home

icreinstall_skype.exe

Mafelobes

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_skype.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.hostingflashmeta.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Bemadetuso   (signed by MICROMAX STUDIO, S.L.)

Product:
Mafelobes

Description:
Mafelobes Setup

Version:
4.1.5.1

MD5:
5e44d48a190c6db8a7a6192521e8eda0

SHA-1:
4e5bf18abbc958fb398b406091c585bd0ad6d11f

SHA-256:
4aa443ae659f8720b8d60c5b9641d3ddf1f3f1724b2f9dfcd43c1c34f318314e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/23/2024 2:53:54 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.4.15.13

File size:
942.9 KB (965,552 bytes)

Product version:
2.7

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_skype.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:BW2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:BzJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_skype.exe has been seen being distributed by the following 23 URLs.

http://www.hostingflashmeta.com/c?x=veNuRrFqYR3qpQyM945yQUCgTtjAj6rqJJZM4vlC6EQ=&c=snPDJUvrA7I4fUr7WJExkhbOrpmDuuQ6F/jJRUqTSLruKGlenzDq3REcqNwnQnniFYt4BxXLY9QGdGhcu9SWh HHjtmQSwyD4G6KeDA8QmT8vzgEbMYOENWRGelJnbxQ9N zqxIoaNIagRXsVa5rqgbdL4Opg6jYSPwn9o zmnU=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.hostingflashmeta.com/c?x=U8SL7jKdtIx2HxxNjs8ECW2G3hleTw1gL6pPLMEeS64=&c=XkJSfOn5X7Y7XAhhhCaOrWoI9hqVIF2nMUIsk8NTBx1kaVcAfbtptv1fqJ5Zd uXjGji2DLPHDOHt2a5/Lo6/qxq5PayUhC6T737YRRgeUzBBAlYWbischWd3HkU0Xl8 k1kuWizmrHx9pQSCG3gf9m4aKHkgqtaulyd96cs9nA=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.hostingflashmeta.com/c?x=5Ohjz26FSFfzBnTU1J3Q9mGy4owKi1SbPTsKeSlFcjg=&c=jPs580ud6iP6B9BUSzPAncVa77xWbNdNeworZKMAb/F7wIovPy8XzqradCWbHEN8JDxsdqy SxFq4c8rYvx3i4Hyf9OrNxEVec6foOWYK0yhuIOCR6uW9Ieqv843hD04Ckbt1Vl Bld1NeRbSFvsO SQIIkknHjQcqHypfkQBLw=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.applicationscentertour.com/c?x=R5eQRgpBF1YKbPXmetVuO1 AkisI2in/hafGQIWv7jU=&c=cafp8CHSkZgqEMtQNiQL9mZx2hLEc7MwUiRmUV31jOACKlQAnEmj4VuCfd40AxiO8MxX1v mn19Gi8n0pyLZ1K2EqJvgTCiuLbNqhu 0etYmyXKUEODt1wfVSho32npAGjdEVjiqhe5lEtR V22FRPVjR7iT1f5Dl/mZ7ZJxdWs=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bundledeliverybits.com/c?x=DYFWa6ux5OY3klB47QX k6Z3SRKXEIOFZPB5Z5YchEE=&c=8LhY8lYT2HrVsr1yiPOYroiwQAJLzi 1aI6g9ZIwZc/xTDTGzChhZszzvzlsomTddimEfLdNTCKODvnOepgCL1g0 4h5vg84tFprQsd aziIv3E0aUmHfxwy4Va48zq4I8SXjYHAYC7GHoXNnHY3g4MOUkR4GDbXf75qhvh7Fxc=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.dlpresentapps.com/c?x=XYCHqWEu2cq3HM9WInR9r4i8fqFryGOxLt n5Er2C4s=&c=CgU8gMX8D5Vuz9F2nl plXSWG4nTM61NiTzv666jCyEovklcpMjRIAcW9tS2AEeTY3WOCxHLL04 st1WvCEyM0J5h1FAgKRmtgWc4DSzRTPqqFw4PnR47KqnfmRPh5/Et/rFua