home

microsoft-word-2013.exe

Lomikela

Bibado Investments, S.L.

The application microsoft-word-2013.exe, “Lomikela Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.conecptbodyuniverse.com and multiple other hosts.
Publisher:
Gelodo   (signed by Bibado Investments, S.L.)

Product:
Lomikela

Description:
Lomikela Setup

MD5:
d4800269728f07dd8ae2d70a3e9599f3

SHA-1:
b33809435b237076a898d837c194bb64cf9d2159

SHA-256:
95665f9eee948b8873bb1e9cc465d2c6afa39a22fee86a7e31df0bf1462f93aa

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/15/2024 9:19:39 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.2.21.17

File size:
1.1 MB (1,156,184 bytes)

Product version:
4.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bibado Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\microsoft-word-2013.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 7:57:03 AM

Valid to:
4/2/2017 4:32:01 AM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:txmdsKWEqY0axg2TjCfH5orzzog3V3sltXyTBXWSwlvP:twXUMZEozzog3V8nCdSv

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8728

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 50 URLs.

http://www.conecptbodyuniverse.com/c?x=SoadWExMDUNqz9Inl7JShJS6M6O2TLnRGVJy/2E 2X0=&c=bHhZrVG/5lYbU23GfOrjnpRCNn4c6ITugGt/xsZDGxOhbqW3BF4d9D6k0mF RqI64O jo8oY6i5q0GVt0l1mertiVeM0Ot1qToPRxLqAkXUB0qJYXl5abGdYWQe9vt3Z&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=WrSjUXV9eh9XvI0GiSB/Y7TJfc5eML4p4CVceFFWsrY=&c=mCX09VVkRPIX5tDVpkcWJm51cC6hiaboJrCaxHDizJW36jRDzN5WHxRK4nFU6oVeTppDgtn7j0wlWbl5o2yHYvRS8J10bjh eaQ76ayWXDwrE/DubwUZfrgYNYvJ uV8&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=Iu7ZCtXbpH5pX3dXsPKNj3FH9tooEDWS3SdJLZWl4FQ=&c=ZtNiYUGk0zIHKwSTPXhaZPNosACqkfCibcebX TetoBhpEMWVKtHD D9PeamKzeq7j4BgXsfPk/NfgnDPcskiu4J0Ivc6C76iPvPxkUp8eJo/Jbb0xG28e3SHwFPdJtk&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=fz14ffGeGvZ9MDk8w28U/6MowYYnj OGbwIp8yD 1DQ=&c=KT12cPTm8c2rtKKYPpReWvtXMvLQHLHq02BIgYo9VFcYRK jOE03UJipSv0QuMcpNbXygSzPYiUdKPH6LZ 6oJye/63MImZyLVk6gILzOR5NQfp0h6eCNMdtdbDvrNQB&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.conecptbodyuniverse.com/c?x=HNIySTP 6LnTgCooih1yFEfMKAYzgk6PkShMFiqYf 8=&c=5Xm EPhrMvVxqob5Iet65tjTXX5ahPyxjmilbLVxc4HiNlkcsmVxwM64104UTDOl2iLDrIcdKcli5fFuLdpTCk6JfD6sQ7XA MUl0Y4ILgaw8hsJWJLwPNUyAGMB5RaB&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=yipJSK3vJj6GhDDxTLBPt2fCNezX2n4aufy7A0uiyxk=&c=YdZqaDgg68R4xSb5HxqyPa42ezU/GClR7FGr8RBcCa7xVMyaGM9Dc9OA1rFyc5nEpJ0E59r/BDH9YcBVjbVHuhEwCs6UegtVYsAKUv1YqFInfSemu1OcSLpOS2gGRrsh&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=7pcuPEPdzmgRmZ4kh1WjT x7B25Gn7bhWQghm1jDD2M=&c=8fUQGiew7 a3zLkgezSRb1PLS3GF3/9egWDxrl6mT//JbTolrPs24jRgN0zGbZ97O7mFvB1Afmkob1WpY5PncEvinX/iv042eCYn5soTpLBxW3hoguoYY3OlXTq7IbB &downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=wO1YRzf5zfFgSn2UwFFh0STKffcpj5Novuot SABHcc=&c=NnXZm0S0trvWGut5CIx jgnizAX0jfYnnJMPKzaaEraxGKuK5vf MnBS0L4PDV9sdFQy6M1YWztbRbPuw VSHYMUSN6OYR/kQLGlQ0bAtCab3/naNCpYgfv8llPjwkU7&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=8nrQ NNbNBpfh5IcTr9L33HfoGxDPsBYeE7jWFwPd4E=&c=4C2A1nS8yQYIMKEA61Wt vXG559megcNpgai g0wAgt8b40rE4Zt9U/EHxdoq1IfZjPI0DbabTkfwaluRqgbvjb80US/vj2653Od/4Hkc2My1wBtrBPgQsTqmj9XoUD &downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsupdatemeta.com/c?x= mc4Sr7rO2NAbtGfXO2mAMVoZZ1uQrxy81VFItUNyks=&c=Kdlk4nLUvcw0RCZPehfWm91u baZvZjPl6ajq457xb49RQ82bKtcOwQCTGq4oeMEQ/7zpNTnBc11dgR7rqKHRXGh5QgqTHdnUj8vaPjZT2TJFw9uG8cvLvZnUNd9t9xN&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=MZdlBWrkTJRbBfQzZjDQiQDNWPvxNcJyfD2KixVR9vM=&c=u34ZYdhgb38GToRW3N r/EsRN/FXBgLl0LnWq4J/D4wcQBi/a34oVHPKhag2JWuDNDBPizQe9W20yoNR X woEgrcMAi1DW8o87nCghJJn0woT4UEZBEOFzKRifFopzl&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=IV4k3IxTs1xnTYRaEdhOiiYyIgdZZIDS3cujyARJXJ4=&c=nMUHMm/F5LViXQ0UF8NgZBfdyd1SfkrLJzCWFOsJtup9zx6xLsatSyL1H7vcXlUEf/nf/naZ5bfbECtArWd bzFer3wV/vtGnJqnKvs EKS/0xrJbLYIZGb2fY QVYtq&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=WW5Bt9/sh98d2paCFRFhDvZF1CVJm8AvCsdiop9xs1M=&c=bv66OP23PDcZ0x4Ttd2CTqn ngHxEwUm6d1HBJ5xXl3cBil 6I4b0BFbDt/kjxFhXUa2UTeRD29jY3zs8rD AsS8h6axT1eDM8dVlAaTeYlB3KczCHDB5MXb18mE3Sap&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsupdatemeta.com/c?x=PojrqwRlPwbRqbdsfk32TcM L5HMwFg3cmho2PKrLwc=&c=F0IjodByfFBFMVxQSc0Ugo6x2IEyZYq2bqM1mvVMzxYVbXkB5dIcyuyGCHOQBlQwRiCWSMFrju66Ky24oMjHIr9U2 d2pCGrn6nht RqW7AjX10bLEwInfdSlo2rqlHX&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=rosqDZn7h2NFL51nbjtjljiVkTf3taLzgOzH87XcDig=&c=TDqo lm6PvSwj99qfFcVh GY89iHKELJdK4sUmCa0zSTOaN4H0u9K5X0bE0i3y/sCvyaOfDUokx4g5dfarDEZeX7j0HjRSK2CXQ80EfgbCgS aYcTQ0rjm QuwuncdpK&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=PmiOHahMK1brks HcneOQR2pbGFbJA PTp30Dk5D350=&c=5c1fmlt2eJRW7/uywbO87e8NW3TysklfHqEFjS03gXBre/FaTa6xQhwNG5s/HClb5NamFOmsLv9ZXGAoiDEcVczuYH4QCLj7txfMmY2xwqSpbsIESV25lWhW/qR3DWIg&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.towersbulkmeta.com/c?x=hm8k1eyrsDdaz7PnCYn/X 9ekgX9V8ByY bpgkPwg1U=&c=yuSAFDBDkNlMsq3fhzuqhpqlitcC2zUokYKYvAFMiiUrc51axd5iKQ2tyGnETiEKOanU2fmQFkClchp9V6d2oWWabMmClwAXxfynbWwcjPOW5AmzO5LXu0FI0yII0bn1&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=2UHsfjlnjxCQ AUDwqCPfE9dEcNuWZmCalk6TWruRrw=&c=kxWj9kiM/NqcWRr2LRMXnyDu2OsZCshe885C8DMLMRW5SiJ0Ok2al3CUoh79KFY1NoRtPWpgV2TKXuSb58FUi4y5esJ821jY43Nn1YCdDQMgMfvcXmYSrFdwW4gLdu3e&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=8LAQcMBlHcbtRvVts897OC8aWh6G2DkC0 wnriHVINA=&c=PXtHQM4eV FOJR77YOaCruU6NphmeSjVKdfqwnM2eGCOMLf4VPEN/FPkOUkCr446UmR2dlBlJ9S4amnjCYeq