home

microsoft-word.exe

Hibepako

The application microsoft-word.exe, “Hibepako Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Hibepako

Description:
Hibepako Setup

MD5:
4112155a59533d4980bc1b561b7f0440

SHA-1:
cc77fd56095b3056f0a7c4dc9227740ed514cbce

SHA-256:
1d2f0959536e5d632adc683dd24abdfc1013ddf912bfd8851a49735955a256bb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/24/2024 4:43:00 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.4.13.9

File size:
968.1 KB (991,313 bytes)

Product version:
4.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\microsoft-word.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:gIHkAQqfeqq6g8thll4DJld6SHuhIdx/NHwu1QnhES:gQHQGlgg0JSSxdxV3QhES

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file microsoft-word.exe has been seen being distributed by the following 13 URLs.

http://www.towncyclesigns.com/WVl6OTRQVUpCV25WRVJ6bE1XbTFPY0VjbE1rSnpTMWhFYVZOR05VWlVhR0pYZDNSbVlVUm5ORGx5Y1RsS1VXSkNVU1V6UkNaalBXTnZWVE0wUzBselQxcGhWaVV5UW5KRVpDVXlRbHBMSlRKQ2FuSlBaekZHZDJ0UU9IaEZXRWxCVHpWd1dHNVpXa2RwSlRKQ1dsaEVkak53ZEVGQ1NYRXdabk5qT1ZOUlNIVnZaMFF6WjBobWFrSkJRamxtVDFCVFVYaEpOMnBJTjIxc1ZGcE1ORlpTSlRKQ1RIbHlTbmw2TURZNGNsTkphRGt3VDNoM1NYaG5jMG80ZWtaQ01ua3hhalpwWlhkM01FWXdVRlpxVWtZeWN6Vk5jMUp0ZDJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWkdVaVV5Um0xcFkzSnZjMjltZEMxM2IzSmtMbVY0WlNVelJuTjBKVE5FZFZsTGREbFNSRWRmWVhsRGNuVllkakZSZFVsa1FTVXlObVVsTTBReE5EWXhNall4T1RRd0ptUnZkMjVzYjJGa1FYTTliV2xqY205emIyWjBMWGR2Y21RdVpYaGw=

http://www.conecptquickrepository.com/c?x=2T0aCm5 m7pNoS8L2gjuutzjK1FxAbP22t5sC1fAV1Q=&c=uig/NtzQAxy5ZKNXq7cN4SPu5V8i4GuW2/Y0EE/OZE5Ou8fJCJXB2waC2LjlXj528akJgQA0ow1UhkRJat6P9uuEClCId1lIhLkPoO9MFxoTXnFVrQyfwEMLszVft1asLHG194SZyUkkIeNNb 0OKqjU890Eh7iCp7soguSKho7 RSSnlwmIiQ2yO9x4vWd2&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.towncyclesigns.com/WVl6OTRQVUZFVWpSU1VWWjVhMmNsTWtZMEpUSkdOMXBNUVhwbmNGRnFWRlpNTlhock5VaHliRWRyWlhsR1MyTlpaVFJaSlRORUptTTlNRFZzVXpkWFdGbHFTblUzVG1OV2NrZExUMWR5VldSRE9HNDNXRzFFVkZKakpUSkNOWGxLVGpoRFpXWldRek4xVlVwU1ZGcHJZbkkwZGsxbFkwVXpXSGRoZVhseVVVZDBUMU00VVRWc1ZWUTNSRGhCU0ZOS1NIRkhTVXByTmpCbGJqbHRiRzBsTWtaU2JYaGpaMUZSVkdSM2VIVTNZMU0zWVZaRGRWTlVUeVV5Um5WblprOVdWak51YWxCWGNIaExOeVV5Um14M2JYaFRiRkZpWTJjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWkdVaVV5Um0xcFkzSnZjMjltZEMxM2IzSmtMbVY0WlNVelJuTjBKVE5FZURONldrZEZhVkJyZVhoWU1HbERSV3R4U25NeWR5VXlObVVsTTBReE5EWXhNalk0TnpZeUptUnZkMjVzYjJGa1FYTTliV2xqY205emIyWjBMWGR2Y21RdVpYaGw=

