home

icreinstall_microsoft-word-2010.exe

Gulusul

SpeedyPrompt (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_microsoft-word-2010.exe, “Gulusul Setup ” by SpeedyPrompt (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
SpeedyPrompt (Fried Cookie Ltd)  (signed and verified)

Product:
Gulusul

Description:
Gulusul Setup

Version:
1.2.2.6

MD5:
f9757604267c2927a75e27acd3f927c2

SHA-1:
24d13b303ce888972d77b22a684f214b5cfe7942

SHA-256:
57a79914e27fd8581a65c64cb6bc6cddd1f177769fc4932a6965c22a0d5cca9c

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
1/6/2025 11:42:39 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.5.16.14

File size:
1002.1 KB (1,026,120 bytes)

Product version:
2.6.3

Copyright:
Lite Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_microsoft-word-2010.exe

Digital Signature
Signed by:
SpeedyPrompt (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 3:03:52 PM

Valid to:
5/20/2016 6:07:50 PM

Subject:
CN=SpeedyPrompt (Fried Cookie Ltd), O=SpeedyPrompt (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D77437A5B286B055B435AA59CB4BA265

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:iQiZ4Cee716maCIJPMWb2L5z7NuvJKKJDQ76Yafb:i9R6iIu2c5z7Nuv82DQ76Y6

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_microsoft-word-2010.exe has been seen being distributed by the following 23 URLs.