VKZZQDRAePXt5bYN2v6QHGbvWgkYKC5tfdQmjV5IHBN&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsheadcentral.com/c?x=yUgboy8zM6bCIL/QOrP4D0sOIIx4I9AQA/MPC9MuHgM=&c=NnbgQU1dji8fRkOudGqGrRlJSAlQkm aoGb2w4UPjxEHt49CmpHZaHjhlRASAdkD51e57dIxBgk6Lvx2mJxzO8o/0zzJ7o3Rlk37NEvVhJJyQrbZyUyG/dI6RrGV3XNk&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsupdatemeta.com/c?x=InwZPHQaqJExrYYp0FVVzZW9Ea4BcGAqpGjMp1HckWY=&c=I7rZrGo9KDcGZHs6iPpIQ2c1PWnmAZrjIjE4FL2HTavmNGFEE4VVtWyig3EJPy8CpL8Bx6hEZnf0SOLRbl6KIJUrOcXc7hXN6U08nx800MUd8SDSEvSni5xYQUvKWO80&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=2CgtcHjwEMjHVcE00EIZqMHiRZYdLnNAtHiip/E75S0=&c=MZDpJQ3KQRaRulFqS9oys7hPcYdi hmXFGmcVYHGXkS0PT5ULBE7kpc55CkxU mB/iqI aWESbAoBzJhl6xvliAaDtNCFYd4DA1MPzjqOwNgxHDG8/ Vrd3yZ3ycLtK4&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=se/IoS214L3vIiDWO826j pcewwps1IJVdpeSpW0bu8=&c=zNJ6h/NWjHpW3Zi77OEpXkiAqtB6mllK1ZO7xg/2pAedrt7TgNg0tSKjcGlbJQImSDE57Zd97 bk9RNMDiyQTgQu5xLeNL5b8gkjF/827TO5a4unDiCliFwav17T9Ao/&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=qn6z9SGvIa1LLpOeI GWmITml12PTe3bNOs16ourFUU=&c=OmCCCDhzAG4hrZpTS9JgWl G8JDK9G/eKZpJRXkzZY PILWpyBXdqGEgEtTOUJirR ks8mgOV 5DLQHP4Mwm8 6xw/HZ ExvmZfz4hNWYfXUE9vwf8snlsct7vLXIbAI&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.grabsignsfarm.com/c?x=hrUrI6x4KKJvtVLuEJeI8TvsmILWbNhdRTBAm5z7lEc=&c=3ZmeEO9peA13c2Deg43YfBGgdScZ5lpOQqoOW8FwExTl9zofOnS9Dd4f46UCLQ6Nshe 3/F1BbVx8vdjDMdxeXOJswDDFoxLdDGTBrawvos7shobHntvoNMYs/KyWgar&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=GIFsQ47VfB2DHvh1QqhWjDAIfpIW4dsHXl5rdsLW4H4=&c=9GXAGwVWBOZZiGW8sg DKh5yDfuoxLgaEZfZGD AIvB6BuMISRmeFpnZUrWAgFbLiKcg5IiNzSxYlZ/n5LjWuHcVGSVXcn5aGxqnhs1K1Zp/f9itcj0ThkivDodvcYDi&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=feSW3J/GQPRXpBEHzcsJ6XJ0Va5hTpwV QePM6ChJKs=&c=w2tz56CBsB5hfrkJYOZuH1MnNjIq/fj mcwi7puMjcgWodWJi9oWKk0NgTPYJ6gfe9BRjwlQhkKCGh7gDXMjJePWynumhWcJbgvziguBoXYn/XgaK6bilAoXSAGvN0EY&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.vaultsupdatemeta.com/c?x=F6oKKyJ/vBwMTpacRs4i9Rj2tsoh8KONHJE/0utlFyI=&c= pEwPPbOBputL2S0ZYPMUk0NHO/f/yaFs89TA36VsbY2xb8Oq8G7QckTzfQ nJcM8zhgumYktVGOuwcQQMIpO8JIDU9TE65yIYSmmqXUS4t13aNlGyupEl478jKZ/Z9M&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=QqA5e28lr1zcG740XWTv7IP7Jxz9Oi1kfkbqupqUjPE=&c=GZDjEKDWYb1K1KKkdvbTD07uK 7Y1qiy4rBziH11cGM7i/PCetcf0DWN/9T7yKEWsrDFzbnThplSk9Sr3i3FpqpWcloDh SyK0j0uLJT0tUCs/R ygtw9QL pzKoO4Kz&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.presenttodaycenter.com/c?x=Y7SlrgIeNwkegvU1JhdJjVezLgl0O04j9A/lQMPpW9o=&c=Yo81wYWDEC S3/gHL0mtrVBRD0645g vwLQcgaBf5icx1a7tnpChhic7SniAftqwQeycFPTL3N QgS6qmIt3gqR2qYGk/pcMYz8njBYaqTQrtgF Y4j54Tt3jpFJt/0j&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Latest 30 of 54 download URLs

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.