home

microsoft-word-2013.exe

Program lite

Bibado Investments, S.L.

The application microsoft-word-2013.exe, “Program lite Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.vaultssignstag.com and multiple other hosts.
Publisher:
Bibado Investments, S.L.  (signed and verified)

Product:
Program lite

Description:
Program lite Setup

MD5:
3ddf70d217b6438328548cc9fdf76203

SHA-1:
125ac44dd14adfe757063345f175d3dc56034774

SHA-256:
8fdf2c1134e52e0e991874d1776d7c947998f6dc095be9780faad9784d2514bd

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 6:02:20 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.1.22.15

File size:
995 KB (1,018,840 bytes)

Product version:
2.8.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bibado Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\microsoft-word-2013.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 5:57:03 AM

Valid to:
4/2/2017 2:32:01 AM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:O4e2h0lI9AaG0ag78xGvA3nTcWNQF2vzSuN1pKm/Qvj:O1g9AahalJTcWNE2vzSM1pKm/Q7

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9284

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 40 URLs.

http://www.vaultssignstag.com/c?x=2bPr4TE22fiVKmtQ57sjynlsCueX7ug9wrG04yLUbf0=&c=SDeI7QufdRFT//pJy93VLsz/veY/kOmd4dR6qv2Q2AHGViBPR/JrLncchI/ZFtBGDA9h9GBQxVPzjpp3P8CYNvXQdsOjHY8PSzeM0Ln64yGBvVb31Elo7efI2TNcaqAG&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=A3Tv4T68ZlqjFvWpj4z5hHVQPZ6rWPzuBZd1MuSyKkg=&c=h7OPWKYeCkayxZBlrunRHc2yqHjjIfvvWATKKPhalZ 304nHIpAB3Mfb5tKYOmbavc2Hf7nkTBYXy3lsrbvW2Yd9uwkabY98PXGJONszUVazkBp8uHxXXt7hLwNFPnqM&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=4AYBbOoBSZ7FCEygIlZIgqUaybUixtYyNAi/4KeverE=&c=iTOnPjFrL7lweMEsb1/0nY2zZeYwd5x2R3eWt748dmeLHzKdvbw40wPmtwMrUm1VRP0C7eq1j1Phh0uuwAbKRgnryKSNcYZ8LsPisysQQ9V07yX/Wu640XqagiQLSgAp&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=16g bBm0Dkspp3Yc9HNU6AQDhA2/wVm97BQUuiERXBk=&c=2z/5o5mJxwQsxb BtktAjnE6J7eOODrAn9MhvW903Y1TpnQgGT7l0kfBoQUvyyepQEQdcxMWrjBHrty21We0kzDkHEEOFShwczL4OlSMaEVIMw3uZStLxbQVIwsVk5xz&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=8lty3jC23JWWEu3k2ZsHsEHIWIQLFQfdm bmUtorzDE=&c=27Ck mLoebJ3 YbnCasLHwvAbh4MoE0c2VYJJ4gZt4 PiGLcsZnlxZ6Lo7toJhylgssETYmyWaRyrDjCepuwAty6PHDfXpcD5pau9pKiwX59g4c2v5Rl gUW3qgi/wL4&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingbulkbest.com/c?x=R/RZIVjlTYzShXtOv1dkqTfGOJ3TSS3hIIBtI9NWum0=&c=Z3boysAcIj63Y0/LBlkUBhLp38A4oHmNw6wd9 4cjbcvEm6YvpdB1fnVT4YYsc55/MgocL/DgnrdUgxFwfW2nhTEDAkdQV 5nHIg7VmR9P/5jkyx8MYDvacsuSvL19Xu&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=ZglODBNTKIdCjZgFZI3iTVxJJ1mjG