home

microsoft-word-2013.exe

web

Bibado Investments, S.L.

The application microsoft-word-2013.exe, “web Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.binariesbitsuniverse.com and multiple other hosts.
Publisher:
Web Installer   (signed by Bibado Investments, S.L.)

Product:
web

Description:
web Setup

MD5:
e456db3da3f632fae841b11b1971592a

SHA-1:
8b05c7c9da499189da1aefe7c1a239a6ce0ee18a

SHA-256:
0114fc38288390606676088e691575a30bd91d221cd3a9a042d74e6c843c5ae5

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
1/15/2025 11:45:10 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.2.18.8

File size:
991.8 KB (1,015,624 bytes)

Product version:
2.3

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bibado Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\microsoft-word-2013.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 7:57:03 AM

Valid to:
4/2/2017 4:32:01 AM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:3q0HMDYBt4lTXw4jpVoHJa/c5IS4nMmCF/gZBJxNE+mKU2hUrK5bIuZ:3q0MD1lTLss/8xIiuJHeK5bv

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9276

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 15 URLs.

http://www.binariesbitsuniverse.com/c?x=g m7OsszWWbyTcEyBYgi/XC7jA0vvoiHxqBgbiWaDoE=&c=GX7q8Rn3dA5EiL4d8j1Qyce9W0/Kis9xTzTGA1ovy EFvqQ89kICunohV11m3MlvKY6JdKBgZD1VypsDbWMpzSIX XfOMmxLZP0/93JvYmT3hWtYACcIC54YCbmyFllb&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.appdownloadsapp.com/c?x=t4aerySEgp5Uo2UP wVMPtTez84IcFwGH2fp22VL Hk=&c=f7kiWPNnMAtDDSBl6Sq329tVPHHBEQGoZUOho6J5WdRzt5RHADMI61EzEvAWVQ pJO2tpwcHWIcXPYd8s4A87Ac4UIsqUCniZKC8k6dMDaNXgz6ppvL4PtCi2Tr2fGMA&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chucklehosttowers.com/c?x=IZw44OInBmCj8eIv5wv7kkAeNPcNgdYQsL5D9MN dK0=&c=wwx7NfS3fOZ6cmurIBd7VAwiaSKyISngIjxq71Rypo6HgyH6m DqUaz2XrnG1sBPRypyxWe YmP5pDRVmFLtHODaOnWUcUSSQlQLOGUnfal8iML7Qp/x/wMxzvYqObnE&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.signappscapital.com/c?x=pWeOVKoz6QMNiM5CCcnSfu vFAMxRTiK5jd1zRgsiyo=&c=InYDSaXDzWwaPewMn69ibRoRCwy91aTWLXZnYqaTT6Pe72qJ7R8XN1zl2GjG3C2e9/oQcmLDZIrRyvb67sx2/9a5JGMiuO1QHap64CpUPYrJB1iUhkwswxde5gbGrw e&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.sendbytemeta.com/c?x=mNmZig/8rAY1Eb 3aMMdphU4nA RvsdKoV7wpbWBw/k=&c=4CyE7foj8Qigwtm6nU8GrnAfizSjIgQL5iM5sgEWMSAECtjyR1WLeT2/neXT0fazpbEnoTeSoauIQo/ l6jjCAS7CMLlNympLRdNJF270/t6U0uI5z1NfaaVd