home

icreinstall_super_mario_bros.exe

Internet software

Dove Max (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_super_mario_bros.exe, “Internet software Setup ” by Dove Max (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Program Web   (signed by Dove Max (Fried Cookie Ltd.))

Product:
Internet software

Description:
Internet software Setup

Version:
5.3.2.4

MD5:
204fbdd06d42fc2e5284c2a849116859

SHA-1:
9fb009f58c94c9777057e22e6fd338f71d94a9fe

SHA-256:
f449942e0979f7c11868700c97b2c29016419d3716ef779065ae07d01d7a1fde

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 5:43:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.14.6

File size:
905 KB (926,680 bytes)

Product version:
1.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_super_mario_bros.exe

Digital Signature
Signed by:
Dove Max (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:03:00 PM

Valid to:
7/24/2016 8:57:26 PM

Subject:
CN=Dove Max (Fried Cookie Ltd.), O=Dove Max (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121CE9583D2CC8D85A6A453411F33888A7F

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:B3A0dUDFt+06XHa37xSAYwg5XsRmhc3N/cIyEBDgRyUD:B3NdUht+06XaF50zq/xBcD

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9293

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_super_mario_bros.exe has been seen being distributed by the following 15 URLs.

http://www.centralsignchuckle.com/c?x=erkXb1HV231a4GE9ZL3vrvA2d ARphuP6 FTeKHLRWg=&c=zkUDyddyoKT2ogrwbNnpj359CoYBEq7f0c33vgzjy1S2UY483Sp ruhY8UAeI7xO3/R6uzTxFcMvh2v2bqgJtbeQ1OoAx1m/Ck6rwkvNMyjZirmch7DPeDC18YURMvCCj5OqH8bmGJzuT7WqYPbeuRxTnzn Fg smMHEvluGP0A=&e=0&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.dlcycleflash.com/WVl6OTRQVVZ5VWtvNVNtczJNVEZqVlVZMVZUSktkblI2U2pCWlUyWXplbEowTjFoalRVaFVjSEkyWTNCRFpuY2xNMFFtWXoxMUpUSkNVbkZGVTAxelp6Tk1WSFJGT0dzNWJuWkRjSEZvVkd4bVQzWkxlSFkwVkVaalprZFBjREZoTTJaRk1teHVPRVUzUlVsalVXWTVhMDVTUlhSd09UVlZXRVJhWTFrMlJ6QmxZemszV0dGU01XaHBOMFVsTWtZMGJraFNjRmhvZVRCRVprYzBWMHRVT1NVeVFtTXdhRlpaVUdwRmIwMXlKVEpDUTB4aE5tMHpTVzVQVmpOaEptUnZkMjVzYjJGa1FYTTljM1Z3WlhKZmJXRnlhVzlmWW5KdmN5NWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1puWVcxbFptRmljbWx4ZFdVdVkyOXRKVEpHWkd3bE1rWnVaWE1sTWtaemRYQmxjbDl0WVhKcGIxOWljbTl6TG1WNFpRPT0=

http://www.factoryapplicationsconecpt.com/c?x=1r1/pt Fess72LRvANP9wcIalWrcB arqxMANQuVr2k=&c=7ru2MoXV3PhNrfCABKH9tgKCHJuTcD47fE0OD3P8A4ScCMdusctzOCdH MSPe5jMIR9RvmA bzBUOzGFMAjkWv05ZcP yWnD0fLPzK y4iw3JN33Gw3R8Bt8FiGokeSeKRkkMX/F 93gHXqClTJM9qg1g7cL6dxTADRrwijKOCsiOtzUhjF6IxRlrmfVZstn&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.repositorytodaypackage.com/WVl6OTRQVWhKZUdGb1pGTkdkbmhLVkdoVmQwRm1ZVkZLYTBwMFkybGFSVFJ4WkZkdWRtTlBlbmxTUkZGRlVtY2xNMFFtWXoxb2FYWkxVa3RUVEVaMU1tUnVTWGgwUjJkMWJtNVdZMGN5WTI1SGJWRTVibXN3WjBJbE1rSlViU1V5UmpWblVIVjBOalVsTWtaS2FHcG9PSEprT1hGVVVIZG1WRzFzZFRsaVpESnZWVVJUWTNkQk9IaElVa3B4VFZseWJuWTNUMk5uWWt0TFp6TnlXalYxZDNNM1lsaEVaalJMVFhBelFYcHhVM28zYjNWeFdHWjVWR0pZU2laa2IzZHViRzloWkVGelBYTjFjR1Z5WDIxaGNtbHZYMkp5YjNNdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdaMkZ0WldaaFluSnBjWFZsTG1OdmJTVXlSbVJzSlRKR2JtVnpKVEpHYzNWd1pYSmZiV0Z5YVc5ZlluSnZjeTVsZUdVPQ==