http://www.towncyclesigns.com/WVl6OTRQWGhpVVhsR2JtOHhaRVZ3WTFaM1EzTktTMUJwTURCQmRIUXhSMmxKYjFNd1dsWktXWGcwYTNkb1REZ2xNMFFtWXoxMlRqVjFTMkZOTVZwNFYzcFdWWGwyYW1kSmEySlNkVWxTYTJwUlFXVnNWemxHTlVOc1lWaG1OVTEwWWxkbmVVMTViSEpOVkROSmNsZDJTVVJWWmxOalNuSkRTbmw0YVhsd1MzVnZaMjVqYkRFMGJrTnlaRWR3TlRSU2VrVm5kRlFsTWtKWGFWbDBkbkZyWjFJMFFqY2xNa1oyYVZCMFoyZEpUVmh1VFRZd2JEZDVaRVV4VFc1RlEyZGxSMUJHY0ZWdkpUSkdaMDVIYWtSVVozY2xNMFFsTTBRbVpUMHdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbk5sWTNWeVpTNXBibTVrYkM1amIyMGxNa1pHVWlVeVJtMXBZM0p2YzI5bWRDMTNiM0prTG1WNFpTVXpSbk4wSlRORVYwRjVRMnBmVGpGS1JHWnRZa3RqTWpsQlNVbFZRU1V5Tm1VbE0wUXhORFl4TWpneU9UYzJKbVJ2ZDI1c2IyRmtRWE05YldsamNtOXpiMlowTFhkdmNtUXVaWGhs

http://www.towncyclesigns.com/c?x=DMQeik0q1Q067YYAuoc6skXiL1zg0U/KDb3WxFWHk1k=&c=f2NG3/2kn72X7n1Kkrufa2OSeFgyRSS5NVrMfjE/1hGM2EseABjeJbYJygbBOGjqpHb6/F9O1QUWWPx 2t9YnQGG7GNzvTdGNOYcWVj231g/FFEycO cg7w8TT0dsPwYH2DW0fNnpykI4nNsAeUhGfLznHmsXAU9bAz6j0UAfqJB2HiOYExrc/BSzbS3hFmB&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.towncyclesigns.com/c?x=fB272MqOxQNTEt0MI5B 7klMRFyPy1CviRGMEIPvl/Y=&c=lqWwTIleDK2QT6bb4mhvi1rsh1sdrMYmOkrOj04b8gwl8nDIsGQiKSHptDznpIW zE pksRiIYLBxZ41wAWVAFBiL6UsFgdinuwroO tk0FY/vBBZ97ab3xm85GSIZLkfZxoWDh8ixQ6E/piA7bY/swh7E93QcEGDcno78g G5dlC5hatHDzYhh0zxShu95U&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.towncyclesigns.com/WVl6OTRQWGxwYTBGbWVUVlNSVTU2Um1oUWVuZGxhMHB1VEhSMk1YQTVjMVJ5VTNOT09YaG5jbGhJTVdoM0pUSkdNQ1V6UkNaalBUazViREJFWmxGb01sUlBVeVV5UmtsVmMwcHBPR0l3TmxSdlEySndSSE5RYWxjMGJuRnVkRWczSlRKR1pUSkNUVEo2VWxWRE1GbDNWekZJUTBkT1YzUjNkVXB5YVVGelpYcHNkRlJUTTBaT2JsRnhSamhpVHpkV2JpVXlRalpVTVU5dU5WTm5TMEpyZFdwNU1VZFFURUo2VVZSalozcFNXRVZJWlRsM1JuSlFhVlVsTWtaWWFtWjZRVlZqUW0wNFpVUldTbXBtYlhwMlVpVXlSbXhFTTBFbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWkdVaVV5Um0xcFkzSnZjMjltZEMxM2IzSmtMbVY0WlNVelJuTjBKVE5FVWtaWFNEUlhWMWhhWTBzemNqaGxVSGRaV1RNNGR5VXlObVVsTTBReE5EWXhNamMxTmpFNEptUnZkMjVzYjJGa1FYTTliV2xqY205emIyWjBMWGR2Y21RdVpYaGw=