CBfPhW&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chucklehosttowers.com/c?x=zJvFFmOpYwOXO/F9FO44PelJC7qmRHncl0RWq1u5Hw4=&c=NcLiElxRE5/TYCsjBFYCmwJBSOh83nWIYOpRHC0qIEq9IPHwDoEjDcOzJ9n9c1yzVltZRxngsKVwQIDdMZXfzpBT3BD8OoOmQX29PSasHfTv5KxKqSChyoPoUj8V Ibp&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesbitsuniverse.com/c?x=YDdpbZoYcwVqCOjuqjSLRjOcz9IRlS7VE25TzwCuMzg=&c=M7iZMcQUKUZepdsquwsl4EPTIau fPbAyJ XaVPDKGztZZ04moSQLpk09Ob8foJZSr9RnvVXsYcB4c05u/LPNEVRf0jJ6tUdBtedviKRtnf596ZQLF7tSKhsiDaEcqp &downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=/TVb3VvLHud4KQloWaGYzcMyKFqOWM25RzbzJ6TmKJs=&c=rk1 FT iKFdtqSP/8Ew3Ob9bhCGvd8kZ2J8ab0CoYNTfTLrAvTEWF/K/yDARdURYvP6wZxxXnFZd/cBVMfCfNRoyC7wctzXrfxDW0MelbKrTpXcUEYBXFtzZ01g/1qHS&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.signappscapital.com/c?x=bvF4Q Pj3huzMvMrSEyQM85y8shm 69ICCEIOxxvvHs=&c= wLj/BW6sZM7KlW4B2LTbGzPIX4MC6U1tihDinzqAyq7/OVbkVahqukSZOMHg3sHf70HSjRTUU856Vlz785b6EoA05nHPSnZ9jDDJ4EpbfZTwh1/v8qjxl1h3x29qd X&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.chucklehosttowers.com/c?x=8k YzbWsvvTEEDf QEn4bFsXUgvQpQrqwWA79R3Sf4s=&c=1G8QYGP0kOk5vo9N8KpJoKx wwXDSgrHJyJ74L suAS8yzlNMonWRgpMYoHJJlKfK7yOI2a/xlUsOT0beivW9OxO2nplEXKv4WmvlZN1Oot/5Xx4G5rWbOpDBfnh4yZG&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesbitsuniverse.com/c?x=6LeOic0uvtEHjIC8r9zcGInQFjadS5l4zV/5NqUODPo=&c=MojB0g4IpZT84O9P1PRmpIOQId1oPJA9ZsErorEjr5oZS7bG1cmkoKy1NeFq1pq PvugSZknJlEa5eNT4b2025 YIvPTQKXP913x6nul5i4aslkJkWYdhXNpGkAwsSYh&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.cycletowersvaults.com/c?x=paqqlTeFplKVdaqBUJMMigS9LRnsKYA2CQ/tyfnaafM=&c=i6Zm1Ai5e3Vl/87MXMjE1vElU kQAn/J/jacbc3Qd5cjs6Rq5uvk7ugexyyEOsB3rsnrJRlkWDBKiPUh93r/cqOp4e/jvntVFv6K3RJjWQbhGl0jtBEDeZQW5iDmqjcy&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.signappscapital.com/c?x=dsiblffGaBaqqze34waeiXWkm3OSn8XwO3Ngii5fCEY=&c=z/iyykK6 8B6OTZrEOXYFh3tg3MrCpAZi4JA jF3yo848fmzoIuSPUJHFN3aaMmM5lsrovkvUi11FmBMaIQHe5ybMjtTyrORsMgElbQDRgO8KtwrnKC4L0x2Po2k/v0p&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesbitsuniverse.com/c?x=PfBL0puTqq5UKcWxGqNGvQuA8jtF9lsbsJnJsE2mj/4=&c=fS563WCVwDlZK6HiO1qKwYbH3fvZq6mIPJF61mVDshaLxLQQVvWjNg1I9obxMttVZ7fbWD9DqHIdZSlQKs5GNTbKAw WoLkHjfPbSvoiinh94tJPd4ESxlKtfVW4/iKD&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.binariesbitsuniverse.com/c?x=Iakcuj9lQHjqXW0STUC93J5z4sRh0Pp14nGCN4fF4lY=&c=juEilUnEcd/gLzpaBwXsPxSbGrdcNzlfDzNN8scMtiGoMxKPThd6YEeOrE3EinPzf8d4de8JOYQ6UUZy226X JaAQy0oiXEGELCi8E6sPUMvDmNsHAvUrxvmdxnik0lB&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.