http://www.dlcycleflash.com/WVl6OTRQVEE0UmtWQ1pqaGxVbE00UnpONWF6Tm5WVVJ0YkhNNVpVczRjalpWZDI0d1dVOTRhVUpxVXpCdlpFa2xNMFFtWXoxWFZsVlRPRnA1ZDFBd01tRk5SbU5STlVSa01GWllNRTl3ZW1oNVYwNTVjR042WWxCcFNEWlRNSFpIYmxjbE1rWk9Rak54TlhwbFdEQkpOM0UxTW5adlEzTnBUVEZHV1ZaRVowWm5OakZ2UW1GTGVrZEplWGh4ZDFGVFpUSmFTRGhUWWpneFMwOW5iR3BVZVNVeVJreDVhV05vTUdGMk1HcDJTWEIzVkdGbVkzQkNkQ1V5UWlaa2IzZHViRzloWkVGelBYTjFjR1Z5WDIxaGNtbHZYMkp5YjNNdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdaMkZ0WldaaFluSnBjWFZsTG1OdmJTVXlSbVJzSlRKR2JtVnpKVEpHYzNWd1pYSmZiV0Z5YVc5ZlluSnZjeTVsZUdVPQ==

http://www.centralsignchuckle.com/c?x= ZmJ/ONvmoeibHhvhYTcNeTVAy60kgUS7mG jXzABzk=&c=JnugV2JMsUFT9kKUwPEmwpi0GO2fUsBYn/xmNRCs95PPIiygzmDsx103tQFAD93EbwQVXDRVH0L2Olz9tWgNPHRYBstxzsx4IOKJ1MfNc4JMqhemiPmofxgZJ4ihCzr6QEUP D3ed/Pp9IcSF25n/czRwaHsj012Z2tQc1R59Xo=&e=0&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.bundlescleancapital.com/c?x=VVmO1vk XdxEIYMj2dcJPGkJyYSX6IbfB4CtRngYHPs=&c=uqyLJMCSK2hcfJVFLm7HGWKg64reQo6nuJnPjuzmupej91BmxI706PYQ fF3BC450d0Vtc46BG40Cmvp8nAhD8QTQYaJ1SyyMpaRk3oDJwzklQqgH6pF9LuDEEgTOXjm8VX2KFD84h0/3SzG16yeoBnOofhXNg9wNfxxfF5 3kwSnKj3sQVUlssmB7jMih2b&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.filesbundleshare.com/c?x=s/9nKLdNK6tRSxaIljRQTPAJE/po6FhX LeGtxiXW U=&c=qu/1 xK1jYjj9J6zMGwx1pbV8SZLyp/rOfabVmL91atfYlSX1fnZ0bPZY69u7tGvOQKOBtxnmDtselwEZfG4MWeLHpLNvSWduSecCJ5wqYiKjAuuBnBPg3T Hi8zxiJW0JV9mO1N3LTwQsDSX tKlfte8n9PJ3ILRk9QVafUoV/cC4GwVI OUjdGNMKVuRP2&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.dlquicknew.com/c?x=PPr ZhAKBBat4tt6qFoL7eEswJTBcGX3QLUIsq9nXgQ=&c=VudxoKAerEgVnJI6WQDTzce7nOqBmT8 rLJOspMHG/Wg85hih8qwKncy3nuAOSnPgvoPLhCzTDYSB9rKKrYeA9rKIzbuQcvtu9903bT0AF5O1rjSd7jrrtWixuTyvxJ2mAI/4XRWQcAzS0R0f4HSVGW4cDHMAUp4eHU57gJIaVrI6qVlqOFHiash0hyYK6pb&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.softwaresendchuckle.com/c?x=GoSjOhcZYEh1ok9pJ1hN3dZ2k6wuzoDQKe6IuVQb694=&c=/nQJ/3nDSOAE0Or7MHMnrjgVQdO2Ac43Dd9yt9ZwJU4BzCGf9Uos1pB/yks28zR7Pn7Zq AvN E/ 4kjgLu9TYT02rmDhZ007auOernhX2mqhqFyYgoEcb7yfQXIU4Z2tyCM7 59TtOb9VFt28jG/VJLsWKYA0vUTPxk6Za NhA=&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.megadownloadmega.com/c?x=A/KqIpi/rxWPQuy1eS/QWjB2zs/rYe2flxNahpJjfHI=&c=IeMN7BKSY9RspWZ88PvmQL7pxtUwSo9LxjPi9f/PJqoRn htk9GuK TjC1jhhRsqAOmjedL/xaKfUvuuJ0TnJRldGeE g6kC2BovLx7WPcbk6Zic7Kg5WD vJvG347OKyKaMejQ9F3yEhwCXeaZBm9zzXLzg AlfjjJ5OQLDVx4=&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe;

