home

microsoft-word-2013.exe

Application

Bibado Investments, S.L.

The application microsoft-word-2013.exe, “Application Setup ” by Bibado Investments, S.L has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Bibado Downloader installer. The file has been seen being downloaded from www.heartappconcepts.com and multiple other hosts.
Publisher:
web   (signed by Bibado Investments, S.L.)

Product:
Application

Description:
Application Setup

Version:
2.7.4.6

MD5:
6634a76deb30c0a656945d0ffa806d23

SHA-1:
d81ef1233aa9cddbe15c95102806a3eaba7c776e

SHA-256:
3117c87f2348539fbd0ddb98632050a617abafbb14ed15b5ebba8264d7548e42

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/30/2024 10:35:22 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bibado.BibadoInvestments.Bundler (M)
16.2.1.17

File size:
992.1 KB (1,015,880 bytes)

Product version:
4.2.1

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bibado Downloader (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\microsoft-word-2013.exe

Digital Signature
Signed by:
Bibado Investments, S.L.

Authority:
GlobalSign nv-sa

Valid from:
1/12/2016 5:57:03 AM

Valid to:
4/2/2017 2:32:01 AM

Subject:
CN="Bibado Investments, S.L.", O="Bibado Investments, S.L.", L=Alcorcon, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121212301396FAE08B19C17F8D9578163C9

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:OA2IK6wP1B2S23/pcjqN56HmqUBHXWH8wrtqQCjzCw:OFpdP/2NRcmN5muuqQCyw

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9210

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file microsoft-word-2013.exe has been seen being distributed by the following 34 URLs.

