home

icreinstall_setup.exe

Internet

AVSoftware Ltd

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_setup.exe, “Internet Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
AVSoftware Ltd  (signed and verified)

Product:
Internet

Description:
Internet Setup

Version:
1.2.2.1

MD5:
f0a3dcd5e5cc4fecefc21d7b15034bf2

SHA-1:
be26e9e4d39d51c08dbd69c298397b0c25b1b00b

SHA-256:
e86a194fc14cb3a4adb146005d1c87e427f3b4b1eb5b841fd89400c05889eed6

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/24/2024 2:44:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftware.Installer (M)
16.1.31.19

File size:
934.8 KB (957,256 bytes)

Product version:
4.8.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:55:52 PM

Valid to:
12/31/2016 12:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cW7lqWsXE3hsBbBfh+xnec+1E6NrF8GxT0oTah+ETy:cqsbE3cBfck1gEQoTWTy

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_setup.exe has been seen being distributed by the following 29 URLs.

http://www.funranchconcepts.com/c?x=SamyI1N5XpTpUdFXbd1NbL3zjgVddy9m7hAwyWeTdFQ=&c=WwZ5QiRiNlxviMPpAm73UZATNiiYxF GO/59IbKKQkf3GtDu9ArzJ1qYuhCY SjbEuk6UXnRi1tqQm4Qm/1ETeSwR8QCWiPoUVcKpute7XkwBvQJeXRaHWvASN7vT2QD&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=T3xxpsMujGMpdywWemSs3eOwCn36dWXAxhgOWkYdemg=&c=T/4sXBPlnlWyMlDzaT4I6hHk QZcFGizcU3v2tF1WsJUXR37B7IH c0cxb1YMs1vBUrns/Gk6 XrL0GMxk2FXwAJcdPSiMq L7QAfWjiITWcKmPozrRLhzi5ep8fgXAX&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=mIqy68edusUUdmUB9rGUcHJkQUvOaQ eUsqr3ou7PO8=&c=qckNRcJsGrBGw9vQx7GD 8XvTLALA6KM4LBTpX2IOgm3uI Shh6bKEGMTAhGYc0cOr/5cMtp0Dc1VBcYF989K1eP/3hbIRH1gm2AapR7tDlz4Qdr8p2d9wrzTyNw4qRr&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=elPjhyAQBpO3YdxyvL x S6U8oPO2TuKEF1dYT4UkgM=&c=UEcjhSoKXshXdGE16YOB/sYX8wXl6VTG9qSthji95urCLD3aJpzdX1n5I6LmDFx6vugZTRNdAyxKZP1/tBm8tnDBi/ vhFvuI QuMaZBFN0kcsaR/6MP4OwDvUONkMsj&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.megatoursranch.com/c?x=uKNcXp9uexphtCpRNAUOlHwIfT3AmCYrbS /PGX2hFw=&c=Cn0O0EBr0QVlsG3/N08wADKQfdHyLF2v8VjF UlVaGyCax8hyfZ0QMrWQZEEBeZUIgUa7NyQwLSQ9A5WYNfc1/SmhO8i9SE1SLFFlzI009lGJ8 4BbEHZrqr6Amc9wh/&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=lsSr6EdxHIg7Bm2Kulz0j6S8aluzKAhsre dlJy2Yr0=&c=5kz5LFL2Jzb2WrFnkVi7W3XWOk/WkSz3g8bYqYFkGkzGl5ukk33gT 4mi FddmDNVqRUuGbQr2 IpjznraA4VnaxtPMcGusqQAd60 cJve8iEqCNjyqOnSE2lxcNxF05&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=lDdjhkduWV9BBlSO/UYSUzn6a9KJNKa4krF3nejW5qo=&c=nI137rIUYAK020orSJB/YhNvt636reKjkk3G571pJ77xBAl4HSVEBid2ovj 