http://www.tagsoftwarebest.com/c?x=ujqmE8iidwnLGrEvuubeuGhbw3KPblTTjPxM7wFQLFU=&c=CVSkCh2LQd06lQFfsH9SM8Bm1g/knKlRcQLCxFkqtiuFIyx9IrgbgW6DXBQLBEzF/KqZJTqYDKLHhd4K6jAuuvWwwLcVmm7bPPSYyHrHbDSQYJg6ypHjgXfAnEa9mZOSPhgSrh37Z6fk9lyC4qKQKq NZdLvDord/BOnNHNBvAE=&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.cleanheartnew.com/c?x=k7snYKnAgIRB9jamJa/jFXf5DfIDP8i9b7cVVlevDZY=&c=oZNQutnk84aaowCI5t9lSvVqNaeFsbSQ9ZG5vf3ui4O1kcWwLEdl7gDARQDQ/ygJKYKExkZzWxhi XtGNabQASEqcaH3YPAf43N7E4ahg1tOdA6A1Zw53DZDEI05Fcnw3ySY3uoFHuHOy8z1 UPVqw==&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.cleanheartnew.com/c?x=Qroq7AWO55KxPUPcjOb6/H1UFmWElqlX6TXTiczMJ8M=&c=Mhd6vsBIECuGFIMvoo8Ukr5HpgREaxOatCEwFgRbQwFzdS8y0eQdwH6PDUVVBwnHXH2fi4GkloACgz4zE43ZutpZwYV6SsYeQWQkx/czrCKcOXTQliYVzpMiDbhwWR bYSuYO/gE7MVgXd6M/CBuBw==&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

http://www.presentbestsafe.com/c?x=BjDEFqaOizRTh2YHWx0rvzjAyjr2EC1DI9Xii1VRXeM=&c=Bzt4ppyYGrzOUZC7o i8Ppie0TcxvZ78qFH0ZVSMLK9i7fM7baQCyfQmGXRH6mozO//egbt6p6PZ41CZZp7ugJ IR5cFnj/GQOTxU lEKeebmn0yFiWxmaFavkAcFr0ZTuvLk2DYX8Y6C7sGB2yObA==&downloadAs=super_mario_bros.exe&fallback_url=http://gamefabrique.com/dl/.../super_mario_bros.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_super_mario_bros.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.