home

icreinstall_microsoft-word-2013.exe

Hopogeru

Destiny Dream S.A.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_microsoft-word-2013.exe, “Hopogeru Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.bytegiftbest.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Nedak   (signed by Destiny Dream S.A.)

Product:
Hopogeru

Description:
Hopogeru Setup

Version:
4.7.5.3

MD5:
eb13a99d0ceeb900425baded2cf9a64b

SHA-1:
aac1c5a955a7083945c6fa55c75510e73e0e039c

SHA-256:
a0bf3a0e9562b97107c3fbeef68a35787b2a1760ab6794cee1700ca8ab9fc2e0

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/15/2024 9:52:21 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.3.21.17

File size:
1 MB (1,076,112 bytes)

Product version:
4.5

Copyright:
Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_microsoft-word-2013.exe

Digital Signature
Signed by:
Destiny Dream S.A.

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:55:11 PM

Valid to:
10/2/2016 3:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:1NNS9iiH//VgVWKXL3q4cWN89yEqUvA9Ja8C:1XSoif6VWKUWN89b49M8C

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_microsoft-word-2013.exe has been seen being distributed by the following 19 URLs.

http://www.bytegiftbest.com/c?x=7gZXOpucGtVdccavnoSjNeQVjKwCN7ke7oD p1A0vQw=&c=2pW/VtbF67g5CEGf06cRiPL8n 0gtMoJotvDmZ3uwd5sdoFPJC2wZOOd56mRClpJ3HKh8e1CJcrvlRddF NaRais5A0zSpU3k1BYM9e0EowvVAO06IXzM2v6GsH xUYR&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bytegiftbest.com/c?x=Qe5zy 512R9krYcNpeNg57aBQk7pDsVeTdBTaaMOytI=&c=h6/fXZzUzqHlvy tcrOYsnlAC52O9UoDSfW2/mMsG7526by2efWK 8v4MmuPqpwHePUA4zO8g C9Q gvQGLXe/jg9/8u73ZbbztGQzU6ymTWCHQAvBD6mLZW4wvm9FmA&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=1q87U1hGlMw5viUFgpWSNaGgRQgEkzID8iFDOHdjtKY=&c=htRIkjGx iUZI eSAoAQjsrKxPJn09CYBqiE7ZrZsGa7LJe1HYtScoCfwqP0wTv8wKXQ5mTKFA K/AmvhrJT97vMUWVYmBnsXVswWLo7RePrVDlI6ElA1NVddmvw7tP9&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presentcenterclean.com/c?x=9lvc5OwYr 2zx3aQqPR6PkisVQC20W4FcuVKlwpR7pg=&c=fyVkkKr46rs4BcYLwO3ft6NCrpBX pBvQEkXS79BBvguFGPp23A5pIv6vdX5peq7M36zxMlG3x34GBFaWIvr3mpNm78v vBOEmvsFW2QqzAvx1EqyUFZqGujQt9ikULd&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centersharedelivery.com/c?x=CfQeIpP5GargPBMMLft4k6VKl1GGRJ76Nv6afuy/3aI=&c=5icw0Dqv8YgDlEbUjoJyi 6YDxFRaqScocQa2S/yOGgPy/ITROwJquF5x4OQqHHDlYiF0ugPEoksbaFeH6ekLDNQ3vM9f2H Ree8xtx/hXkYkgx dAB5eOLvCfSjIA3/&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centersharedelivery.com/c?x=t5sVRZmEef4fGga1 bwe9HgdF4AcsOg7ws8MeTmvBcg=&c=UH6uwVG/vlNA11NdiVHQ8mr42DpyBY0IOA5hRfrz07fQsGxugj577hrh3g qogmYcPPlwZ zxz6xRLSH9n0Ld/O0NEVqMKT5g /E5PSva LDMDIYhkTaD4/ Wj/1WXyC&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=Y2oxpIUR/l8xYj9cMbMrhYoEFmF19TAVoi215GIPh6Q=&c=S5ZV3Auc 1HxEYT0eLb8Rp dTuj S0WZP1SXOVQc8XV/caCAGPdzktJIl QjxEMqlOeUxvBRAe7K/lqop3EYLPLqyWInRujh9fmYsVPh/ocH51kTOU3WnrPlE8rmnZTi&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.nowbundletowers.com/c?x=2Mglvp6N/obzzwhrBciBPiKmcGIqVV6bzydb/R2LLGw=&c=hh/G4l/Gk0iS24IcorZ9nJ3dWBtb1tC8QyVB/XbouvvX1O7/jx7y0QO7hZfB