http://www.conecptquickrepository.com/c?x=HltSPphwhCPZxu4IErLkgUNl5UtmCAy4O8PN4DLYj3c=&c=T8rW G5rCVGDD/WovUBteXVl l9CLKN6HGk5UIQhHBomPCzy7tYK/iI0OwQrEds6RekDh93GUCDVqDWs0hhFvoO7Z0i5NTkcZC4cT4k247GotvCTPtszgEzkdVd aYpwpMk3hGXi2HrEfVh/Q9ROJelIOyzjuExgsXNZJJLHhnppQ0rJG1Qgq/LT3 sh JGG&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.conecptquickrepository.com/c?x=kY9gat9DeiKucuXqhH/7pcApuaCbkloxiXpl1W2h6gs=&c=tkBF1d4hZoT860/xItbo5TteigwRcbtdmmaY9DYk7Zk0bVYJz71 eFDAZkQoA HoSL4WgjKMHr/RPFeaLbR ydt/fgoPvWrgGaea4VholZESlBhmxF1ndNd3x7Q653Gtpw wCzn3rdFLCZJI5KCpEtZg77T6oJOZNu9Tek1w4MSGA95fyRKtsYeFR5imPUqF&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.repositoryuniversegift.com/WVl6OTRQWE56VG5jbE1rSk9WMFYwU3pjeVNFdDNUVVJvV0ZadWVFRTNSWGMzY25VeWIzQjVSekUwT0ZKVGMzSkdRU1V6UkNaalBTVXlRbU5HYzFkbFdHTlZNMlkxWkhCSVkycHhRVUpCVUVZNVRrdGlWMU5WVWpSdk1GQXhaVzBsTWtaWVRVeFRjbXQ0V0RCSVRFWjNWMVY0TW1ORGRFaGxjRlJyYVNVeVJtVnlXa2sxTVZsR2VrOTRhMlo0VDJSS01VeFVlR0Z3ZG5GU1IyZEpKVEpHY2pZMFJWbzNSVVIwWVVsREpUSkNTMEZKWVZOb2FrcG9SR1ZHYnpCeVJFOUVPRGhDWmt0M00yRnBZbkJDVWpWWU1XUkRkWEZoZUhjbE0wUWxNMFFtWlQwd0ptWmhiR3hpWVdOclgzVnliRDFvZEhSd2N5VXpRU1V5UmlVeVJuTmxZM1Z5WlM1cGJtNWtiQzVqYjIwbE1rWkdVaVV5Um0xcFkzSnZjMjltZEMxM2IzSmtMbVY0WlNVelJuTjBKVE5FVmpWbVNIVnNhbEZ1UTFSU2NuWjVTbEJrV1dJM1VTVXlObVVsTTBReE5EWXdOVGt6TlRBd0ptUnZkMjVzYjJGa1FYTTliV2xqY205emIyWjBMWGR2Y21RdVpYaGw=

http://www.conecptquickrepository.com/c?x=dpqTdNbP3mLIyWd6YpBB1uJZcOW0swf3OIGfxuZnYa4=&c=0BQtuJB/5gbIeX1 XMJ4Ww10b/El0rzlDCZQZ0Urh3ElwQufS1ZU2LB46CYMoNgYATG8FJgikL9V4Hvwyw3yyQnd6NUAnq46z05sqgzdRP5hMIGr69 zakObrhfgoNQrxzsuP9ZZ2f/2rNCV/cevjCuRZZaxFOnFVyraCIsD8 A6FoK UH7mhCT0EroGi2UO&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.conecptquickrepository.com/c?x=sGs3MZBJxOKVSfqPzM7BAeChfrgNLCz1klN 3HJROdM=&c=YcUZmbjzydHkJlk1jT8fO67lhrHFbDHqHWzvAb5NCdEy6dNzyxgbpuWCguoJ9hCQwRSZ94h7pniS FjJAFziTCg4YyXJS8QdY0GUYuKFhzGnUw8Q8Aiv8w5bck3XU s/ULlAXRb5KlOtH5uaaZoyCeKHtvK4luBCvh9shJ9KcP9ZdYH2hkPxUNeoeJY2vZn9&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

http://www.conecptquickrepository.com/c?x=qiJ2AjP7ZtihEtf61uhSSGE4EVKFv 6Ji X1sx 8kX0=&c=IvynKpMjLSv6hPUjBvWrVsLOua1hhNRQ6dAINcMxm8j2bODWVOCXidYVGZL7x9vnn/cyItB dJRFtHAi2x1mP7SZzeEwpXKl NtiU6QEmxb9kap jf6D phIY LDPR5j p4oZumIjbPrxrxVJbL4uwWGNCKf5PH/1igc52g8ZhDEougWsfYOQoOr/VbppFw&e=0&fallback_url=https://secure.inndl.com/.../microsoft-word.exe

Remove microsoft-word.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.