home

icreinstall_winrarsetup.exe

Doh

Agile Install (Fried Cookie Ltd)

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_winrarsetup.exe, “Doh Setup ” by Agile Install (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download WinRAR archiver but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Agile Install (Fried Cookie Ltd)  (signed and verified)

Product:
Doh

Description:
Doh Setup

Version:
1.6.5.3

MD5:
b4b0d11083a377c933ef13d205c5c341

SHA-1:
66ff4b544eabd12daae80d789113c950f8184f1d

SHA-256:
9971ca7be1594d4cd5e3623a6efd326364763d9acdb109c9a5a45ee9774f99c2

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/5/2024 7:09:07 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.4.18.12

File size:
898.7 KB (920,280 bytes)

Product version:
1.8.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_winrarsetup.exe

Digital Signature
Signed by:
Agile Install (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:06:44 PM

Valid to:
5/4/2016 3:41:37 PM

Subject:
CN=Agile Install (Fried Cookie Ltd), O=Agile Install (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121833A91D38B769B990852C63E6BAD6723

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:khS6FEeV5eUt+vXd9ZTUGR3L2pC+jSo1fKq4WieIUnL9y:kceEeXe/JYK+NxKq5Zy

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_winrarsetup.exe has been seen being distributed by the following 47 URLs.