http://www.heartappconcepts.com/c?x=Cd0OgZrgbbGZnVYPVya6AcC/rMIQ BR8yATFabDPGi4=&c=B1IrxY370ikzYAYbupwTKwdKSEE5K3REE1RUVG3ilt7yu6dEa/ldI8G/chNhS4Nriinr7Vrgnk9/B A7h5t7ICgCXZKU7Jk9K5bC32m3/ORsyeg2GBZzqfEurugssV h&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hearttourslaboratory.com/c?x=ZFz7kq6pxjrRjjgIDphr4AYemtJRgBjlRjwVe060kQ4=&c=x4lvwhvJeUw 2lm7dfW7 JGFkimGebNaClJCwFhN3RC8qFQsKiJOMHjkoIZpw6E5i/N5u7B4vynZCto1OjY4cDxKpWF2nQnQHMESfe828hhGBYMbKJ8rvl3lQV0lcAK9&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bodysharecycle.com/c?x=aiwBBockDnL53bomwgiJEWv5YkLZR43eMK8Bw2grXJI=&c=790A5IdMx/eMeNDZicoyJs8bBDipzyBlu0Mj3JUcP9jFLegdbmEDT9LKkVvWFt4vMo1XnKOcQHKWC3EzZEwdUYoGNfniJtBGC/jzh34qqXjpRTVZGbR84Lrs4FqjLtMk&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=GqFsQJ m7FB099BeK4yJT3mOz3ryxGnU7IJHuEGCD U=&c=mBdyRHqks64nu3RsxVJcZEtBSx2xf1es2JkHc2q9MjGyzvUQ1yPYAFcU1wwe3MbnwJadgLDD0fCNt2f1mkDV1G97Xdts7yXTJzX1PhkuLRuE2KqLZh7UADpZKAPa8loY&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=p/VFhhXcKid2OQcwd4YzU itu4zyYXH9VVA0S b8AAQ=&c=2VPmoji8beC5mZLg/yZdjB01Vu7NiugpHWn1zQbyix2LE/bw 6Visit6CMATC7owhSitsoA5q7xX8VIXfuj93rOE9YJKoM/yC0zCQsPuAI8qjNULLNpMqBz376M2otOL&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=HP4hjhFfEod1fD01LgW g6JVXHaiKmp4IplW0qRRls4=&c=n4Yra8jDsfIvC7dNqqF3XtrgOHWGT/QN6n1eqJFPjxH/PIPOXBjMA7S21a0U2DmTOBhAFBzmyji5tf0RG80VuOMlHQCgfr4EB41hdp4EcXA49xxKACcje7clD7UVeD5p&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=v6L QlLhVdglMvhRkR9CfsYnZWtLsLVpt0 ReSifIAw=&c=B8mHrZM71W7OTKijv84ZVarkYZe11uo/dNPVRN0uMi Nnrh7 01r80fqbNnKog5BjkEAS3svVBnClf/3W8ZollKK/CgzBvOIwMCLvXEP7Vc6N/p1Z04QuShvhjYwySR9&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=NAxoqZMC59RX2TgK9pGHRhQUfj4XlmAvbI6KWfImEMI=&c=faF2V92iWzt2Z/XWGXqBbWfKf6ERtMd9ETWRDgfWuKAdelMrCejd8VGvB8hRspA4wU/EqA LufJPx6aajtF0NiQ5hcBtmjLu5CrW37JeJwl6OztHv3N5qyls39nxFbUd&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bundletowercenter.com/c?x=T5ApmLPgcbPs1PR4y/6yJGV89stzj3uee3Vhmv8Bfhg=&c=IYJgtcieuBs4yTezYk3mfu5HSxjdWsUhAqwfn1mPxjKiYemK7 SDYGl55nsb2ckjFuPLRUMOL7LNbyuAEwI9mNLI93eIhg5D8aWVwhQKW4PuKcsxfYDCub VL1rFzYfH&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bodysharecycle.com/c?x=gmDejdgxY672o5ss7VkvZYdIUNc/1kXDOoa0Bpo JzU=&c=hh0XW0yAIkj9Z s3T0v01C0jxK7QkmZXif/glbX4 qtBpMr/C2ygfBg7y78CKQZqlkWGBh1G4SDZv3E7t20H24cQLb8OHgBzlOteAwrl5djtlJt2ifxFh RdGme0zneT&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=07lvkz5blzmeoiJyvCKGsk7tqm Qqfn3ptCXq9tFbZY=&c=Qd9ARNvxTBdNHoRoYzP1e1L5boO rYhtwzdQN0F1qx48JxDrsoLjnSgtOpxXHpnv s0gqB2gq9AouFL9VTEyJJvhGKjOEZDqr1wQjw6A htOTXDoYxQfnE6CDQeQXFrF&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=pwECIbk46q3zkJgVSue6g3xLdxyVuBCBUhbS4BL1FR8=&c=8YFWLsDUPCzEcmajfWyL4sO/lQY1HzGQqtN/h6fBNVWPR8uLycAIm7O9rTYrCpDQ nmegHCskUGal B1RZ7TK 1W/J/a7RKcz 2k1JCe8nfSbDBVLose5RJfwT/d9Naq&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=PTa4Xop/0juX4OkRrbmqPs5kEEan0aGD/MUYaFonMkQ=&c=H/nkkhK8t2oY3l3ic0At2/2//gOd48K3eaDuw3U8eMZmZe8ZzOQEnNNb6MPs2pynxS/ITX43MwNj47Tk/Jtjju c4vQ6NiBCPOuHqi1PUGyqdIyDugJkdj3cLDjw5o8m&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=xguo7RJ3w3qXNPlj0xvXlRZyEoQ2O4vh3GBmIaj2Eoo=&c=eAz7aX3/Qt7C/UUASvq8zM8SftZPHWLA2QvHZhIgRNKC2XFkbs4X3MVm3SZAq8/LXH1mCAdY3fgNXZUZKmdZcLUnmobYNze8JzwQVSk1ZC VDZUKwrZLWaIa4UY5FrbL&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=GkTYDRbvVGeZK0tDInZZoAkX0y9GR4yte1r2CCvkatQ=&c= CzCp/JfgBX6WMvtnY2TjaQjMnbOoECxjKFGALlZCXrM/f5qwu3MkOJdhwmJuAFIfgTVuKPw4Y5ajfSDZ6fzjz1XbviTzrJWyBpM2A5RwHUf6rnAy Jl9sDi1FeBe7dl&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.heartappconcepts.com/c?x=quqM/i1DgVNprbc6FCLsjWdytL dH7PSCyHDxl4lXQQ=&c=5kWijF3N3qjEOnYP4hPkEz7E2Cpx8DRQqHv1kNBjfND2GAKoobbRTGwYEqictpJGSotamNvjWyAv152AY8DPcKPbPt5ICY/ 