home

icreinstall_skype-13018-dp.exe

Pofecas

Funnel Quality (Alpha Criteria Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_skype-13018-dp.exe, “Pofecas Setup ” by Funnel Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Funnel Quality (Alpha Criteria Ltd.)  (signed and verified)

Product:
Pofecas

Description:
Pofecas Setup

MD5:
d01321a3923ac16e7907cd44f3fb7600

SHA-1:
8cebd184c62072380c413dd967bfafe7a215ca20

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/27/2024 6:16:42 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.6.26.16

File size:
958.4 KB (981,392 bytes)

Product version:
5.2

Copyright:
Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\Documents and Settings\{user}\Local settings\temp\icreinstall_skype-13018-dp.exe

Digital Signature
Signed by:
Funnel Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/7/2016 10:35:36 AM

Valid to:
8/3/2016 3:44:04 PM

Subject:
CN=Funnel Quality (Alpha Criteria Ltd.), O=Funnel Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E6C9E138C2956FEB458B5B444F447890

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:LO7llHcZYwySG9c+bYoLXOM2x9zEtDe2laiC6HnNbvDDyp7D:LOZVcZ2SGWEeM2v8C24yHndDDyB

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file icreinstall_skype-13018-dp.exe has been seen being distributed by the following 9 URLs.

http://www.bundlesbitsbulk.com/WVl6OTRQVzVoVDNSWGNsWjJVbmRFVG1vd05UaFdZbXhWVkdocGVHVmpaMVJPUm1kR1JGaHZKVEpDVkV4YVJHa3lNQ1V6UkNaalBYZzBiazExYVZSMFYxSktkVVp4UldnMVRTVXlRbUo1SlRKR1QzZDFSRmRUTjBjeFNXc3hXRVJuVFhwbmFHOXRTMGxOU20xSE4zbGphMGhoUkU1RGMxVlRUa1JzTm5GQmVtTmlUMWxHTTIxQ1VWbE9UelpETlhkcmNrTTFiMWhETTFkcFRUSnZXRWw2WldWdWJqSm5ZV1JGTmxwM1JGaHlaMWR4YjJKelJrWnVibmhYYkhaalZGY3pOREpzUTNGa1VVUjRTbUZzY1VOdWRtY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6WVNVeVppVXlabVJ2ZDI1c2IyRmtMbk5yZVhCbExtTnZiU1V5WmpGbU5HRTRNR000T1RVeE9ESmhOVEl6T0dNNVltVXhPR1F5TWpNM09XWXlKVEptVTJ0NWNHVlRaWFIxY0VaMWJHd3VaWGhsSm1SdmQyNXNiMkZrUVhNOVUydDVjR1V0TVRNd01UZ3RaSEF1WlhobA==

http://www.signfunpackage.com/WVl6OTRQVVJPTmtrbE1rSWxNa0phYVdOaVVUVTVTbFE0TVd0RmRIaFNXa2RQWVVsVWIzZDBkbFZFWmlVeVFtSlVaVVZCV1hjbE0wUW1ZejFNV2pCTmVGUm5aRUYyT1ZkaVZURjJRazF6V0c0NVpsWXpOalZDSlRKQ0pUSkdWM0EzYkd0T1dscFNRMEk1Vm1SalVGWnBSQ1V5UWlVeVFqSlFTMWR2YlZkdWRqTnBiSGMxV1RGQmNsTTJaa1pzVTNkNldsWlhhbFVsTWtKcVlVcFVPSFZKUmpGd1J6QkxTekV4VUhWT01WVlhiV3R5ZDJ4RVNWRm1lR1JTWlVoakpUSkdNREpSTVhNbE1rWnRURk5OV1dkcFlqSTVTVFpSVTFoM2RubFJKVEpDVG1GUkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNITWxNMkVsTW1ZbE1tWmtiM2R1Ykc5aFpDNXphM2x3WlM1amIyMGxNbVl4WmpSaE9EQmpPRGsxTVRneVlUVXlNemhqT1dKbE1UaGtNakl6TnpsbU1pVXlabE5yZVhCbFUyVjBkWEJHZFd4c0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZOcmVYQmxMVEV6TURFNExXUndMbVY0WlE9PQ==