http://www.vaulthostinglaboratory.com/c?x=xpBnWV5reMPZAFwxc2fbo3LIzVftTo8cJgDNHfgPjY4=&c=ED3L1pQm3PdLWsOa0AOe40 E/rJPCPZnKNiUAjG2sMEugJ3XzfmXQTo9M0k ruKwYZ4Vb9 q41ej8PY1kBT0UU1sLn5Tl3vy9l5I1Qpfldf 1Ehq2Evm5RAMRyORvivvWw9LNJN/6KtEcQSasg638SsI0/fiaudocCR1GCf2lm9RHCN4z7 6Kgwdj4RnXaQk&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=q634GGR07Qo6mKleMQVtAbI8A/Gh/HmOW6ffhAL9mJg=&c=u7kekXD1SORrA8oQ9OmmgCsZl0BX2usdXJONY3Ic5SUyA3DupkdXtv0ukp07mfrtu RbHLUw6XymYKz2HWkL6aA I8V2kiqNPZ8dFyYdddrTENQcvnEmnenilIJfGEcCiNWvLIkpbG54bqZmQ5JoThia4R13eL0zLmoDT9MP2F5VR8ecuqgyi/i3aSkLdNPb&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=5ilVCtVInujx/ib9ih9WfG8HprHH0vfFHUjfiC1TqCA=&c=ZFW5hY XEBJxT8EhhId6yeTSgCBwyphX8Ll1rIKLnQC9BntOomvH081ligC84UHZ/24ksw2IIwWvHvgs/0GaF32qskvxpEtLo52lr8 mdDeYs9A4Wpm8li/wzgyEdvl0UT5DmNUyCkl oepz6v8ZsjZ4h/eaW8ByPi2onOfoxZGqH2PJ75711iDDm2A064lk&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=xuvU1o9CyxFb6x2mUA36HqWa6Y sc04KQixVOiNRpYU=&c=kz8kTIh88EMb1mNpGdNyDKIb6LQigzPCb2ALrGINgcLgJLmaRIluY2O4v4FxyCMzzWC5QtvErR5/q2RpFOTwwrczvdKGrBrsCYN/rbc6Y8tQQ6MsIzJKs0ivYfoesY2pLBUkxfChW7iAvqF1vzMD6YTp0KcJOsCT5K3kA HK0ZY=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=vz2AXC6v6gceEIfRDisYB9SCgybZ7/d9QT91XvX0JXo=&c=GkuvbYKSehsqdT6XAyVQrzu8OZHip8I2Ehnf5r9IUlWonYwRIrsxU7go8Gik6RUitUmY1b7pUW5AqO44oAumpq3j9AD1yI1ZMvLv2Gkq9z4KGUSLqzXrwOQSZMphAEQon2W3 e51pxeUF9XicsmTLyqXaS1dJdhypmWOF/vykOE=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=sFmDhwuRZCmV8Po6fW5016daRUfSdxxNO6i3zCHevu8=&c=p1SnlqWXwwSAS2lrbdaGHhuVvRb SoKVwnmJFP6SqKTX8EidSDM/ZyVd2o339oiFEGO9gsD3N9NZGVSg7vmi0XPjZR7gKfvuwfd96YbibIoh1YIMQ77FVLBHOl5 oZP2jDdBirhe/5vJnl6pZk/lMlTyEpouxyjXivnVsgG93x8=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=X 40cYVfPlJzUCvnUVeXXpWQ8gk9KM36AK3/M03t87k=&c=56ohqJAiHs8qYJjUSorHdX9j7NX2oUQk7LUrPsFsPyBeTcxTAq/1X/2AlK3afHkw5ZuhDGhSJmRzYz/IbesLcs8eub1gdkiKW59ceRWI74eZ3DFmTRcIF3a/h8gT3cbuzULehnxdpEWNshndk/5jkL80tF64 oj8fyh4K O1yNTDds6rTx2utsZfsrdb9G2J&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=dEWbqkLMpgFr5gw09PutVMPy9/Af9Z9gwrUsRAJoM2c=&c=bn9NRVXNl0zpWvG2Eh70JZQzeXoGW7BDlWyAMkUPt23ET7kIQnnRVkMhlqYbsBmeGO1dbrn/ixkhEqFr8XqeHsqHm4W5kBWp0UX2vLBED6nZR /mPT5JXFwLsUDlWW0fdUUIbsgFopmdgT6U7Sha87n7ot4dDujXGVf D6/O Jk=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=oHCJw4GMevKE2EPzUnEMVn5lh1oB/LBblysDxKH0wMg=&c=PZ26UfctW0Zs/UfH0JLRveepIENc2reeOtvjI9eRlvNIi5jW84h5DpB4RCn 2qf0uHW0G4i6EgSDeqxA0yg1HxSjl63bOwz6UU1Z/QmFRjLj0IBBPGhihzZPr56MAKqurvRERjGmWDv4TJmd8maVI/2 UbV0t1 kVAOYjeMESZY=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=kHE2QVuB6GtPYIdjZ8WXO0DKMNw2RAd9Y0l6eNYineM=&c=T sXGy8sNOMR06S9uE/nEPwvg07yeFI8t7ypU6vkuN1Uv8ZmVOA43ZkVAESKzkPisj5PlRRx8qOwOdgdIOaeXWtx 5Y0fE4YTu9x859Rq5j2mEzktd7ySoe Hrw1spWSmbY8bjT0IQHdUKr4nFpWJ/uKApU8B4RR3YnOEtkzS7yFNlpa TukfnJyxyocamWn&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=hOt5B9AZ/bnySLKUIOl5p4bLFZT dRu9RwytTfqBA4Y=&c=2AK/DDtbu9XrlAT10LQbljE/8TQ6Xv5bgBPohSJvWUIUykoIwrDPaRKL5EtqIsNgI4StnpVGeEbeb1gzTwZuCiAApSeA2vkwD/tHzJW//vAYtHQv38JA/JiuD3r0 1NOj 7mmfLIep82Xf2NKgm/lRDTFBNF5wkD6ikPHDXR Pi0UlRDxwA4xfbpFFyWR/dN&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=h7wGj5jHrJ5Lwpb5Jh3xrjocn2X/P6Rzf8i2VScvLJY=&c=Kc3cbw6xYTrfS 4zHmQFb2y69xO/FHS2DHG3DWmVe2nuzE/gH J nZCOaTAMCXlYGiEbqQLpbFd3dZtRPwY6ZJ2esdjckTWi/FlxX71WvpPsTHU81hyoU4/sEJot0eFjNSb0N/Vsj2sifCDdO1LuaN6wSXHCor RfVSn XSWeUdp LZwD5YvjMyMdbuELXMj&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=o7KzgmBGo05TNEyRidYtTLBQCuT/H18AKeNZNof/FAg=&c=GyDdn2o4gZYF3NEWpi5YAe1Szu8O tOIldBRUeHtbm/67dvL94O9cN3PG9ues9mwm4apdjVbFqz/RR8EQb83 JMdks4vjgPPX92MjK0MTFNQwMIjKqURTpTyNmAF1xCag6IbcHCkCGcguUgLL8Q1F7H13/zKVxMlTFaPOvHYA30=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=rhwIQg4i o9CK7v//aSDiafjX4LICBe I3YHjKFFb9I=&c=ceig57CiJt7wWKsXymISnz5l41BKnNxBg41om5E2lKrtm/bjc4uLw66CcE0j/F5w0EKEFPiPlmcv9YGQsQIAgRIxUHd4HN8a11SGZwgO/FzAoM6QUN1lMkAzAp8zYY45s2Rpyvkc4pDhZDxUXAJewEe4L2BHYbbMheKTx6dsbWlKYlZFOEvZrUE/4VszxxO0&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=IeCdNbbJHLliNrn36MAeO92 MVDwYWB8t8v7TNECocQ=&c=jPIKhKag8W2yAoetpIBYj1LM9lR9JKW5fFmLkwmlqUlKs7TPcUhDC3BpC3lb241sYvYLQ9lR2KIKzajGD2ub9LRofN0I9RE7tJ6d1q 5ilY55S/sfY5fgWPonRwjmBKrk9EAecYANZfwZ8DHeOSGRiiI/Na2XX3TG371cIkHazb/uBnCIqhGWdJFAO7xEfyF&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/WVl6OTRQVEo1VkZSWFNHSlhXbE5JVGxobVZuSTViRTVHVFV4eVdUSlhTMkZ2VURSTWVWWm9Ta2xGTVcwMVNHOGxNMFFtWXoxVlpteDVkRXRIV1RKUVRITTFSU1V5Um1SMFZXRllPVEJoVEZVMVdIVndiRGRCYVVaWlVFNTJNekZ6V1VSYVV5VXlRa2N6VmxVd2NrWkpPWEpHYkhSa1FtTjBOblJqTjJaUlRtcFFORVJLVDFOaVJ6aGtOMU5uYnpJNVkwSjZZbWhQVUVScFZFNDJNMDlXSlRKQ2JubDRTbk5WTkZOWldYQjJlWFZNTUZkWldGVlBKVEpDYVdselJHZHBORGxFVnlVeVJqa2xNa0pRV0RsalUyVmpZV2MxVFVFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWkpWQ1V5Um0xcFkzSnZjMjltZEMxM2IzSmtMVEl3TVRBdVpYaGxKVE5HYzNRbE0wUmpPWE15VjI0MFNrdHBXRTQyTWpWUVQxVlVPRGxuSlRJMlpTVXpSREUwTmpNM09URTRNRFVtWkc5M2JteHZZV1JCY3oxdGFXTnliM052Wm5RdGQyOXlaQzB5TURFd0xtVjRaUT09

http://www.vaulthostinglaboratory.com/c?x=R4vA6G eJJ79MCGa3z73xlqKhrmMmytj2whZT6lBQFk=&c=LJy1OgXAkE/1UlqW49 CTZB5cPudLu5flvFzLr3Ys4slsTbhsY6gdvb4H3etu4MxGeBn6U6XH4q6/wha5mKPQKjjEnzj7e BqP9lsezW2OTCdEHlbZuP6o5kbUm6Xr5ycrovYDb8CsYARFlJex4K4xwWUf3so69u7PkDHVAG1NA=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=nlXO2zGn5KGpg8k9yWd0OgCx8BHj2L bFny6U66T1hw=&c=m0uNy/QkCHWysJlelOpzaMN lpN5ohVdjkMH5TaNesIBkilJ/KP5IiXS7f5w9gOFvTDVWYtCLfuKcTslQDM0kPd1Tgrj10XKozMPxsogTboLyyc3/k3UHaIpnOeYP/VWTMufQ CLplpVCfYVcqO1XQjHMZpqh3sDW4xy5CwT5U4=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=Xwy1WDYErvCCIGZKF79sPj6/kgQuBU5qACy6/hs0fX8=&c=MP8e2gGSOdXgnTwZr/uLarkCrVWkRLWLoGs8J3skPHmO9fhquOSgeh6uIogZH8tUxKcjBvgLFGJRiqjutsxWlNZz/22EoxFzTCVMmgXP0iZzpq4lne7AI89JQ7ZS5H30gQhe6mKJ5QfryIDZknwMXXJiJEbsoEk9JBotbakUDYU=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=mkjmig6z7JZiI5lpEp5725oiVKV ny29EdUwlo37wv8=&c=TkTYfjl2bN1ssF37r6UU7Aw6Q9aeMSFc0wWP5xNF3WkJuI L31bNg3kgVI3S7hNM/tAS9yvALN4jCARLPFOaBHEUPutgc nNpcl6fI0PJaPNq SfDKXPSMcCF1nv6SbS9rAvzsDx3pSWO80a95zimusfGvJlnF3MJksFu1myrcCtHADs/ xEpooEmEaTD9v &e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=ZKA8zMRRu1el6qYm1WgZ5XcTwkpjpGpVhE91VmN2M5U=&c=1DxZb12OkFPd5LZJem7s/aEc9IPq1sjxELeHW5HtD7rBNc42CmFDTNNwS0PdOdBv8Y8qEp ddQbOSRkhyR216it31YLXPFpRla XDxR0G34DjTjm6aHtq9s6oxK/wIGHXyYqH5HtxOm5V2CRUTMYwWBphqCYcSGk1lQFrrGSHvA=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x=Zz5vp a 7r6SHdv62wbvVpY6LvsRFdkFY3Jbw6hOwvg=&c=xYlDdpRKduGHr6lO0JTaGbdufvPnlmJnx4lOzGYLDlVAkAPvtaV3LBR7AoNE2mNqRE2k677jnNPftxsA5LbKzO7NtA11wdlb3QwEA35nVUjirYE5NMcjTw7FSYY1tSwfIZNx8IVIkhv7LHWjtzKHC0F3VmtdgwaHj6Y0K UdLZKvYdQa09Yz74SPNAJbhZAP&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

http://www.vaulthostinglaboratory.com/c?x= b4uxXOSJpdwI14zC/6FbAJ537cxyMa9ToCGbARcZN0=&c=8GIE57t90M8kI4gpML9x10P u4RK7Y32HFLX FUv78rUG5eMFMpF/uceafy9S1mhGXhv 7zAtXOOeS/mHNtD0zZbhhvOnc4BVAsfdpVrtpxNIraRpdzaaP0qioTTPM6BAinlPg7bmC7bTAg1ZTJDFev6Bff2xJjsMPV1wYGt8TE=&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word-2010.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_microsoft-word-2010.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.