wk3Hj9kwJ4HFACEFdUO1VcgS5v6e2Y NGPM=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bundlesignstour.com/c?x=LlvaP/slecK18K3j3R2nCxnsf9usO9RGAMrWC4yVF7w=&c=xT7kKN1pillsZQryiw9IXfTbiT275Pw5kCzoA XjKHQKiMrSiS8FUAkat kogpklRvgw1g0n0CtvnHWyS2EvNvjNfBTAUo18PRoUaWrigpjVQaXuyWL1U5CZTOsNnkhlTqPZzAw02jAGOd5R6PGmY06Y6W1O74hKEXAYgo4C93c=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.clearcyclelaboratory.com/c?x=WzNeAjwOVbKGEoCiq05NbFKxK pmTlYeWW OMKl4dZ4=&c=d uPYtkl4WjhjNtGECm0hOM6HhDtSY8YbsgXNK3UrGbj77O69ft49uz5fAlS4sjLVlQe3lsBw7M5BmT7h/rpokry1 0prYLJrToRhxBtyKWS7ng0G8joqhJc ujiWc4Ue/AvvuwEvuSNRrhfD5vvKGfiY1fciSAPYIz3D8mqd4o=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.guardappsconcepts.com/c?x=7RMvRD66YoRpervGn56iJ0D49gfuL74b12 PVN/AJNk=&c=vrcW8HVxTa3tNTAxp 8JHfYOc2jcZEc0vcVsWGuYXw2mF08SitQmszuYpz68U2SRePWX6KnEUxGea5yicKJ76QpxFu7LvAEo8mvZQSvsd7Xxp/F3WcOzaMB0ZXLRR61xpNi6cmlTXrW0Eg TSLOBJuTp4RQQ0nW3xH/fwUIJyHk=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.guardappsconcepts.com/c?x=w0zMorW6ebdRCQFJfA9aXMIh06JwCNdx5JeDzV8huP4=&c=8wdQZeAwG1WgMN/9GJwqkPpKBDAlkpXZGmUj/ZafcY/wNdfohVLhC8H6riA6ufP6Ijuwcp6rU1EQFj9noZDA7tQuR6DjIa/Fc3gmx5cOixq2CIcuw dVQmrSphkM1WbTLXKYT/gnqWsrL6kZSnBRe5GNHHX1 g6vrUaujdmYQ3Y=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bulkapppresent.com/c?x=tc8mTO5Tpxd2H7CsAO6WwlIPUZAYO6Sd5DpkBcSU9iE=&c=wRQgupuRBkdtJvC5GOb0aOwy2RkiH8QEFyumOfVQpHcl0/0xBr/XvMRbwQhGiR9g7LFSlqEjqsqwdZoYFHfLWjMRimMW/HB7Dem8bqSnPQcy5JLYP01pVTiSscytt7ymYlklBUQ9y3HKen0oAD7RBK6AF3qJYqW9jgSd uTo4gI=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.guardappsconcepts.com/c?x=Naz0zzA6zlH0CxOwnjDgLJ/53wKtsfLGVC1SRAwjoW4=&c=wZK2D7RMOoSYbALTH4fVeHbPXtpHG3eA3jzFqEmevQ3xJujXeQpKnwSuApqnqVSUN25fJ1AVmMzju ASWV sN00pWnaBf1okC0TjMGt3Gm08MfOexWf1C 7oSBTnMolxifZYDvXrYMCgKd9HHzQ6d6SDJXh7WAVx4sdcvIHnImI=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.contentsignssoftware.com/c?x=KPO/EfFOh8FCBer3FP1vZktbREf5pyytytIYCe3zOTY=&c=9nXZVvGEjsQbVbUyc8JsoIYHATDqL bureJWmHBQLeOGA0Dhf9B2xBA3Z y9q0dC8mMyD3ipFW2pIGGHS8B/v8Uu7xmDItpbfv9RkDxEPEX4s9Gtu3IhrtTbwM1L7N0Sm0teO8bZ9WEkjRrdZpLcrPFsQa JLMdncOUE0bPYTDYBfb4eRZecMVb14CCxscwh&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.towerslaboratorybundles.com/c?x=DZrDPxM8Fpw8cydCkRltZES9 RZ4LZVtzHrzkHoT6V4=&c=z WoykzLvgbIR V 7 AARy8aZC5dSZp9TY3pr2eoP2MIrM82QEbpJ3hkb29nw0ID42InhLL8iawlueeHpGtX92AaUqFRr939n/h9XeYLGln9Rl b5X7bemsuw XWc83jFzXtPyqXiP5irIhScD0ctow5QbTv3LDqcU0PfLC0lYM=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bulkapppresent.com/c?x=kVLYlsZANjgaym182NKt7PtNmnX4UUrJCWTQzOaIW M=&c=WCouj9Ca1R4nCUlRHSbCyQhC3dLzt1syJNgvndbintml6dZrYdErKLU/NmEQ43GCd X/ LdLbNzhBB1Py6AMSR5 