/6tl6VZABhf27iWjkIYBXHO/EYYVxahmKcv8e44ZYLjvQy2XhI1&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=rzAREQAjokr6RTHbP4Tx K9t4VK2xNFRR ULuaUVF8U=&c=XJjQl/WtZ6vEjDqXywFqYlPABlgYB7Rt5sQOi1S0nYhKSXn2CjrzqsdoztytJQr7mFLxYcYwFF1F6kD6XBn5moX34VAei9 bFMfjYIwK6ARaQrf8zY CFAlND4BcslLf&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=FcloLCwkh1cf 8uE5ClMOwtgOF7lGtCliSAP9leyxcQ=&c=xJyIoJJHZbkAc4GTRK5DpZGfwcfzxzDY3Yfths4NyzdZi4oyKJt6y9cnXVweFvHxAQ12X4TfXV97o/Yda88eg2DkECD1mUoNaqdEQrZPIxVJfwpa0p5m18 cqWyaJQpq&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=9TI0BXsaPVBpfj7wAxmVMOmlNLMMg6bX87PqhZLyQec=&c=/azaZDcCucOrY9shGlQgpWDc86UICj6omiqEmkwelWfeUEtXi1f51c DWdS0Kj99khDrbugoX2iqM2LGGwJ8KetMQPfuhKps2UmH2VKqL2lHxTGYL1IFxiXMRjot3sXW&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=NEiSnkxJnGEKT9dPwX/apx9SjAod1yNZnym2Sb5gG2M=&c=Tqdxo0kn0LxXbU Qt xtgmazi43wL1/y/Zsri/18QX1uewCYpGADgVBhSu32245d17Fks35FNFhLbt8znKtGX1PVbCrG4DNBdnDOTGy/5fy8NqSg5jVc56 tAiWP7Hpg&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=MB0yO6zL1khvnZeWJ7LZrChrJv6s0zAM5tqvHw1JnY4=&c=Xiw0YJWTsNJwJKxbz5il9VWD08LFyridUxE2jgD03doiqFSgyVlyGTIKuhPiwWewL/Gj/ABDqiDa1PqeDj4j8Sb5BpIqybevEftXbHxRCkk8Sqkg6QWJlO9bqqHa/T7F&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=QDZexb57XlD1lDv8pMB3lO6ykEAZ XXFY/HyBUXeclU=&c=6C5Yeyab6LH6ABdNaySQDTUQf8TDGJHDxlvfpFu6HmeZLfoBASKzR403947ylOMiXeE4gCNPRSv2VxIBezxfeX6yWl88Fs3HtPUILMprY PhbEcKBGi47IEIUpLhFFGw&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=0DeGia6aTnZ9hENtrNV0oFAP4qngwAii51lbv3lYkh8=&c=SaRpktOEiA/i6EExKJRAXpK4S MQAxKM0TzJKm5O6tOdI0irqjOfDUYy972T8m dMgVx4JHRwyPak/DwlbjUST47Y8eOHUMrg6mBjx3iA2P8tOe5fmFcn3XFOWjPH/Uy&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=wHiUB1Kv8NRjqeSvf32VB98Iqdf6VDq5jLSitKcRu2g=&c=NGB4vsBLeteAXl7Sufoxh39C85IDuGUTUPQk2UWXv6K7HwZhLGjWetgCxGmZ9zOd9qWHKh9vlxeXF5LRP9FQ4A E5UeeEHnc5DWPGYqAzmeicsqfsFf9i6LcPk7PARvA&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=PDtAGRS03rq0qL/4USknq3xJOM8XwoTr4ckxqsmqAds=&c=MUo5wKywHW0MCm45zOB/8QONhyiMe7IECoi4DByHvT70MtYIYt71VGBEaiTQSEMjXaRAAerPONcPThdIRM/yDXPZwNN8apnr51LdOAc6o2xWlzDiVC6H8JZ5FE1eJS6L&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=cs0TvawfUb9mNo/FG5xCYEmvkmgcAh/G/Gx/JznUI90=&c= MJ6557VFhQ2u62CtctukxByRYC CkJTDlv9TrfhjuxW0f7C2 LzZx1hj5Sz7n Z6WCWAO9kRXEBZm4Ev QXTJn2OiMUu2HFYY/Mp3RTCmCIlLKqpk5czaItf7P35keE&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=k IOuICCkQPma6rHnTfinsFU0kp qFujFn79viPz71o=&c=4An2s3jSB8RnGONpJvz8LCQSBkGm4NuqnSNjwrGoyQICuw9PMSp6F/hZ722vp6ZqfpyojpSO9pjX7X/8IHf 89h5/7ADavRm2Y9KpMvqC460dr53SX6GK62iQvcsuW7O&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=gBS7OHurpeP6KPet0e2DZBeSlULLoV3jD/pU 