http://www.signfunpackage.com/WVl6OTRQVVJPY0hsa01GZFdhakpYUWtZMFJHeFRSMFZUTUhnbE1rSjFZbXRyUjBFME0wRjNObU13YVZsaUpUSkdORzlWSlRORUptTTljVXBpYVc5alZHZzNRMjRsTWtKTFFWbGljMkp6VGxaYWRXMXhaazVhVGtGRVN6SnBOM051V0dWR1dGZEhRbmh1ZENVeVJsRmtaVk00VjFsMGIzZEVTVUp0VkdGb2RHb2xNa0o0UmpKWE5teDBWeVV5Um1GS1YzSnlhR3QwY0V3bE1rSlNabTFYZHpoaVRubHdOSEJ2TmxRM09HcEVWemRCYzNCRGNFNU1NWFJPUVdkbFpFeEdNRkpsZGxacFdVaE5OV1FsTWtaNFZIaHFSWE5XTWxCcFdFbEJKVE5FSlRORUptVTlNQ1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTJFbE1tWWxNbVprYjNkdWJHOWhaQzV6YTNsd1pTNWpiMjBsTW1ZeFpqUmhPREJqT0RrMU1UZ3lZVFV5TXpoak9XSmxNVGhrTWpJek56bG1NaVV5WmxOcmVYQmxVMlYwZFhCR2RXeHNMbVY0WlNaa2IzZHViRzloWkVGelBWTnJlWEJsTFRFek1ERTRMV1J3TG1WNFpRPT0=

http://www.headbundletown.com/WVl6OTRQVFI1WWtjMVRHRjZUa0pwYWxsTWJXTmtNbTlyTlZkVmJUZEhXalVsTWtaTkpUSkNOV0pWVlhnMVdGcGplbTB3SlRORUptTTlZakptU1VVeFYwNUZUa2d3YkZadlRWQjZVVWRFZVUxWWVtOWpja1JWUTNKUFJtb3hiak1sTWtKdk55VXlRazFFU2xSalREVnBjbXhOUTBWWmVFeG9iM1ZuT1VWdVIwTkdiRFZVWWs1bFN6ZFJNa2xMWjFrMWIxcFFZamtsTWtJNVZqbDNKVEpDUkNVeVFraExjMU52YkhaQmNrNTRjVmRoYjBwTkpUSkNWR2xsVlZFMmFrcGFjalZRT0RkT1RsYzNOMHN6TVZWUFZTVXlSbG8xZVhFeFNuTWxNa0psUVNVelJDVXpSQ1psUFRBbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTmhKVEptSlRKbVpHOTNibXh2WVdRdWMydDVjR1V1WTI5dEpUSm1NV1kwWVRnd1l6ZzVOVEU0TW1FMU1qTTRZemxpWlRFNFpESXlNemM1WmpJbE1tWlRhM2x3WlZObGRIVndSblZzYkM1bGVHVW1aRzkzYm14dllXUkJjejFUYTNsd1pTMHhNekF4T0Mxa2NDNWxlR1U9

http://www.headbundletown.com/WVl6OTRQVlpFZDFkaVUyWjJObFZxVkVsQk5uUTNObTVUVEhkUGRGQlRUMjAyVlUxeVN6WjVSRUo1YzA5Mk1ra2xNMFFtWXoxYVoyeHdPV05yUVZkQ1FsTmlUMGQ1Y2s1alMySnNKVEpHUTNGaGRVZFdZM1ZtV0RCU2QwaHNURkJ3Y0ZwemRHTlhkQ1V5UW5Ka1JYWjRSRzVsUTNKcmFHWTNObVpDYTBKMFkyZDNSRXhrVTI1WVFUTnFSVnBWYTNGeE1HVjZkMmxHTjNBNVZVSkxiMUYzU0RWUVowdFhaMk5PVjJKRE5HYzNWalJXVUVaeVZsRjFlbGRMU21GVVUwUlRUa1Z6SlRKR1VtWlZVRXh1VVdFbE1rWnRVU1V6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROaEpUSm1KVEptWkc5M2JteHZZV1F1YzJ0NWNHVXVZMjl0SlRKbU1XWTBZVGd3WXpnNU5URTRNbUUxTWpNNFl6bGlaVEU0WkRJeU16YzVaaklsTW1aVGEzbHdaVk5sZEhWd1JuVnNiQzVsZUdVbVpHOTNibXh2WVdSQmN6MVRhM2x3WlMweE16QXhPQzFrY0M1bGVHVT0=

http://www.signfunpackage.com/WVl6OTRQVmc1ZW5FMWRWRlZlV3BzWjIxQk5HUkxSVTUzTkV0YVdWQkpURXRQYUZsclZDVXlRbVZKSlRKQ1NXeFRPSEZySlRORUptTTlkM0k1YUd4NmFYUm9jRkpUWkZoeU9FZDRiMEZUY0ZKNlRVcFhkbmxGWmxsR1RXNTNWbGxKYlc5cVEzTm9iMGd3WjBsM0pUSkNkRGRyT1VoMFRFSmpZMGszZVdkU1VtRm5SQ1V5UmpCMmVGcDJZVXhFUWtwbFRrTjVkamRsUXpScWRqWWxNa1pLVTJsSlpuaHFkbW8yUkd0alFqVm5NMDFPYXpablZWbFJjMjFMT1d3M2J6SXhTMWhMVFRWMlpWWllhR3gwY0hBbE1rSndkMGc0U2tFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpZU1V5WmlVeVptUnZkMjVzYjJGa0xuTnJlWEJsTG1OdmJTVXlaakZtTkdFNE1HTTRPVFV4T0RKaE5USXpPR001WW1VeE9HUXlNak0zT1dZeUpUSm1VMnQ1Y0dWVFpYUjFjRVoxYkd3dVpYaGxKbVJ2ZDI1c2IyRmtRWE05VTJ0NWNHVXRNVE13TVRndFpIQXVaWGhs