http://www.bundleguardbundle.com/c?x=HP3uomwd9wvjvGzP4tS39qOJYefHUCSMhQGVv/WLiPA=&c=PBkRqg3f9i1yH4rkMj lVeaqrVKub4xPussdb0F244S1XNBOfFVezvZZuB4k6wMnvD2knyNVk2236LpVt1GQuHti7vbTE/GZDKAapmAtvueaJlApUNx4H9QAOOzW5YBf&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=tZt3X34oPOaZcehoYOZeQyyuPjKRnJmvTX1VFMUx PI=&c=mtnUdu3HOO3irOfoId3ANkr1bxJ41AfIgmw3sNOpta9huxDw d DC2cHymoZV0UvFt4D/4ZHeKltCkCX5TG5q/BU 4iJNCjq99xdIfTN9rx7bjEh4Z lQIGrcFq1RXnL&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=EG4pGBsb2JZS7B/5EmNCEq LlKrkNcJ4f3e6rzsEWmE=&c=RjIogWmRClx5Wy/VX8B9nFNkN0p54W/9UDWNdSD7z9 roOPANh/MFPIClAAPbCfkMhW8fHbSphtAeAtcqTw2rf88oUQplObsxngX6cmiggz78btczoDMaBuiH82VkBJn&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=KQ3udHewQjCI1ElldLGKvc7Dtelwvn2qxAK9BjVfsxU=&c=Rv2 WQvF9SmxOeJ89c6NzITpve1U3WYVqeyziUkhdfsuTizhcK8Yb4xguyfZMyfPzzh6nFe3Ghlmzahe04PVc6HY9IF2mQ/w4bcNMsKz3u8v7KrLRNN5dpqOMR7aja0&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=h8jS7QclAGtynJTpOHIOSUmH2ERqwdmldZE8DESZ0P0=&c=w88PApP3feT/51HQen0ITXBntrvw0kHEsNOvdUyUvJcvQ AJXzuxUCgOtCtdG/6bA19yGsveBLRjx8nIV28fO0jJc74P6WWHtoN/tCUAoSNLiot1uV2Btkw5WCCJOGkj&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=1eQxD83A DJmNnCnvj6Lt28E3EA k4Hcj26A6qlwspY=&c=hmKUqkEM 9zR6EvUzYZwA8K44xmJ1qHIirXAjssglGvAhwcwhIR0zRsui2ggzchahv2tKJQXQND3lbFitrVcNGaOPECswAdsYAFkbbz2yUp9LEOPQxJKXaKhjUvA76Hj&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=haNT8PsvjVRQQfoKEj 0f4H2mDy4UxFFbz0w4VCcLqw=&c=tXXJHf5UcUf2T8D7J2pOlaYMFbhryZHotpsAv26YVWc5ck24V4 LI68l AUYC1BQaGc0IFQudrCg8YzYJCh0ykFHJV3Z7Rpl xwMeK27VvKxsADtMzmrsa/i4i7bXj7I&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=NrCMiACxyYqeEA1y8BgI9PYGhy9S/YkZLEvdWx2v/Rw=&c=oO rBu26wB84JIohnsxYha9DQ4esFmagU3qnRK8FIuSAJRYw91peBmqbrtSwUTo3q539K0T9SdQ73b61UfzKA3g6GZNlBfQHCaYbRBNhgjOtarPSHzLNAOOYRIlkn2 L&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=yBmc zQr1bwxOr4BxkaAXrBroWuSgbg/kE9zR8jUAfQ=&c=aaAxlqtBwhYb35OXo7d5x ZdkKnUTQMqiJXAe8UCrJi53oFBYn48hWiRk3ees0uyhgsMeSBP0T 1v5DqP3So2H8cjTlGln0noIkH9Qx2zhlo/W4 Kawk1fYO4CZRYqTW&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=X3GNWztD8JIcuL9Tcct9EU0pBHUc9MZ56Gy4Aq2dPwI=&c=46k2Dd2YqRgMnR9TnmfBsIVAzUsuRXl7ZmjHN3ilpwP1uPkIK67OJa2rhXjkWG/yL2pvc4J8qdUZQDB8bEpPUw3ZJOCwVCqvyhpLUxEfvAMfMGFV7U7xgnCyf11AkRRO&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.bundleguardbundle.com/c?x=BBnP1 DXDU0 C/CKmInUCQ6D nO/BvxTCnfGyeCknOk=&c=fKGtna8nnbnFS0FM4J9B01RkoKoQK3SR0sWzIvpeUoWJy1Gd49 nYH7uEmCIXZNDDdwH0VhPEO0zchml3Vz85W5a68jHYF2eZO6IDh74//4P8R rAx0QfMjtyp7nyRU7&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=53E57NE7m7TXvZ6qUIbE649ClaSWQHgWFlzE61eDPWo=&c=jx0 7M7RD7y17wPwNTxGMhAm/4g N1tn9drBvE2swCS q2zMhJbQjA06fkhpASK5kbLpoPP/cGSRTYS44Geuo7k/q5RUuJsz3KKXf7/HlgzkuNNrAvz OlrlWzrMJazW&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=ulzzqfkOesF9JWltvJDuF9gT0wpPS2YLOkNyb1ekEWo=&c=tzeZogxeHAuqPXjWzLguRNou6xLnX R/TzZ0JizsskgBwPDOo42c8xshCaHKF3OvGYoaNSLA3opNiAi9ZNMUuNiLreC4b1l2ZVQJ3okNjJe5RqFk2uT2jT7ThrvmvrSB&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=XE1uvSk nwcdlK3ZJdCiYKApPq1RmIDXAZO8aSzw2Fk=&c=/cRNwZZ9QBC9 6RS0MLvLiBVBBOEfqnSL3BbNPsYh7tcLS9uMynPFAO8hfWGrTPJQG/T/LQk3HgufJOWb6HWgrBGigMJBQ3oRadJw83PWDobiKBy9j1yzKjIYaVhEO2G&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=XXBqiVnKnHsECEVsL zo9EO9S3UWmG8hZSNBlZ1C54o=&c=EOoFnXq3UONJa98fm0P4lL348hk7r937oEu/jlk9 fVc2YZTPABPHHK 9aLPkNhbzoRsWSGqgpLB/BOWkpKFlgYWTH9Kucv5jWJ2/SNlY5XcpaLlMc0rfGYdq51GNcH9&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=t61MmvzrizcBEcCmJ ufOsUKvxWdaxT/IIeYyj3/2 c=&c=I5Z7wqNiPHVpibtOYJhZsjrRykHhMFrPlczRwNSLmQ51FgvJf4Jn5Pji1QFYj0 