WZizhPtbZS6gw=&c=jdU31tyadUkuGA5wTODnb/Qn/JrTFSVZmOyC0A9VPs7kHJbljOUcJ7g88WPpMaD6c//K7SxMn9s1e3qaM69rPrGUw6BaYOOA0UAMLgOWZVI6PCGXpmMuWZtzCqdqrSn4&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=1CRMgLoOnSWel32VoewjtillhxpoydY2x7n/imJnVSM=&c=S8gRvt2bNXZzJSzyJIniO/wL50lMA03Dg2Jugn4pvSxgL2kQ1LSYTaIib0Aos5xtI7YoCcfQm4HW6fD s4Riy1ZK57dxCnwe7Kxgu sGJ5JYsgZUIO O/AMGphSorGd4&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=E4 7MkQ2TNQwdscQCUYEbXm/ebOdiIDALu1IttDg mE=&c=7GasOS9pr0BopjmW5zvRooHg5OVu7IEyJAUFzA/JqsVUDUEhwtc8rm9lcb08T/8TGHUy9sicPxKxp0C8waUw4ccqGGSPUiUa8whrSnzJ3MwmgOAf5sJW 2H8K6Raw9ul&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=D71Xn/FK94K2hxjqFrJhISMvrMHl0qxXP7jL1Ao4bwI=&c=FM uedUMKZyASi LkorzErfFlTxEmaefKRgt6vdE7wGBw7ANe5c9NIEV9j6V73d 8BrjETMJTZCtmZIpwHuJWk5pXUCnWBrJDrKYBfBPeZpwOo/VyFJ35cyW 1lRD/kM&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=DDqXlo2WwoqZsfrwxYQrskeqnShO4KPpyfy5e NWsqM=&c=/mOe6rEidAX8nVu7ZlXxwI9uxhYPgek9fJDlUCO9k/bpDBtOnGFxeiYkE CQzm2p7ztVaLyzQ0jzlZ0e5wLZpOAd7BUtKw2z4Q9GMVbe//JgSC/aZHmOLTkeDS6umMAh&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=GDlWWNazSjOmwTJ3R3LCpJ6dpTk1OzINFbkDfd7o3Ts=&c=9nAoe4zTEA8E9F2uEdJ/20aVYfywmq5CQmTGdoNxFSMa6K3h8xxmTKOIu2LJfO/0t0dzT5jsOyHbWiRS/rMOOmHMx0O4dQiC7GhA95SvTWa5qrNAnWYPVQZZeOLH6jwA&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=j2s yjdLNO0Z5Xd1Wgp S/bGCaSoIe5b44sdnPTdmBA=&c=nU41Irjy1YonziWXO5A17Zy9gj0YAuG9vFsxJbRqv6CeGfjMPDSIoJL7MbknkJQFWsyVFQmPEIYnkYWbn/BaNX8enkJmrS g1toZ8ftIPghqeNMGb/fRVoLkakYiK9SR&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hostingbulkbest.com/c?x=RguL43bWCoEtJkLkevUTgWX 7rAbMQezQE7NGF01f4g=&c=A7KncxgRHjwgm4SIB gqI9AgPkh7nvi45Otms58qKv0T3g5pLaSNmd2CTuGcEGXkzlDlTH7fmAKE4lPsQcZ3c1 O7230RwPJhzmVroOoGXOobM6793S7JoXX/ObWIsQS&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x= 2 Qknvg3RjsifXEpQ2S thEq5tjD jTy/h/aO2as0=&c=vixyDn6YXNQH6tJVAcCC53UL1kyOcnC5 Zfw4Ck866YFGeVOoCqojvdYumq4VygLBOcZPshMG 5PY/c1xjJVNUdOOTcnm5UaAky8R9PoHVU8jNd4vjdEOJRPlfpHnqHf&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=MqZ8RCiROcNC2nVu1ISFuBhabNmEp1bJ01EIOucuhiI=&c=RY4YjEAsRmlX wtYEIV4nxbrLo 82awH9wZjypa spoCr2XhkqC6/47a6SejL/Y4XX/Hhp3tTPl1hQaaN9NVJF7GkyhM7gA IlQgleE8GdfKMpXmwvGmLQRND7LIxYG8&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=lvzx1vNYVNf9Ux7eYf8LKnXSIZGPj6OnxPafoAQgOP0=&c=xJ8SIxVNJJonre8DOXsLq4b0uZFsgPtZTIwAA5RKXGSzXxLAWaeyidP6La6Lc9Ij566HssZB5YIw9Vm410n8r/953czMWt7VaoenR7sN4j9Yd70Rs62AXX4lBmtgPuDu&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=PqLHs/RiaJSJLLwD1t0jLwVjyJVo9N8OqusUOBaCD5o=&c=dU6WxDqnKlaTKemyeAOJZFgd05MEw4r39hECk6hQwpoHvxtT/llE6aUlVqsqs787U4BgVmogiypH7GkI4TEiJJLHE4YlsCrJHq4qvHTT6XcX0eQO9IGQLKsVm8Wb6ea &downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=beI3yW02arO03nMJ5D7itGw2l75UhJtfSbqUt4KiVVQ=&c=T5zRvbJBR16fnGtoKNcH3QtUYOQlsUOkRtnhvpW6BwabZeAc17SS0Szkd1NrjsPhcr0dYP5Q71ub9GjlRWwQhkrnhNWkc4N7zrqckQ9DKSDOIpXmqU08YxU8MQV079c5&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=dg65kWYkg9SiVUkqNfTXDyho/VCc9UuVWTlVZhfiluQ=&c=hWDHNkLuZaLZgJ8QZagZekNDOdCC7 