http://www.funsignssend.com/WVl6OTRQVk5UVEdOT1FrdHNSVGxTYXlVeVJtTnNXV0pYWkV4aU1FMW1KVEpHYVNVeVFrazFZbTlqZVRRNVZrZG5ZVlJLVVVrbE0wUW1ZejF6VkhCb2FHaG1WRlJoTUVoSGJWVkJjMFZETXlVeVJqZEJNMUptYVNVeVFrOU1aa1JIVmtOd2RHbzRXWFZ6ZWxKWU9WZFBZM0o1WW1Nek4xVkdXREZQV0U5TVMzSjVlRmwxY1ZaNlJHMDRXRTRsTWtZelJYa3dla1YxUm5CS2JWWmhXbXRCUm5SWk5uQTJjemhvY1dwTlRVbFVVR1puUVVKSWVqWjRlR0ZvUlhacmFrRkpaU1V5UWt4SWFYQktURnBhTUhseU1GTlJkVlJzYkRCbmR5VXpSQ1V6UkNabFBUQW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5oSlRKbUpUSm1aRzkzYm14dllXUXVjMnQ1Y0dVdVkyOXRKVEptTVdZMFlUZ3dZemc1TlRFNE1tRTFNak00WXpsaVpURTRaREl5TXpjNVpqSWxNbVpUYTNsd1pWTmxkSFZ3Um5Wc2JDNWxlR1VtWkc5M2JteHZZV1JCY3oxVGEzbHdaUzB4TXpBeE9DMWtjQzVsZUdVPQ==

http://www.funsignssend.com/WVl6OTRQVlZNVGxSeFRUVTJNSGRXTjBzek5qSlFRVTlVTTNrMUpUSkNTVGhZY3pCMWJYbFJRa2xhTUdaMmQydEZkeVV6UkNaalBVTjBkMUl4T0dWdFRtWWxNa1l5UzNOMWJsUTBXWHB0Y0VaMVpHcEVZMU14VUhnbE1rSTBTbXRwVkVaeE1TVXlRbWQwYUVrNVQxSkliWG93UlRsc1JESnhORkFsTWtaa04ybFdhRlJ4WjFOaFdVSkhhSFpWY1ZwQ2NtUkhZbkpXWW5GMlMxWmpNSEYyV2xKd1NGUkhOWFJKZDI1MlVqZGtibmhWTkZKWGFVUnZabHBaVEd4Sk0zTm5Na3RIY21RME1XODBjemROTVVWVFVETklSMjkzSlRORUpUTkVKbVU5TUNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0yRWxNbVlsTW1aa2IzZHViRzloWkM1emEzbHdaUzVqYjIwbE1tWXhaalJoT0RCak9EazFNVGd5WVRVeU16aGpPV0psTVRoa01qSXpOemxtTWlVeVpsTnJlWEJsVTJWMGRYQkdkV3hzTG1WNFpTWmtiM2R1Ykc5aFpFRnpQVk5yZVhCbExURXpNREU0TFdSd0xtVjRaUT09

http://www.bundlesbitsbulk.com/WVl6OTRQVkUzTlVOQ1pVZFFXRm81WVd4aU5IUTFhak14U2tSTmNVOHpTRGQxYjBGeGQzZDRWa2M0Y1hKb1prVWxNMFFtWXoxWE4wMW5TMWhCV25GdE9TVXlSblpKWkZabmRrcHNiWGR5V0dJek0ySnVTRlV4Y2s1cE9GSkRjVUpEY1VzMWNqSkhkMHQwWjJOVFJ6Tm5WSGxQVkVSc2EzbHlRbFkxV1dWRmVYQlpaRlVsTWtacVRYUTRRVXBIUlhSbU5rZ3lTVmhOVFVab2NWbEhaVEpwY0ZSTmFtZEJWa2hFVTNWMmRuSk9hMHMzVEZkVk5qTnhjbEJUYzBSbE5VVjFWMFJtZUZWQ1drTTNkMFpuVFVWUkpUTkVKVE5FSm1VOU1DWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNITWxNMkVsTW1ZbE1tWmtiM2R1Ykc5aFpDNXphM2x3WlM1amIyMGxNbVl4WmpSaE9EQmpPRGsxTVRneVlUVXlNemhqT1dKbE1UaGtNakl6TnpsbU1pVXlabE5yZVhCbFUyVjBkWEJHZFd4c0xtVjRaU1prYjNkdWJHOWhaRUZ6UFZOcmVYQmxMVEV6TURFNExXUndMbVY0WlE9PQ==

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_skype-13018-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.