home

icreinstall_utorrent installer.exe

Internet

Silver Setup (Fried Cookie Ltd.)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_utorrent installer.exe, “Internet Setup ” by Silver Setup (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Silver Setup (Fried Cookie Ltd.)  (signed and verified)

Product:
Internet

Description:
Internet Setup

Version:
1.2.3.8

MD5:
4f85c1a60463b807023b6db4f507e3ac

SHA-1:
d06262759c47da160b32b666f7f5cd2aebaf23a3

SHA-256:
cdd25d19cc154c486377ca6cc7dcbeda6ec8e57c0429173884b1fbfb6b5c3713

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/2/2024 4:24:56 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.5.8

File size:
963.4 KB (986,472 bytes)

Product version:
3.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_utorrent installer.exe

Digital Signature
Signed by:
Silver Setup (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:13:58 PM

Valid to:
7/24/2016 4:33:54 PM

Subject:
CN=Silver Setup (Fried Cookie Ltd.), O=Silver Setup (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112140334915ED026A82D6160FD4F0BAD4D4

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nevQdNB1+F3tA5IWFJVxYRDRGkvUM0R/JZNs3:nRPB1+dtAJYRDRrvBC/JZw

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_utorrent installer.exe has been seen being distributed by the following 27 URLs.

http://www.bundlesbytetown.com/c?x=TS3atvEsx1NTTkX yYbWE40Y1D4bHMR4AGwoUvP4Riw=&c=K7K7kxy/fdn0eW6wOvzKiT7mVKVWhgYCjuDBXOupynhTG74KaPEB78WUVxo9YhtJK4aI5QwfhlsTAXO4nsydZzmLucrCiCtplexSeZ IOQTCjTXgYn MEspjaA9ZckFM&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositoryhostinggrab.com/c?x=Sss5qB0XAJuakaivgphlXvsCGpMiY5upi18lTqzugKk=&c=cUmCkMlqPHM bpV4odBTWkdaG4YOcN7ukndbLanIjZn3DgV6t3hr5pqxlTR7SGcJ013QUe7Q0kqvNGfegvPITBaMw5EBHIFdZGy fdRTsJDrRmQTbSvJyDdx3GvnQbgK&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=aR YSvvGsc4a4WdCveztOvgK/IiBBwMHPRI1orjONCs=&c=H/ThsmHYumV2YEYbaFcHUHoRvjbYBB5LswYttMTqmtV2f3FAshMIcz2LbPCEVc/P8A0dequhlhkIBGj2cHIGPl61M/IJwLcsL/jgoLLD7 FHcsYYejX3etvkATa9wa5h&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositoryhostinggrab.com/c?x=vGYxCBvqjZcAfa5cPPpJcasmsaMi7TGGPjWvQgwhjMQ=&c=ZO QFNd9bP3klVHX2X7R5uWHWXn5cIds3XfAGu7fKaIqlCB6zsxEnjiyMY4HVNXmUyzIN4QSW0THBJE67i3VYE0625ud6TTg8nTcah09K0eBhmOfmzxBVe2df1J7Sqxn&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.bundlesbytetown.com/c?x=YpgVdh/6OLvcQg/3kQdxPYmxjI8 Nt5y90ATQFJ3bwE=&c=cV26gG3ftG gHYPIa1sZjIddPTi 4d1tmU0JHI3d6rcWXEXun0c6jjtjl3B STR6cH0lnqlBfif/uHrQRWw7fhHfIhgdP56zkFp2zLFochgRV8nppGBHKzQvAGyjhSWP&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositorycurrentflash.com/c?x=BsXyEiOpWRBp/fk/Mr03XUqlB3pJDx3u9uUTiaUsHVQ=&c=Xq74V5nT9omVTewiU9rS8ABMcII153sJthkq7hxcjOOefpzYTtzEgrbTPmi6gKCYwoLb4AWMMyP3RF3tXH4FC23K1bwTjhu4oPu51 