home

icreinstall_snapchat.exe

Mafelobes

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_snapchat.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.hostingflashmeta.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Bemadetuso   (signed by MICROMAX STUDIO, S.L.)

Product:
Mafelobes

Description:
Mafelobes Setup

Version:
4.1.5.1

MD5:
7223af297fdd3885df119d5522ef52e9

SHA-1:
ad1ea57f2206a9f2c0ce18df59b63cb5c9194cc5

SHA-256:
2f476ecef7858625c6a4ca33e7e3871fc4bdcaa9d7603b6c73159c82c1f508d6

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 6:00:25 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.4.25.2

File size:
942.9 KB (965,552 bytes)

Product version:
2.7

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_snapchat.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:DW2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:DzJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_snapchat.exe has been seen being distributed by the following 6 URLs.

http://www.hostingflashmeta.com/c?x=ukNTDRGaMthtrhhEJGdVVzbd/DodbOkYmM3W3yJtLwQ=&c=dHRiRfaSjZzM1dzLvg2KHo NTWhitcVmBocqNQoA7L4VQlxUIRPRvFdhup l zXpqxNV0Wlfks7zlmo9Op4eF1L4kmHMX bGirHKz/IuOiMDa4YYl1V8nAiqeLoZpe1CrGPrgFMtdy0l7CFfuIrSm8pRM2GUlWM8IG82BbV7LMA=&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe

http://www.heartlaboratorydownload.com/c?x=zDBeeXVDbMwH pZ/iJ2CXgtJ8qrqQLR6 3oVwoBltec=&c=K3MHKW9ZDgukM N 9XZvQ4/AuRZtK0o7PiwWN5 udZvj1cxRxhqcyr7AaOfDFZzEHKWQgfa4LEIp62/d5kcsfZyjxEOKhjKRTOxAMX/6Ca11eKj1ofE8VMaEo1w4NtcgZQdQUmEgB1P6kvoW27YYGj0QxSTasVKJ2rmAZgzDY0=&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe

http://www.appfarmpackage.com/c?x=wVeEjYz0JmBMxjuhqAZW/DMOskNSXL3KPKj Itel Ls=&c=v0RCcfUIwqm7ypxfko XSGtyDw2dMBYeleo8Jcqikg5plywfd912ggPNpJA8iZ4SZ8R6xrlT4eaNej7Nb4Nu1 6NG/5oI8FIbJ U tqOPFiR/Zypp7RgpCzCgTNCtlFv/UfgYEvusuTknr9r5cC4UcLI4KJzkBUajUHfOAKX U0=&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe

http://www.townchuckletours.com/c?x=57dwIjy0TjQsEC0xMXSfNAvBRMOhmbXvea0rE0vHW50=&c=Xl2YmKDylUyTs3HV7Tg /eXy46rGoHqchhFqhpMbojP2OR/IWziKy0YEf4qaK4LRrtk YIcqZqj70SP3fRrXjaQ7y2QZ5bjjYgHv2YtR4BdFAnyV7/7re YXB4pT3wB/tW1cCluUKasSbTWj8x8W/dTmAEoDYi HBvEnu/QaQOpESUtXGZlfJ38BonaGGlbI&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe

http://www.grabtourpackage.com/c?x=/sK2k9KHOgYqBFSNgP6aY9RfKlJ7MrFyBrbMbAhCGP4=&c=BqtBVj9DgJ2yFZnXeGRqFDENAgA/87PwQi QbRqnDFHH1QqO5RS/D3QsI6O3icGmBy1MqcpdabnCLO1dcYiwt9eilpsiqVSNzU/6vg86/ 69kZo/hSTLcGSlNwH7J4tGiuxtvvgV3DFsp C/GL8/lchJL9RQRxhIM1ifKft6b1M=&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe

http://www.nowtagheart.com/c?x=kL2MSc5VUDiqEZt689ZsUVdjig/1MfCe05LFT9mcuQ0=&c=ej1AwLT0UyLrjyOlqfZARHGFtWWxsgXr a5OxtROBCa3YfXE0U8XuNkmMTvMcCHS gHM6meFCxEwvT4rREZv18NvfTqqYxnGUdjUbv2REcbKXvveres Q3asxra3N2uakeUt9Q80S60enCZv1h0U27iv3VIqmZ5c1OzIgUFPmpU=&e=1&fallback_url=http://res.mshist.com/.../Snapchat.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_snapchat.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.