7TSefKJ6pl/GPS/Nu2vSNOD5ojywAr4LNnv3k2o0GQ2PeKkRw6SKdhgKQP4sMRb8H3Xy&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=gnGip6PtMXEIhIpPwK4E1XtemkpBO/TyQFuatfPWjlw=&c=/ TvYXkKAWV /GexYRWY6NUFmIdJqSaYhiyvQ4PQZZw94LDEcElnjotZYrD7ePXI9cZbS4R3AljbDuX5fxRcLf7GI/AOHNYWJvVmKJUguNMyXV7Y/iE7pW8mZLcbzhd3&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.towernowworld.com/c?x=sa0oF0aCdWWlJgWPjapcDHaIPLK1WeUS5kf7GbKr pk=&c=mEyp7A2KqvjT/ShiKh8GnUAJ57tu0peXjX8glZJU5V4NaY pBluSkJB9QMlUH3Mnr1TEPr8aHh2JrRAVfGA3XI5ltSUaBXI5m8nLkVvESrhu2pquSn4UmFNRyJZIGlR2&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=UXhdstNY3J4fjFxEHw/ex9h5omtyhYg8tTV1Aw37gpY=&c=JQk8kYzye3g e5d43T2pRMSMtA/FFHeOJ4l00Alur7IYs7kyJ0fPhvph5kVO/e04fOR3gPvpM35U1VkepO5eWsVHoXES2LpTDLToSfGf0JQPULog7bkbIgQE5cu3pr5&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.megatoursranch.com/c?x=xg bKmSOxCrIAOX/aU9w03EPBWh3de5Mwl8WY3RrM5k=&c=/eFRemgYEYpO2iBC6Ebn/dYBPZllwQkFsco6CwZOBDDIf2aMNuwG5vtgTrpRDtklBI3acbj r7M5fvi5nPtLcq3tHNO5jFUKhSDGh/YNGsEng2ewNL8arYDyRfg1a1q1&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=mM3OWXEjvFCuxhBUrmKfNBx15ZdAa2XmfClfq/8G8/c=&c=98XsS/Yk3DkiJ3xnr567072kAjQ4ORmeMHyFBEHwq5xr7xWX4UByzhb1l Cw6zG30AYevd1d/zr6bx60XF56bTW0dKOlXx6f9U597CjKF1lr/0/KpmuGL42Htw5ZoUU2&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=f/NBtlLwhUfYtSp5sKNRJrqBOBswe7ANVLq/RFqvzG4=&c=NSuUB1f36Yg4/pAgwSO5bLfqMsAZtMe5YTAemdcMYFQOS5gBxw00BgJXxp2p37ujCcLUbBcm5rlcdlvG4rjnPX nL3ls6it2xwptGCQvrMNLSLGi vokZ5LOQUqaE9rj&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=Sri1k8zSLBWaolIzWJbsXdj4S z42xvwjjmmS0p5r1I=&c=HGJnjMn CrC/Bi4ZjCTcBT1pSE14j2Wn5zfhD9FDWGA TQMT0LdsGfdrc2nh9QEpphq0lKGD6GD5ofeXiuyrOoom dlyKXHm HGn49QpzJdCpIjcsFvwBswAFfN3F/Ax&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=yKco9noyYUM2jp9hPalQUnH/PzQG1D123cYtfBNyoE4=&c=wcb1T IoKnumHIqoYe4FJEBy u6QI1XEuK0H1w8Clk3l5Obo7UwKGr50kNUUWs5RufupMSqhQSoiG1J/gpuyJQvU2Sn TYkvY3zKS98 MkPWmkCCVlpR8M5lidgiO35B&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=hzOK7hE6E61B8FTwCVVebeZUFjlZVL8VREkG9T 0zo=&c=4IzXEPuzQg8IqXvTgwx8UCc4nO65pnRDOpeBIK84I2Ei49Cwk4wsdLakp9SIjAHYbkbKf0Jw9eqVWKLqG4QTDWUJl7co2H5eeLSX6rb0a2 zS5eYkQSbvyF1pWtJei74&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=NIraZ78zMl/TgIIYDRTd9zUTPN3F9M4KjrBYzyCgizs=&c=XokLWfcpwxhWT4jKq9KAKS1k6YnNEh9PONG7s/3XsGdKBdja5aPLTiQdOEgRjATMQT2WIf9e064bkKShOxE7MV82uFGSJ ok/qyJ5vrfahyQYHiIUaGJ9CEPDFoaE0QK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=o c x8Z4adFiDu6vi7mk4IDUsvwmbOxcK xAEmSTPkk=&c=Odu6P9ktSjQX3sG0g6SeVU7YpRjSPdN0aKwQIdQMcmh0KDS/1jsaKgNFkrB8dkrF821I/A1WB6J MX1hv/Oc0vWLi205Q97ERootmg/iOLZ QMP8059E54UG9aVlx4vX&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.megatoursranch.com/c?x=vKbyTbZuZGNS3MjoBr2cM/a8zbVBC8xFFblCYoA0BKk=&c=xOs315XAQLi3TiG/P2txA7Nv8Qb 2RxLjrL4KGORMKgGpkQHcpOUbOxUycqfQ1USRvnVNt5CjONea8aG3ztc4kEynnFc1du0XWxytfnx f5brZ/wdSCn4bmyKIMtAu8a&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=L17MQw3RIdvgB4WJ38gEsAhugByM4pJ6DjLN7sMjplU=&c=hqU4YYnGoQyMpixQURf9Rn3HAv6cgjOBKBatUk zNUcWX3g8RFg02cMQ0jH4vOW9b/UzNMeeOyaZLQrt6SMz32SkWOujVQUpOHNmfrHozmoM6Lcvo9o5fAwgDzgJXiN4&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=g1IWFulujMHPiC1lOEGMyVVtDN4aT3jlwBrQfCichBI=&c=yq0dbKideAumjDt3I6kaI88LeZJhPc/bpEmCrSHtcLLPJgJX3wWe0g0EcdgGxC yXQwgfWpCeK0MeoQaq8nBL CPZZ2lkoOCZ5nsQfOLhV7pf8dQdWAF9XN3/r151HIE&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.megatoursranch.com/c?x=Uy6 pTQCPOkPbyS4o7NCD rNAyMCFjdVJoJEzrw0wjo=&c=uS4IcQpWFRNWFZltGAg5zxASMrwAwiA7Jc2Yz88afxnWWZ6w Ln/q7z/ihky3hXj0HvPdDyYRsVfeB8eOStk0UT9J5WFMZUzVxeW JQl9c45mrRdSHVXkNBCNUt5vJKM&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=Z388qhPHXJRjXF5lT4eolwG6h9Ac7RcwEKT479yMwHk=&c=OktlveJG52xKLA/Msbz38kUbjmxTb4ziIfW1RGIECIk9DEtRNK4jhe3Odb4FjEHHej7rzY4HOnazBRVv wDL9E 4//lBS/G1JflU fFBUapApuyyIzF9Y9aCO6mmj0RO&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=KWG3VPE TcttyeAixHU91nFiMyCJhE3BifYCj4yG/98=&c=cvQ5VLRPi9jIY w5Z6/fMLiOKOowcDOIBLq7uRcu9/McYpzK U2XZEo0vixPffb6Ln3GAh0axatR7MQU7grvfeJoPS36qL6nU1bQbUxr7HIsdkMQnR/zQVGFYY/Muf4c&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.megatoursranch.com/c?x=Au ArKiy ZlTS6PWu21tj2rapX2bC2TrwUlsmlKrPys=&c=E4cNR6nbvvYCCnMyVOgGUUIpUIj2P37pjy47JtO99WrWUO0s7FbnGwiIi7cdsjtQc5B0lV/nh06tC0PZw5y7Jg4ftzFJLyTh3U7hvuKUdyN1IpE43x zYDBfCy2FRMXT&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=8LhDSVE6zWEE3Idp9XTQ87UaVuTJpEN7Ub5WmrvOjb4=&c=IZuktig1wRKjIeR0rLJNMhK udvAwwI59n3GEsUuf3DE1xVpSCQgKzytp 9F/ZklAdvBMMsPso//WaPzmtKcv9PRtzPzzvAo4JYTct4EiOxd2iW8dK5w5Z8vUsKSGjfR&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.megatoursranch.com/c?x=pIFODSkIouORkH3Hhopbs9LL0xp2qCBbY9YKuH9qArA=&c=UK6Axv3paT6EoYtXJHXF7XLZdfZaBdg7IMmC6ZBFGxkTnZoubyI85AxRTeWBbV7mhNKiShA10IKQnPf6WCqDgM7tiwKccSlP0efM23tlnmSjBT6I9IQljwLMLQ43xWan&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=s3TxtndSM7nk6/BDPrqVCXWYkL985jJEEc0VAqbD5 s=&c=rVc5Z0doNtpGqTJMJjtZnA4Qs2LqApYAQBsc BpkpwtRanc9XuhORNeII8dAtp5fDyyfedBU H3nDLRaUZHXr3lQ3iyeBwOGJayF86pdwBqvWXev1N 5mRQpVf9JGlJK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=d9CnoDPgP3R7H/ouy8wBhj8ObaoO76yXn50jsJ4s4TE=&c=TuL51jCEVJfqxsir9uVtRijSLRNE29spAob4ReOAMUf8vZP3ZJELN8JO 57H2nzF3FneZmRionhOljxdXYPB yQOjqEx8PG6e/e59OWoqDv8ZtmxpfDBRZ64Nn UmIvM&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.