0auqyMEFmrByse/je22N0m2V0/&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.newsignsuniverse.com/c?x=ihB46y/1oLZnkE189 yziPDZJYpSlB4BrqFQKplH0xQ=&c=osm5rd4lRLt7Kz/QgRNATVXjX6v66tvhc0nFOFYlwTXSysEpoy6xsHjbqoDWQZclPK4g5BHsrPD4M6XM28uLI9BPPcCLKcaseSydQitRWfDwQWSXjn3RZ0JzEbKWcZ54&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=2rt7al8qYtyVN 3u8CGWISGrTVPIoXexSsFosJiZbek=&c=7wfwaAZWkzwypu46ODR/jfG7ltYTV4sW26r/jBrfJ4kYeOUoMNLCPlaioKAaynMXKr1ADWiQPAOR MVv6xeHSfCs/RT6xRclJYLulPK/kKv1KqQD5fAZpKi yCaPLk2K&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationbytecenter.com/c?x=H37La/F/I65lpY84Dn/iKSbk eRLn1rj1GtGoLmfxC0=&c=8KzKgphLjSnlB4wAQgP71FfC3ATKt5ALVd guH4YLFcSqHCbMtWF18jGiFd1LLo4Z/Bxr91gF0G9QVRoKkAqyKniFYKkxdTOVcdOrONgrJXyf4vJkRJAXYqEFOHIRzP9&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=kLNkcLSAGvpuDIo/WZqcyEat63CBY7gecTEQKs5P8Cg=&c=aV9SGylaP1V4062yyDJJvcrES70DWzKrYmA gD6mTC0utypJql7Relas27L1kU5B49xH8EcITqwVvazTQ1ptuLyDIL3 P9CKUqnf3x6xoi6cbQxB7SUet6fjxPytKRnL&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=qywR4N/ SrvC5EKJe C15a 7ODy ukGSz8o9gzguOcI=&c=oATgtrmRuCotlo83yEURbTA8lAlQH00ptE5/eWTPLJv1CU3HJ/XrZ6Pjt0tn ZjxKE0ku HyEkDfbQbpp8abjLNAdeuOyrRTPC6UJ92GI39UBecon2ngigoeqKmkRINw&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.bundlesbytetown.com/c?x=zaAXUhwbVvTTInDKQ2kw/CbeTO54gIXUioi80A0yIn0=&c=x3EEoOFotcVUp4oCr33ShUVmcTo5ZtOwzBY9H32tnGnQlJMjsDqbQMRVb5WPndZ/a9TdvQSyQp6wu/mn1kpykt10h5kw2RsQWZEzA1dyon gyMYUAP6csD2pd/wd9XsF&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.stockfactorytower.com/c?x=E0lwxv7hw1hqqhL3m6R1pPyBQHm30m4XuQC fYrPj1U=&c=PmzKIPiAadmZlFk9gUDBxaO Tae7S aeghcgFoH51xEKtXBWa8xo5UpPpoqXHB/ AL6RNRwP3fhnRPtzueFycGl4wqPlDNZqwsWpb82khtLt6TmtMGF3eflQYPiuRd23&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositoryhostinggrab.com/c?x=z1TBdUdL9RxVM9r19Td5KEKRa57SxWSDzithKK9Rvlc=&c=wtAvGK7gnyFirEjRLNqdNMF4439kAr/dYytieXg2w4U6R2UhlGPhLrP pReZCm9bL38YfMr4FKoHV9wE7S lFjwQJKk69f8Axp76237OWeigg5rY24EClhTZ5GXKtK4J&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositoryheartbundle.com/c?x=TS5NHFT9ZnCbxZobRIBhuVaHwZg0jzbQE2yeOT2RXFI=&c=fyUND17E/vJ8jTzll1oskoco gJouzp7itjLyRNdeuMvZz9p5FUtODLd2Fx5dYm/RrLAqtpCMDyxekHQheSp3AQedpO3jQreHrqPr7 BNBM9QaGYlMgdEFQhuFzOWxtK&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=QSizQvtfdg3g4ThTbOHBwp0tmqBfb747BddsQGqG5cQ=&c=ThLtCHH4vwM2DGSdsQMx6I2yDlUaek07yj en535S6orIr/8Amahb0h zJmgTvpkG5Z6ZLFe1q4fMYe2QZoDKE08eXSu1joTZkXdGP216w4e2g5sM5gTa2S36 fTTGw&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.bundlesbytetown.com/c?x=c1mVUpnZkVmmJlIZrOuoO/p1f5gacHf4xI9gYfoXXB8=&c=wktGiu96HneSlUVIlHWswMl1KIyGUjfCsexwpaFGxf