home

icreinstall_yandere_simulator.exe

Cilap

Morava Group

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_yandere_simulator.exe, “Cilap Setup ” by Morava Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Morava Group  (signed and verified)

Product:
Cilap

Description:
Cilap Setup

MD5:
93314601ed770dd440f73d17e94d286c

SHA-1:
7c36888aa2d4ebbf797b48efc88ff1cec6c508cb

SHA-256:
79887a96189cf74e49911a90226a525776b51461621e70f9f5e82c83d0aadf9c

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 2:18:49 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.MoravaGr.Installer (M)
16.5.14.8

File size:
925.9 KB (948,152 bytes)

Product version:
3.7.3

Copyright:
Fast Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_yandere_simulator.exe

Digital Signature
Signed by:
Morava Group

Authority:
GlobalSign nv-sa

Valid from:
3/7/2016 11:28:01 AM

Valid to:
3/8/2017 11:28:01 AM

Subject:
CN=Morava Group, O=Morava Group, L=Towson, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A83F14C1C6D435814D1A4B9EC949DB5C

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OH9a0YfN12k11Me/htysP9NLE/MJmPh6L:CRYfN124yghtJDLyMJmh6L

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file icreinstall_yandere_simulator.exe has been seen being distributed by the following 15 URLs.

http://www.appsfilessafe.com/c?x=WQzvHpNucFCmInlCyl7WHRkTZpqArcJYrXorGd1ok8o=&c=GrNr8663AeeyAMbw7II6na6gEaaJaajZihi1geYzoMIp9aMgYSeEptNOBKD7Hfxgei/PZMCPdGnDAWddMYnNmkZvCsRmQRIIr69AxA6P/RJSuD0j8aNYdiYM/.../JQZtb6isZT23XHHPflo43xnKlOBrL ZA=&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/.../jrk4D7FrOtHqtjBnSFifyj ygU1t6PjPkVdyEqb6HvRJSKC8OaePJHGUimDSz6DMIRO 274kwwujgtvZZsox6drE4xr3UZFXo NaH5&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=26PNLnZDaNxFWZXF8 xHBytqq96wzuVGYltxkerZM6s=&c=1Mjz8X6YvO6crM2eEX3tt3qMRAmjr6a8Im8zEGMBfdLVFI3PxolcjokfV6V wSwZ1kSLOQwvRl1U64P3N8Pe7Y45FBGTD76xuKNjPHTF7wx3c2e4dZOFMWcQ4e dS/.../1rIKNcE=&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=AO8EY5mZ9tHqU74a1BmocPgd0zsihe8zHox4LB0D/pE=&c=bAXSwAur5FGLWPV 9EZgz9WCh8Ggba0OO GatQWYv/.../ZVNG6ZuTCINjr8DdGzl35OxFwzs9HnA=&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=SQUFRMH19z oWQpFSqSzWpo4dbJLEMBqV4dcOE0qBuA=&c=ZixNU1nKKbhD7f66TZ6xMwJ/eBG1E/Se1tlm2FKDGxcw7J8yM5tgxEixF6DC4WbZwpX3L9sL2AokPjYB8O4wRbsrAT1TLNalngKjkvS/1t/.../lCyHHUgIh4uPGDYAw6spTakAFIAUFyMgXwmzEjBxx6AI5Mf3cqKVAiAqxUESWhOnMR6h4qcgKvzhLzP2S&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=DOiS/9sYY5vd/1MVRN kDPvurMOh3tB9Ttn/tikidsM=&c=3MjwVSn5v/vpSQR2vtUs1acoGbbQpj0xkU tTs27NSjbicwSzGvf3oS/.../bE6judY6j4F1toHM tpkKyAfbXPlwfpvJ0bwtXVyIFTFZyTI2I45AJSW CkUj8bYN0nTYlgXKr415U dWGywS6Cv bUsZpJAl8h&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=nPFf0iqlvuOeNsEzf4odZ3da/uMvyfZwGCzXYowZ69c=&c=xVA ftyEj40q7cQMT0HjqAwh7EJEYkHNsOnNxk7/ Jp7XPqiUOF391CMn0NjQklGlTK29jmUPb5E6p8sxY3AM0FJflz30Sl1Fee3vr3n FzmGwGCdLl6/.../G9vjzepu95AMuiyhLg5T60OYW8=&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=zp4iSxAFMxbKXxbao8zukDXTghI9KfAsodaJnObSUl0=&c=bZFuxWqeyGoRqxW3UFWeBVYABnMaH68Fa0BlnmRr RiAup 96i5BHeOqDKKD66kQ/PheNvkG NFJcolV3P9Sl F/.../yx4SJJhUE3FW73ID5bieiP08D5hPKvQ6jIu&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=/jN9Y uB7TLKqnADnxiQjWCS 9T92SLYdTx2Iz0OJdI=&c=X6jL3Ag9Pts5ZFsvYHk97LLeKI2NJn8PO ql uycYKTs5c7VahE3l Rk1KOd6omwyNiQzN587 ddPhdj6eX1zvdgug1loINofuiOsjJNUtKeJQ00pP7zQvih2eneaTHFy0FLEeGY80/.../&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=NOzEZMq5dF1AorGvnChe4C fMpRLkgrfYSrVd0cFxvg=&c=TC70UVLJ66Ox8BjLdet9 NY4mfSkMi/5r4rSb7dbIXaJATKXVidsug/.../VdumIjIRF6bG5QmfQF9C6eiTanHaDEI594e9Jdr0J6Fc695qnY&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=H0invDbdZC4vOtpopn1PYycbMVPt9uIRezT9lhe0x/8=&c=8Kj7X6WWg71NGi0DBE2FBAymuWeCvQPsmJRSl8TGkDBe2CB6mA9suNPhFlmUXInj9USNT/8h8eJjYPYOB6VW/.../MCs8w1UTVQSsU7RF Kc4ttwAQ6UObYwb5EV1NNui3jU8hCfDbYQzFbi6jEtV1LtSMgEUAugmH4nV&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=IEVZ9r1XHCSLLJoTWAd/t/.../lamAPGHduLsvIfacCRsnCoACW6EmnjpEszBAfT4WLgfPGSfbTkb6xftoedaf2AX0SeZchqv&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=6WLC178Vmctu2xAZhxtGig4KsvWcgeeyDeetPE3287M=&c=6SL5QMOIs4SQ6NRoQ8UHxuK5D5AG5sz7epmmaSIyhWxTyNzTTr3Onw1quG6vy51hMg fi0Jsxl/.../tXpx &e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=TNXcwMRWALw4qXxQ65xIVY9rAhhhzeCXNU1wHxHvjyI=&c=WTq4BpSbeXRKLR9ZxYewjsiN4zvcX1UM0D7wc iJB2pDSCjB7SVLRsxODdaT4tXfPSaA iQ1C/.../uA8IM6dfCuM9wdUNOv0pau6xO0eWPLZJQLyOdqQ7j4LLzKlGinrlbaUEjwdh5R3k=&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

http://www.appsfilessafe.com/c?x=RzIS4r73v iAFEio2UYrbeaMZmZIzMnkf5ShaU52sNQ=&c=p9wIB86kmLdQVx2ogrSguepbaTbr9ic2RYuQF6IB6TTVeqsAc34ZS4jTx1 Qf0q6G1WjteLE7/.../4H zdq0AbW1rJvbBFYBJSN78tnVp3zVbceIu73slSfMDd70ss=&e=0&downloadAs=yandere_simulator.exe&fallback_url=Fallback URL

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

Remove icreinstall_yandere_simulator.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.