0I9GlE=&c=Jh1ngeSJZh2PUaLtjYH7dGvpRUp41SMFSUhUilcwXtD/mMX5iGhlWIEJViNWaxnKvOJEfwA2t7SrM6BDX4vYFj6Fuj6WxDAPk1sucMyvlyYMzzSyJOYAW742zedYeGzU&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=cJuP7kIDr4YpTy7wlyHYH5PGhrNBDverC3MoMHLoqHE=&c=pFS6IXKevcn8UHqPefcL83XOJ4fS55YM5lQxLvNZ KaU6vWbavhQqmZvwmGCscgrOQslbQ3f3BV3mSzgZBJo7e4Cz7XB8xPvK9XoTb3eUETyygew3UNbURFwNL2TSsl6&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=8ZFHKdU2UBsEZkGYaXJkMzqS4Kw9/1L Bp5S B2dGUY=&c=Nm69UkWnHuTBJFT9fY11DSbLxGEfSle499inL gJ2UBm/hAZFpw0 UafTog36TLP2Kyc6UoMYSSH2gzY3Ah wZOrvi9aH8QH11iSyoXv9ex7bD/MIYv2/bnBU1 Hh1RG&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.citypackagetown.com/c?x=7m/fHhVhm/gVFKiDQUOiNvtbgBR7rsojoMJWE6PyMBU=&c=5ob744pOUiyJJ6erltt5pM2l1jjq7UIXL6bxutCoBHLumEqC6lgeZtvAJ8XBlCYOWjbCI68fdvgLuGkVkv3ps1R5lM1PV6zjugPadq p9coXqR WUHCEErlwTQEenYai&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=Ry geHCe9UWnFq8go/XLGPhE45 5UKUp1c6KtefSgKI=&c= wV75ScJtLCq91TQ0gMxhXotFn28PeJ7pu5aI8AfIkKBq/KLxHQjn5J/8KsfAIG55g4S91F/Vw9XgnLFScQpnD3knYWq65STuN1zT5Suyq2dxVftCz3BauM5qiLFaNFe&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.bitssigncurrent.com/c?x=HdlCwsoe/TP8T1n6voLA4UifHw6ka30Ehp3xSvWK9C8=&c=Z2OjDZE84QKwLVpZr12Xlvfzy3H JZ0dR4LuEtyeVhIikd3TbZ1N OPUSnY/LbODQGnPJwtPFJi8hQNzuv8PYdMyvPo3ewL96sN4yCKImgBaBlT2LfIvup nwL4NHkD1&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.hostsendcycle.com/c?x=Jv728xen2YklHuQX8Yse7RhQ1sCPuQUUAS9p k yyTQ=&c=sj7LMsH0WGkTOuvAUPVxPsaNux5db4ZvGghKOxIOx MZt4DwGitxN1llzIgGt8Ok51HBk1dLt YQtpUkgG r59zL2PNu 9FQAuBMPpAD3oppgU4F3992JzWcZqwuMwkM&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=IgxGOpOi ojAR/ZipAvMf/nKbtE75CM0pC68tJKXPhI=&c=hNpsYWOj lUrR0FYvvo3olRrdQn4GnCScuJu9fe7X78Q6jsu42nvMIp/J/qEOoO0FByK89AszXPXtXXx2t1ir6ceR8u0miVs/Dh7dLnBwTOZ4yxvIKKnWYFGZBgt9urq&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=dlNxhtus3eyh2nR/DOklWkucDXaXqgOWIC626dama4g=&c=kZs8jQjk2BYJdazMhOvwD8uzCCbqfmZU80sxukXwcEPUKX/PdqWO2iHmbJ1lbpmcsGqQIEm5mjZo5oa cd6FUR7E mAUgZFNcq5Nh2vMJp4oNAoOVPoMBbXjro2IifvJ&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=LafhBlw/ukJToJ1we5T2CG lvK64ljUJMckovdeXa8Q=&c=rv5/8dahYT44LA gS7peKESH0Km50eMu4OoPUT5BxqowRJ4VfI3j3FmjtjQoYZFcQKtucLHlFQ4gOQUA7aPn3ua9srYqrn3kgIB4DgtztD5ov/KI1LKmr X/RciPwq9l&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

http://www.vaultbitscapital.com/c?x=DMkhstIHpnAJ9GRCxFApfusElUlj2Spibyu/Zw HdEo=&c=U8xkXN0bT/3Gl3d57vnruANtn/7CsOdEHJgKCYgl/ahf4E1XVQRH gkGx D0OUWesHYyrMtonZIa0jrQHhvbtv9DGKg9BDdTkr1/kHA8MkNKTSPD8S1x2c/WXNYTFjKY&fallback_url=https://secure.inndl.com/.../microsoft-office-2010.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_microsoft-office-2010.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.