3NHGDQgMaPgkh8bsPFqwFGn6vf7A/X3n0bIkqCURFibyFADi9F5hRcpg0QOpE67j9U 3pwDCjRVivCWkrhtxuCAjrn LdkG1WI&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=ns8TMWGEBGmfsa3Ns3w0zziFKwSKao4U31sKKlep9Y0=&c=o0u3ngi/UN1Rh/Ia2BEAu082qibOz8KkojtPdHviGf5WyWLBizAYi4oEgE9buk6gLWmyVS8xQxPF30kzrL64qG5PU6sZo6kMh4QAYQc9AZ3v1pDBff9amkZ01ZAxWdlu&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=N5Ay3sGKNsh9XYrjRVe y93uPpO62o6LJyTu7ElkpT8=&c=TuwRClPkR8fPls7k1Ah8qU06NsThrf3rhy5x/wX g6ETRh5m/SMwRUtga38eZwOZD/YoUaPzEPFTwx3Ndw9KDu7hF505eBqwDWfAIErThzR4Z40FF1ZhvNC1pbtBig u&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=pZavy26xrXaYN1Hs2QyVFTuK3qz1C6/VNhW0BmxoSj0=&c=/MjgAiukDaAwgk4N5XhRQ5z0QQes/KaJGILzcKuVv0/Pyu/oYVHeZKM7pvi3AQFwgv4cDM1J//Z8yCFPO9KuWdTz0SXtp2BfFHRlxNqbWmnW3DQNwslMBO wOQX9Iar&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=CU3A/BvJBVamtPBZ70mAlDTNS7TYfD3Gse3ErhX4aFw=&c=fidh56MFaEXHz00101D15ShFg/jYLWqR74JyffK1EVo28BU 8osO9XAhAE/Q9Kk912fDaErPrdPtNfgyjl3HyFDvbsL/2AvUR5ZnOfH/eZaMTy6af3E311cJ9gDbPXkF&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=MSuj Lgl7pwv0sS0Uzl9l5sHcnIE1FEl45MhYjbyi5A=&c=oGcLas7h0YR/Pz05prF4sHQ1thf8PZREG5JhF6wspPIsm8Y5Ry8ba30Lj0AyZ85MkfqJYRMeLY8G0e9EbnI0 m8psMDouP1ohIZ9hY5bgrmupwynoJD5HYzZKPPmpoXm&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultssignstag.com/c?x=p9e Uz/bWSSilvOXJfHBiSaI02d3ik7wIq5FSEa37g4=&c=HYXCGMqiphE4aZ8e9986Mq/KVd/vey nUCObXHcVzxxzKoDN3FQS5JLFPOauQr3StnET3RvkU fBkx5kHbUOoJZZ4Fp/QzE5ZNTY2X8M/VfcxxDxxp NR/wWNHpAZdCU&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=bVLk3PIxLSWfqSk4JhZXrdoPHBzg5q/DR/l7QDI5NeQ=&c=CkiQ4uR/nTx2PYA8nvim/7VVPBkywFK WQGH6/WZVUaRZ8zHHV5Z000sdihAkfHB9JecDs3SHd9FLudfqVL22hLwJeYQuMYqfON q57tU8YR5V8LfX7MS/NihoThWIKf&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=VPC0uKwxCb6ZHgdFGxIJ95eeVkXo6Msw5ISnDbL2Wss=&c=phHlukpfm7twd7bGHDX6pLQUQmQayZOh1oxdBHWVS12 NceSVE3 C7dlrURYQTNV2idY dPYfMSSwKPIyTyUt6ELt9aI5myZky1o2LrpD7w5CWiM2eCuBwofIZ85sgV6&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=nGzqpN f6/7HMebSU4dbTY0TwYTKoP1GnzXXWx/aYtw=&c=g2RhboW4ElQmyZ0jaTzpEzVAtbh3HTaDbG8jrmrLQMXRzqBx7Be49I6Vr/DpMUghQynQHwF4WRNxu8s87ELKhkpG3B/YQr/DcW0pT6y/1wdul1jNtQq3sRTLHg4neGsm&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towerchuckleclear.com/c?x=W80s0VXH3bCEJSctjtZfynERPh9rMJXNJ0fVf9wnLFQ=&c=5eo5HkRavOpPUm4byEd81tYAqFv/AjmsLw3u ijqO3e4MXdOwIrAU3VbVMYDO2IFanZiYHNwzgRCTwCocoSpEHKvIjR6 DujnRwAsXcJd23ImGvVNeJVYmstUMNg wEx&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Latest 30 of 40 download URLs

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.