sQqRVoMzD9SrCsf3NTzslb9KMW402EPzuAtGyojvRWUVcgWDx9iJAn7YWqqdqRaEYG7MlNtFU5x2O23DnVZWS&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.hostheadflash.com/c?x= p8dHBuTEkhiBX/ZbtkKUon5rRdGakYW P2zf2N6XTI=&c=BWiyRp46hRdLZAe2D5caZ5ionouBpsh3VhLszw7ZO/uXi5A9 YSgKsrcvuJhDbQ3EXK 2Sl37AEo8lCQuhoSAo7DPVEb5rEeMdwWRp0txkrJZRXzVkxl8QHsfHuxTR1F&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.newsignsuniverse.com/c?x=70umEkkEf/tFJKsISuSXR35zNVT x60DKWEJVfXlkzE=&c=7DoiMAvLNR8UZqBJEx4DjoywzhXhxzWOtfQJicWpP1BC81SY5HqV4LAitB5/OE2bd5CGUJI 5OuXeGXU6MtI81GJTLdRi7o9kQxSCsHsZHhtQyVsFLJqEfkUt0p/FztI&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=K8iMQ98zFarJULaRGAxY1Ez keMZXRZjPCXfzsX2scE=&c=2UvgHBNbG3uBADhge/A7/fyOJdz7jS2cPu OdU9W9RQIKgCAZkKNKsvGTJlY/qyFc3Ie9omaemrCt7UUCUeW3RrZuvN95NjX4xrz192xoShWTIXnrqxMKED5p v2lH/r&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.signsquickbits.com/c?x=UrEKSGqMswk2lGCojOzFkz42eTv8/EZE49W2eG8aLm4=&c=zUpqRyyaVlDhYdxhL2BtH30yGT7hQ0QRJYAZS0UYOH1MPHGbA4xDTnG2kf4U85/Z14YZfz4w2J2BEFYaX7U0/WTpYaiVlyjDGbdgRosK2mtI7emH0TIkkn5dOTUDYhjS&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.signsquickbits.com/c?x=FiPjXgDzUwZS0B0jMTnOLE4uom288wez4Hi3E3O9hWU=&c=OQm3mU4QkxilwT6NaySJTjRdREHQuSw7UJ5eJLmyWIGCr3ynoHuz/gMOAJHCLQO/ RZkO2in5AjV75dwZq1sVyz ON/Xr75BBmkr0535oAArzz5Sv6zR8ZYG7u4xzLgM&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.applicationschuckledownload.com/c?x=Te76K9bpVmv 1H1bRsZxLTkfJvHZ3tlrKDWnrISVHcI=&c=QdM1qxJdGGdxgqg8OWknpNuVciWkfNJqWw85bPwMjYpkB3sNopPVfeeQdxF7BJkTHpJWdNYmyP0p5uKx0AxbJGrgM9VFKmIpYN/Uyel6aE2n0fPQCOWJF3cV 8V5tbJv&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositorycurrentflash.com/c?x=pWtlN04/gVKRwFH FI4zGAiG6DGvfWwFRY8on7eHYdk=&c=GL520KGwMODZsyxm3ZzjJgh6JxO6tmKUmDxYetwmvYDRDvur0iapGXv0dlcDaozEVlbdKnqMLQn9onpJ274lWEyDp3vHwXOzRqqCG6ix6LEcrRh/5t4fBEen/iXbf6K &downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositoryheartbundle.com/c?x=3 xGb25Uk 0SK5wumK1P40b4tPusaTejrG7JG5zaSSE=&c=0tVmqDBW3xba1Dz1aKmUOM/mNMnaC YXL839hi81sD7509nDlVXr0SghVf4qUglf6lq/EGAhaL1YmnMeJ6zqmdZV9EBFz9b7uwDcGSixFgbv 59F8yRKkqpk7Ale9b6k&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.repositoryheartbundle.com/c?x=B3jzAoukjrwU4lA197NOw7pCoR5pgwGf0HAKvUMj1Ok=&c=JB/0wZ6QX R5XA2SkERq6GCQjCgFQiwoSnDOdzHQSKYhhyngCE qoN 3DglzYsy MUyWIvAFkIw4RcgyMQOkVTe75HcnsqM7ckrSknvleVZA8luzXwigVTA7JazrWBX3&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.vaultsapptown.com/c?x=VsTNJvinaSxkPrOcZvYYb5a4bMrekPghfdka6iZWxX0=&c=K7EEGJymQi8z4Y8cr3C/ojWCUb3SEZ94CJuSLgIHGL MJ2OVGNQU9ucEGf4i8lSuTN7ll2RBnKm2OgrZwAmfcwvbjnBsSmYlgjr/1enLUt46PXJuzJq/8iipJD/Zotjl&downloadAs=uTorrent Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_utorrent installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.