home

icreinstall_updatechecker.exe

Mafelobes

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_updatechecker.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.hostvaultcycle.com and multiple other hosts. While running, it connects to the Internet address os.solvefile.com on port 80 using the HTTP protocol.
Publisher:
Bemadetuso   (signed by MICROMAX STUDIO, S.L.)

Product:
Mafelobes

Description:
Mafelobes Setup

Version:
4.1.5.1

MD5:
a8b7973ef64fbc4b4bb006bd1f4135bf

SHA-1:
a33d95f8169e15b7e6ea5fd3c43d439dc411d1a0

SHA-256:
ac7e6aa0fd4d95852cd4f6d8a43f40ecd799d9ef81c7353855fa1b701c2179df

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 8:09:58 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.4.18.2

File size:
942.9 KB (965,552 bytes)

Product version:
2.7

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_updatechecker.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:kW2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:kzJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_updatechecker.exe has been seen being distributed by the following 5 URLs.

http://www.hostvaultcycle.com/c?x=BO /s9vMlxvehUFtU8ejgDJZwy3PQcpUwnLtimJwwQY=&c=5jtDZfFiLO46mX7f7mn4MGTm8EGQ2MI/XneMquOMR CX /Vu/9QcZuulY3jtWp2Tq9Ftd88UwP14Oe9Sla5pocpyORvSmp35 PA/faJ1PDmMkv/xgBLw6qPWDGFIvsbt6rn1yOjWqvz arYzcUk0wjZaVw0jEdYjTHUmflOZiKXgJLvlxfKMxvwbFeJr8Uk8&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.toursclearhost.com/c?x=y ojLkxJA6NRyAmNSBfgiBwL8pjCBAMVmCP0rjvVQ0Q=&c=n2p8rT6jZ1WEYyWIU5 XEUj cF7 SHzGtva9pq 8mhUIVwsF0UFHx3wsPBXSxKCqHmfmsiZWGhJE78oHyRndVy pNH41oGhcVd9Ekrpx7h/J32I2WQZBVGEfDvGfCWHzSKv8btxob3b5jooOEKHszwFEmVz45k/qQhsniw1vD3Y=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.guardappsconcepts.com/c?x=aP0NXX0DXQtZsVqnFoD9T p4QPnwUTgdvDPBL38VLdU=&c=3 d8vzV9iUZU5/9ZnejDaJDkSF7HY3Yc5Rzpmo26RtDn/2F1vx0nUlrD94q uEumkmVAf4p9ri45oS33oC ZiKtZMhOknOxnZvl4Ssb3 P/E 5hbvcBMxqm5GaMwUxv0/f92MG5oEO8HMUMCszBJ9gPtqwysQhiI1tz9fZ0Vgg4=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.bulkapppresent.com/c?x=lvjYyv6SD1Eva6aix5nWEk8dDXS/i Y5y8kgO9DRj6o=&c=WMkAXLULGLaduvMBGetAGZVG71ZlwBsv43e4vb0W9e7iSe8L0raF6DUVVuemaUfUQbQQ09Nzu3PCUzOyF3NpogWloG/xz/J5P874mdagpI/Y04HkK10Aeev5gaAA8r5c6z211L Dp7o5eZdI2de2I0XFGtglBXD43Ad6sbSq6yo=&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

http://www.packageconecptbulk.com/c?x=nZ9u2H9mhPJhIbCfEjkiShyKkE99CoglRrnbPJYhcqk=&c=/Dj2v3GDvolKSuu33eMckXdU4VsXfEENPRMbC59QsRXCasViWWHmjm6KGpqw/IO29 hrvPI5Bnrbynk0YliglZVVtNWmdUo2BP69TFfUa7CJY0otpE1wgcwotCF4PmYR8HSM7eBiaKJNBGTX3VRWcu/YC9nRUfXvk4SCkDnGl5nj7JgCy40e2FCMdd2/WHk1&e=1&fallback_url=http://res.nobistex.com/cache/upch/.../UpdateChecker.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_updatechecker.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.