home

icreinstall_openofficesetup.exe

Software generic

Software

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The executable icreinstall_openofficesetup.exe, “Software generic Setup ” has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. The installer is marketed through download protals and search ads as the free Apache OpenOffice but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Software

Product:
Software generic

Description:
Software generic Setup

MD5:
ce756faef682c6014cd97ef1b6ca539f

SHA-1:
cc7c8343da5c8bd107a797f2dc1ea631c4429ca6

SHA-256:
f2fe680d506e725910a0d2851436f2a5297c9d29fcfa12f6afdaa0300805d051

Scanner detections:
1 / 68

Status:
Malware

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/5/2024 12:48:00 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Win32.Generic.Software.Bundler.Meta
15.10.6.12

File size:
749.9 KB (767,935 bytes)

Product version:
1.2.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_openofficesetup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:n3o/p1yL7sMaXzVS1eWYVv/1yjeBHXydKb2omKrY57QPnc7DxjvRSnz8gxjc00bm:n4/DyL7sbjVSlYVv/1yjeZ2RJ5Acn5yB

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_openofficesetup.exe has been seen being distributed by the following URL.

http://install-great.org/?dl=1&pi=ATLFAZgyNTARNM==&osos=VdluDrW3cw==&dr=cHaWck1JcrVu dDmIKNlvExthXN3DKV0NQDzcj1QDyDphXAmD3vpDZ0m rcWDK4m7dAWTCwm7dREhKVuvmAWASDChTMm7dlChV8yAjM4AZMROTnm7K2pDZ1fNjc4AzMyNTnyAw==&pd=2323Um2l2k1oDXvlUmNJ i==&campaignId=9jn0AzMwNZCdAZMq

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_openofficesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.