2dxAZJ8I3YKePdnhRU57ys4O99xbJnIU&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.filesapplicationcenter.com/c?x=fqHPFY3Dr 9jiDvagscdg yI2ME4pWUMWlN5KMHHrQw=&c=1cCr9svQzce/CHWJcgqEYVQ6kCqYREoGm8dGgt6XDb43avRmi0Mu4L1qcM3rgiGWZc4bC51oBhndUmIimAvB434VyunfB1fI 2CCsa2LBffgA Z1j6/e578Z1Hk2JoA8&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.filesapplicationcenter.com/c?x=S/fBVIpwFwXszvRgW0zqHYedzl/EC7VDq9pMM7XeX8E=&c=xIMMmFf1nDtS6Hm/O22de9oTldu0oz nLfLBS QUAx8c/QMGVCi36fmcnXWqe0jJzSR/pEhRVDsKm6tLQbzhqyeomGUlPVXhspPPFH/JgT35O2kZuMGKmuwwfWxAbI8x&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=aYbBzbeFbD6WJXnZBwXdCciST6dli7juDXsv Nz/B9o=&c=jXpO0 0vc2FQOr7TitGYI85SJXRCc28O5NvyqADubJR3Bmc0ejHnZOtD4ItdvN536dFrkQfl7Skj4VmJWx MHwg/fGexXSBg8Xk0tN1C4KBfrgea9N7bUVWKXB2yzlMB&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bodysharecycle.com/c?x=uyVaDCevgHtv1WVyUR/vcfxwzjVTgpW4hBBQnPN Yis=&c=3wRS5w9j5hbnoezF6PHaxt4IFlN5tSo0Ls1UfTE8Lv T09Xp46PSJKZbi5ciKStM6 uZxETLJwmIP4KpM7idifVI2BDGCgsznlBOwSyCqQnA6f31cvu268rdKdR39d7i&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=Sx4Z7AiEifZ4GyttrJ4UtjrJ39M1vk1N1rs9JQLP1jM=&c=DoHzwQeoSv4pAQTZeugFWio4g/Sa4NGMXpym2iZjU7e0IhXF7zSpzst38WpSl/7kksR3zZBWcj3Rt5jyFybI8TjPFJHcnpjSZvijrqvOKAb12S2xZXy 61WiKWSIsSPc&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=gYo70g4LkyQdIqN5X8bLZG775Jd5PkjRrmmj84jBLzw=&c=KNmP6EBJAkALTf/S8A7GT25xPvYf7D M7odJQhegzb7rJZODGtRaS5uF6p/oI1YvgKieAahJnzNpeNDKCr5lEWFQ8jJ3uNsJ3DBG/l2dn9tSEDekffBfSmRuAduP rmW&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=vS ACyYEU4rESWOAvNSCSKUwia6w4DY2EESM5R6SIvg=&c=Z3WwaEHJ4P/8vrH0J/vY6MhV1b991f3QPWlLFMUJfO1JPtqguvwYNf nkWVl2PnS 9S20TObrKqxU NcpcwRrhwjvwU942/INoA8GdQn4Zv MnrTJDglNOb8N1Hx5Jtc&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.bodysharecycle.com/c?x=diaX0QzSvpOxIo3v59m Wvy01sYnd8MEP/ 0O5VBC7U=&c=7NvsuL28ZUMXrO0s51JjKgyWb9P2mJQkSxSDTEAB1241Fk3aF2YsWxIoO4 MfBwlUGlmzH7wKUnudSu9tBSkvVQyIzORSRhfTSHZ2/7Lw1A303TRMNK2rww5kJBauYu6&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.filesapplicationcenter.com/c?x=k62lE4RxIVCHEYJC oQMLzhYVljDs79u7EA77a6Nzhs=&c=CJmD6xRTylKDXsA8R3u aVvLSUbH6Q5UV7WnPKFmezOzo8nrIgFwx2RiD5iPZi Hy/wuYGUlMyIvdgUSEXJRe14rBb6gGp1aUY/vhn9Qo/L6ytVQEWtW5upSHXGsfnNu&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.filesapplicationcenter.com/c?x=rxnw/xEe2ducvOIPurWgCSgt5aA3f59KwHKfpkQ86Bo=&c=KySVFJC0l6rqgntkER2rCCGT3aRzH6z5KYTgWbYT B8z J54QX1TaktNvEzhSQBwpycuatP5UZEiC1gW9Xrz0OZ HRRJ7PQ0483XbVUBsnIFFWYeICI/wr1zpFGlMcHw&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=c7gS6WA6Y03ZMIX9iY7S8L3o5X5sJgGtxH59MGvp4mY=&c=KYF42F3Axy1wzojbga6/TaTAKGhud5/b/pDzcbVIfVGDx0XzcaAvf8qobxsKW4JAWbtRnKgONehUnsbJq3Aa2u2BNi5NJpaTNetqmT/E t28QOnzQGGOpPyNY0Xn8XMd&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.hearttourslaboratory.com/c?x=I4wmcYwK qyEtqROKweqVuLwpg8oIiEtFvKqCSQePSI=&c=Ri56v3qvjmyedWZkFKa5T/O biPm6AATOrObsAWULPta7vAIQeelL24nMIzlnfVQCmYr1B4ddChjUNU5qWw qm33F4tJN9kjRH/VuWiAA1Ngkjn8rJBuHPvaJr3S61n&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.applicationbundlessafe.com/c?x=W/ZJgYTCTlDNfKiuLy4mPC8JDZnqdknPD3lXgcNFAQY=&c=TC74Pqr/8gXF9U0u avSb/WLGNs3rXF/5OIr1JllSRH/nx5is0KH2l01nBmHpgWdxWRNfgjGd7g7Wj3ryPYl/XJgcY9gUnikNC9iG9u7KpD7XB92lQG8U4OctJGatzVS&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

http://www.ranchgiftconecpt.com/c?x=M2hV1VRsOqT HB1OWleKWjtpVkRthbwBjBQnczs9fDQ=&c=m ZpcZrYCxp4Kh8NMWyX6bQdBpKKigxn7CwHFr3ZXiFB6n/XE LX XUVucj797/W2Ak2ZLbc Zhq8uDy8LwYx/RDrxzHexSpYtWC6cXf4f2y20W54bfALyZ gc R0Otp&downloadAs=microsoft-word-2013.exe&fallback_url=http://office.microsoft.com/en-001/.../

Latest 30 of 34 download URLs

Remove microsoft-word-2013.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.