tYQCbfqPsjawxv/ddQOVtV0S/NWueu/HY8eDuqJM4S2oAgm88jHhPxg8CO/xG6wG2Ey&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=Iro7E96FkdaCLvrGFFRXNpirgUFp8WgMB/EbHHxUd U=&c=oCEitQr/Kccyxo/LP2cdCGXLoAl53ibWgI gutmHiHIA9y5eMQp3d N3iWKuMwjeuOyVSj2GKtqvedWlZzeLUyRyOWvhMZjWpSPx7H9xoxI HozjQV0q3EKvIX83x0SA&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.nowbundletowers.com/c?x=B47HSszROelGutahUktksLc8MTR7AhJkDrT6TtSxYCg=&c=IF/E8vBf7nMtiTROMLWjlnDIIN11apPcJJlRTLo7lQB0rr4bjBI MxdJ8d2Rsyi7ofnP5cBgV2GtQKI1KD 6T3I2xHBPKTXkFfAW3uXS8IDC8pBz3l9dlY2dwkxK4Ejn&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bytegiftbest.com/c?x=n3u/ATezbqt/GjqDuMvGaudTvkeEKj3xuQ50LYRwixc=&c= v3b4tJdsuZ 068oQNRBrBXnjXhjOcvnkJD32XSL7WbfP3bU7DXohWHZizoE rtmUwF5A/Iv24YrDnBpk4GZhhJv/e2U7/2s aX8dxsGUgZgP1u4h3yMETduQJ4Hc4M &downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingapplicationpresent.com/c?x= J2jUee0WJ9djZDZrufrbfES5KV8w r6qHiSW/LfQiA=&c=zxllnOUC3b7Mj8s0m3VANe2 obC4GmAB6pv4 Ufaj5P1L/TT8WSHGKscEiDnac/pdZma1 466ffR4ko3lnVR4ARU5bvinRSRSas4faRppK4u4pzKpvdVwN/4Md7xkLut&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.nowbundletowers.com/c?x=5WvbtKs/igC8JZym4O8JX5VgKX2rY8wMYoax I6 l7g=&c=J38Cpew099PYAUZHGnQIP12elUWKaXajvVtCt05KRnDTuxgKz2TTG99jXaEesDh dQMnAg4Q3YbRpszKt895Jbapxy/xwOEVUgIYJNUFWDLGxrk4xGasuI 4NPpmD8gw&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presentcenterclean.com/c?x=sA3Vx4us3BRe4xEd0O502YJP04qWNqboxyjw31nG7R0=&c=XTpw5GDpyrX9/Yq3cZKIPKkbv1VOqVplLiaFtkxj2k5OiuDgzy0yTJ/g/0JDvqPUmYsuZ9oI O0IwZHQkhFurwgCQ GYLNVuRPl9nVQmAkmWi/YX9ksrJSTcLhTxitGG&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.nowbundletowers.com/c?x=2JLzwiEtAar3un0TSL6raPqxAQM1pcP8YEm1XLmrgRA=&c=Bz/J6QKrwbd 9nVs2PM4a5SU4Z12VIa1QAnuNpUgE64WPB6Nl4ZFkjf/m86gO88cYJQPGgRIxoW1SJ5LtB1TNLEcRv1/WMJYcwAi9Zq4j1UYmO7IMTjBEEbiomJiE4oZ&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bytegiftbest.com/c?x=OkZWoIr6Qs/ozHxK16UE5SUq3kHQ2tJXhEe/sZ2S8/Y=&c=YM6PtRvVbjRWyJnQRaWKgiS899D5N8UExYdnaZuTIKeQkT3R 2ujb5djrjmIn dSpntlPPAsRE93eTPmFrffkf5b1God1PQsdmoqIK6beBIWB3qOqSwTP7X5RABAjivK&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=WMFIqQMwyZdqNJ1Y0mOqYxrV7RqdefKo0bMD6gaaVC4=&c=RPJY7czbADMld7iUDCEebPebLxoRJxauH8vvAEMsOwR6iJxapLxcVySCeLRbSanUxQd/AK2Nm86zFq8hpoteDYoER3F3QGSbeN3pKCD6gNXngkwjE9DKDjX6434cACcx&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingapplicationpresent.com/c?x=GSRIMeEXbFBHhbacoAo5ZWFy/B87e6YGM0iXZsVcMhQ=&c=8tpxw3tHMhifwuru9i/fgRoleF7SRoCeylGWX99QQx1bRIhKLp2obrs0ok9dbD/izisicE/AJT7chGNNCxIGnnEwOKislVlYlyRk7w1CTHttIluT8P2Zt SI6yy0CODg&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.centersharedelivery.com/c?x=k0wWXn89AzXaIaEGVSS8Eb chHRbMITBlok/MYQVb94=&c=o6q6j0RyGSOUP0pu80hgIrKN24Qv1s7eg8c30l0 Aqsf8nQPXg6gWgg6jiisjh9yn61aNSpMWR5U6v LzBWPMOGMQs0NDVE3DHzNmuXO1CoEc8 Sp2yjID0YQ27zwkHd&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.