7hZSDaXUVeGI5idHYTQNVQAqAkKDI/m7q0dqvRqwPuhYSiYjAWeunqAxraA0r3J8E&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=/xGps67lUl1eTw5O8Od6JKiyC5zRMOJASi2jJzdK/8o=&c=udn7pStlAZi1SETEZsI2vl0lZ2ImdS0Sa7cgoGMEode4wzfyJ/p750TDa2jqOe9M1hohHE4S6U7XvfWvZN wO4Eflgh4UddZ87k2p7xBpM7sZIPXRMPFcyPl8Kv/6aEX&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=MjTZe mBulTXeXFnkvOJL7tnj5GMRy33WiseXQj850A=&c=w8mCczI4tMR/c3BsP1GiQ/ZYVqDVkV2QbrPCfWFP0YJBAIi RHkoHg bkLUM0FNGSIQWIjCEhNgmQFDzexFUgHAHT hWQDLww7dP3P4n3BGVe/3RMZK/oqBuuFaKaXvr&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=X2fhvOW2ZPtxJAeSU6npWtz Lg6gz/UPqXRKEo4e65E=&c=avWZUl5LquJWmA3N3RnwKpcSSanr3sjZ4CLN1IPtwigrKoEqID1GJR2IjfvHyzT6TdlQP/Byk8dbNCTSnAazRFF7J7ygwClzD5DH9rxAe5WsnoLfZZdGmoF/i3v7O6qt&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=FCMROsJmDrbR7 Tr9N2w5 Kee78yyzo yf3hd0FDh0k=&c=qQy5IeibBut1d/YZh785yCWpw KtfRW2iyjUJVwFWKD79yzATbWphBMYVpmP6uVJCaHnW0MSjNlA9o5BoJEHWh9hCiCd6bdr/zpJIgF5gHvC18PhNfrmLi8e8QrZWnV9&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=6R1cUTyP3EJxOC94dt7Zj58delANch1uURu1zsPkYC4=&c=O4ucSmkKimAmzqeBBqkXnjo3d07dYThgPMI n3LHMc1jI7X9klBIsTVOe4R9mourdBRQxWlKANzBcBLRoekYnUvaiR0DqEnxHhON0MJFtxfnDYMwvzOW5t56CHGBvRDb&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=QMvv4EVklw7JeqpANbx6R87FUpEJGdIkrr075g/ApMk=&c=zHgRzde/vDUEh29l7r1C M8aFiojlyfeGAfG/IQSECdRJG47QvG0nyClxbrh0IWXFplr8aYF6Od6ucGVfhYwzJScBC/a2O 0ZNsAu6GCKXIaxIQEAJqkKwP6ylnW8i h&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=wqf XvG1y7TTq2sr57b34af/VUq gBIfHwuuWjHl2g4=&c=IrGKxidg0U0lmxa6dQEabE/LYj3NIv8pfyy103wmx0ZHOOkAMjg0wHR3F7FHtP0x3tm01/5Z08HRKVWFK025S9rq1 SrPgrNlTWnDrWN0V5jjrbJGJZS1lq/vd4CrJJZ&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=6NHlGpc14oHYhF5TBvawfqIqEfPGMapSFLYS//g74ao=&c=HorkaAIerOqlF3dvvWH ewM9yE2qSXV7YluoRjPrteTzjJLdPBBI4oeJ/l0Mrt06OCo9XhEC4QrBbfP/bMdhXzdICb06DzjaDQIa06WzeNrXKGmIKbq7tLwvpbJDQZNL&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=McwPxziWz MeMLP1vzPhrhdGdFlsic/AGa2z4PlAalc=&c=dah9K4Cc/ixoeL7yWr7aP8bbqk6kwpCTOwXTJ9pYqh17iVBaHwtaYFTdJHar3DumvPd8QaUvy0xskwgYaEvZV4mPm7e4pe4U/XEWmGSg1FaV2LYdxvEXld3W33zkxoYK&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=y8U8vIMW2zie9j6q4rf29u8frsEexeBUq1r/mIbtOGo=&c=8sMU0eZJy5QKHm1yKeQcdjobXAVOVFH4SE6/vL2xVDraS65LJUpacpYFDVLSFIvQdGS5EVREoXteKbxxfLcfnkYT8uwD87O/BweqbInu9zFznLs56zVXkv5sizXtZx 9&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=LitUNKVAi/rEir2B7O3elFHvqLimC3hbonUFynBIWcE=&c=Qkmy29GNifZspTI2ZcO308rCHCwoOrzEDosUAvgG5X1HlXZYJG9r/ EoDqpwNf95xa9yjQPVRYpPur/vOLSwrCLMxyx7crM8xTVlxt2USpifeDe7lvS06CesKEiJZthv&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=RPR6ji0pwFj7MqvHGpdwhLQ2g3Z5jF GBlpol4vSq1k=&c=hbNb41R8zIBmmiITpKrAGI2KMDQNeCItvvqe34kR4aZMWAn5vkzfyeLZID2BXQkkFWfGoTAaChOPMmW t1Lx YQ0UJZk8lrr0f3L39domq/c8uGJiaK zS6LigXW6yre&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=f1maXiy6yR/FdHvkkAR9ayT5OSHfTtHXy0gbYjhSo5w=&c=Od0ezo939XOXcPeWOI0XL3jFT q1u3cee54upuiTo8zque6RSZGwrY8vLSG5bHhbCjiVmrgJXzh1P4 zJlDMoVEYy5CSss38WfYoseg7vyWoLMiqr1J9rstDFoDiFu0F&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://cdn.mediafhcontent.com/c?x=NPa/zs7FD9Mwv2BhkoSSFHV7NOHOT8lYcrBCvw1eeow=&c=Rwbl4HJO8jKKbj07QiNI3uql boXi01KHC2eH6NikfLVUq64f1eN/25Shlnks92TbAnl5GSHsqT1GiAdybKVpXELATJ55V7wkfaY/k/jgxGBci2dSCHbRLV9s12XjPpc&downloadAs=WinRARSetup.exe&fallback_url=http://allmyapps.com/binary/1410/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

Latest 30 of 47 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_winrarsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.