P28poe12yZot7v6k0jH1EC7sx1Czf/qMkavn5xd3xWorSY2gzK05JBLn5qm3bLpmgUnKa8HLd1OHaGgyYGE=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.appfarmpackage.com/c?x=u1spnN7uWdcAXI9eH2Wzx9WA7PZlu8S9PaLKAis5 Cw=&c=6O4B1dkA2pTUXcSNc5/OBZws8znapT7eIObMTHUmn53uCIhzhUu2UT/hOBtda7N8DkFi6UKbFAvIQY2AtfcDbzqXjJQvE0BuSZlqa2DwFvtagM6QSF fCiLuTCKS4h ti7gvRUwPRBMUrjGMG4TQtulFJulsD4jaGEMz8Nt34Uo=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.hostvaultcycle.com/c?x=Tn3/y8ZMXOI1Y1m0yH9mXUv4v84KLkenhJW5 xISeaw=&c=G5Go7hpwivG8QcYjbuwPia 1Jf9oEgL0SxLD9AHa7iY6 x17 ImopQY8ajg8QcDTpgSMrFz2K4Yzbh5GeFfwrCstcq5yoj sNljrJfOrgDu7dP1yERx6qVWepzyhTBBe3vxGDjkdI o8CP/b6BuFZYKdBmh11rqc8zp9/sZ316k=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bundlessignscurrent.com/c?x=MVeTKs484DyJ2ld4cXVTIm6N31T4GxnEolqhRV/Gdlg=&c=V7 zy9n/ISpR/FX2zYouQlKNl1G78AJV6W1ypOfFtck5EKb8U52OxB4L3mCRY ytJe6DyKW5EJZNbbljKTJlQ9gv9ocftwMtmlVe6FdkpPcCcXVmyvtn9eSvzoKhMYIxCW/b/8qGl/UraYBC0ou 0f0sS88q2aOR22YGljuqaqt6cxqFC8MAffkGl5YegZ/&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.cityclearvault.com/c?x=lbUZbY3cV/J0dhSnciYsNkV9HdKcKTcXptToOUoY8uk=&c=Ncl9y52a AfQxW6HGz1bRROM/HI6B1DGPf7jc/B98OPQ42bq oT6jZvAAw0LIEOK1IxzRO7Ovo85A9s1us aUBvK EHT65KQw8pCblaTcm6dyPB9wmQh9rOK2mVDsYl56X3T2lGKlDCD2K3bwCNwL3VYnjdle9O9Sq/Rkbo8hkH3bPWcmXlRfAKiUJY00Hah&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.quicknowcontent.com/c?x=CCiibCMfJxik1cChhpgRqqyYc2KBAeKrcsqfmauXZRY=&c=6J27ooBwswOJc A1GV1/lM licZu4/xqWCKSSNSO1h9DVo/JOpQco/0aUfPGUZmsc6rtpq627ZpF0XiO6LvcriIL6uVCUgwLNlSFsn19p9 1q PMvF85TmGDsmgUQ6wumvBIFVOjkFib8mM65A4/CFkDB6oFzGMEINsP0r8MEco=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.newheadchuckle.com/c?x=uuQwVP r2qiBiPj0n4purhurUyeK4fvER v0oXms4xU=&c=qYlOcFlEmVTcSGTrh mQNZG/ mmqG3ig5BF9Atcv6GD0msnM wnR BSrKSLiCptDJ9ly1mujbBoQYwWOKRnGeh8a uxVg26HAe1GgIxV69z37Bn1ZKOzvVd79rMHDzKvKyGZBLtVeE3GfBt53lKTznudycShOn1Hw26HYaSNN8uRQfAPBAxavIwo20sAKysc&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bundlessignscurrent.com/c?x=VmIP rtrpHA3QW1 Nfw DFGjpWje/q4LLXtnZxhtQVw=&c=3/1lduaz3SeqDMbujizFihdOlYMEnu5fu5qWzQssw 7vl2Y1Rgloq4UKwFPdmnHkAuO21Zi7Afhb4L6b2KAH3tBxN8ZsYYMFMmlRskkW30R06HxGcJQqD7BAyNFMO/vJy0j50YU2jezY/I4fg/vCM5kKseK0CITBuRQOt9gkigw=&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

http://www.bundlessignscurrent.com/c?x=lbgP7tAR3MT7joppgGcIWgpiLAmdmmKXHVfCm86pn3M=&c=mEvlCIYaT0YU9S6KNet9Rmruh5L/x26sKv3DnYkOxKEPsA7vs0VgCObMkQwHmrx6rq003i4hZ 8/0/StiAv3fpGEYynUcE9eYN0lQh5kA9mabykbnVO7begRdTRKCTMzp9zIiJV4eGK2TOjIR0ETOdu1cmZzpz31HZ3GMRsHv2a6oWfk0fyEgzuF vfaKXz9&e=1&downloadAs=skype.exe&fallback_url=http://res.kchuss.com/.../SkypeSetupFull.msi

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_skype.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.