home

icreinstall_minecraft_1-5-2.exe

Application Installer

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_minecraft_1-5-2.exe, “Application Installer Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Minecraft but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Application Generic   (signed by MICROMAX STUDIO, S.L.)

Product:
Application Installer

Description:
Application Installer Setup

Version:
4.0.4.1

MD5:
81dfb1a4721fda779281da4e145cf796

SHA-1:
58a013b52682e381953cc46b25e2fbeb33001dc5

SHA-256:
9be51be3b70ea27dd4d302b670701762a5eb6e7dcd0d74037a6b759854a5a2a4

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 2:10:19 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAXSTUDIO.Installer (M)
16.1.9.1

File size:
916.4 KB (938,344 bytes)

Product version:
3.6.8

Copyright:
Application Generic

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_minecraft_1-5-2.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:av//uCoylpB8bnLLFKqe+PO4efJOVGykH:av9BBSnL4kPrEcPO

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_minecraft_1-5-2.exe has been seen being distributed by the following 3 URLs.

http://www.purepackagesthread.com/c?x=zjQhbLccAOR9wWOpuQCoHWGvDLtTUMGNEcwTqIFXaD0=&c=SCDam5ylIeW1AqGvvVm7Ta17EPsA rmzoO4W lXXAQWUDDQxBZcLERtBJsJSQWce2UUvV0PdA90k 7JPmtG7l6gdu1O9h1/81MvlvRPgU8NkTzExMEpkYi9FpwflNAc69ApX86meNlHEREycCHUJsw==&fallback_url=http://res.charmchorm.com/.../Minecraft_1-5-2.exe

http://www.purepackagesthread.com/c?x=Jq9 u0v7d3pAlKp70QQ3xVGvaMNsDSv7VH74UXDGnfs=&c=ZEY5c2Sml oU Di/3vm5Gk0rg62c2yHLLSIjc1jRB66YYe3gXndqKdhoDd3VGj/C8ElSKpclJqQ6o3AOsYZnMeMXn2Ao V3Jo5/bLnZcSPoWRRsb5xFZiU03dU8kLqE/&fallback_url=http://res.charmchorm.com/.../Minecraft_1-5-2.exe

http://www.purepackagesthread.com/c?x=E4XkN05 J7YSNLG/zX8D6frX6WljpOr1pMkbrzxPln8=&c=Ptef 5VSlzm4qYywPrkY/6pVvh djk0clN/nQQmGYVsfzVo8qUL4EdaLUbNqAWl3DQhh6owbQBcwpM0YHEb//ko HUC0gznZ7AUe1s1njWLFo4B9RmE Mapsf/nMmh5Y&fallback_url=http://res.charmchorm.com/.../Minecraft_1-5-2.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_minecraft_1-5-2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.