home

mp3rocket_setup.exe

Application Web

SCCE Development Inc

The application mp3rocket_setup.exe, “Application Web Setup ” by SCCE Development Inc has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.mp3rocketnowbest.com and multiple other hosts.
Publisher:
Software Internet Installer   (signed by SCCE Development Inc)

Product:
Application Web

Description:
Application Web Setup

MD5:
b8564825510a0bf0d33b111fbe9d1f22

SHA-1:
023e647d5c69aa5cbf74084a7a08c8a59d4ed5c6

SHA-256:
a23efe9a6a275f0958a3a02e07d55552ffb378e2c6ed88ba32a0a789c6668367

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/14/2025 10:57:15 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
PUA/InstallCore.diur
8.3.2.2

Reason Heuristics
Win32.Generic.SCCE.Installer.Meta
15.9.7.20

File size:
1.3 MB (1,345,536 bytes)

Product version:
2.6

Copyright:
Web Program

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\mp3rocket_setup.exe

Digital Signature
Signed by:
SCCE Development Inc

Authority:
thawte, Inc.

Valid from:
2/23/2015 7:00:00 PM

Valid to:
2/23/2017 6:59:59 PM

Subject:
CN=SCCE Development Inc, O=SCCE Development Inc, L=Lehi, S=Utah, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1FEC5D7B86418BE6C86668F0B194584C

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nXqVEqtAD0jWqvn8r7s4nfEVaG9YCu13pXJ1COE9pxLfnofjZPbpcYuIlhCTm5PU:n6VEwOSRvn8rhnfy9YCu1/YbnofjZPt2

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8762

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file mp3rocket_setup.exe has been seen being distributed by the following 7 URLs.

http://www.mp3rocketnowbest.com/c?x=4xg 6TvXeg01yi/DlGIpX4rF51hKG p2/zq87gwpd30=&c=iEOr1zvcsNWpnmPkjpoRg/2hDslGXnFsqHtYoiem3rWYUiMGNnmOv84i3kqAf6RGwvpgJw0jH/UtShSh/KqdbeOWgkf0Tc2DnPfSA/mbpWoCBwUcovHzWcAr99uHwM4/lJOkVVXWiGtv enyeA2hzpJIFRkOo1Fsy7ck66FZAtg=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://cdn.mp3rocketdownloadfiles.com/c?x=bEG2Entrn8n9BvZUXWlY0E9DfJ0Xfs5PepVlY8dmL1k=&c=kb52TrxWGzUIl/74Z8rVLIT5PyLG5NbDX9UGrJe9VEYAAM9utn4UBRBuA79WWeXAg9h7udSpLpnKtqBX5ht8UB1shx6vcywW0CdM08N8Jk9Q3Q7JEmUJMtL3FNr8pxcrBelQ06K5WqpXxPQqH1jYAEw2LPmu814hDvdGYQT9DKc=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://cdn.mp3rocketdownloadfiles.com/c?x=P/ChTmntlEPk6m0MF4jH9z5cKeUrXpxymBsnVGUe6Jw=&c=f5K3YxGrzQ7WpVfZlyLCCidJFexKuPg /xPdVWu oKzqCh1/rOu7dgFohY0rEy 64CLMRXCywD3rpZcngdYjIx5ntFht09JFrv8TF8aG8TBtKYVoVBer8ymkfGqL0h3DN01ww3aHguLOdMPS/B37ORf8mnXXK5G2fJ1 sGinic8=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://cdn.mp3rocketdownloadfiles.com/c?x=upe5iZgX4tVXu iSTAE9o/BzwWi4rqtlp2hY3ivDZ9A=&c=wcpSFfsg1/ZuiC5E3mcfomhkwThRoB5PXhw2P4dotWukpUlPdC6Gs5TLyBUp45h/V0I9SySCNkM5sTgu4ic P5B7Fanlc9j00xuRIndoH0gSZ46laug2Scc1iRIVCi/yvzi52cQT6e1TES 2GEvyyA==&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketconecptdownloads.com/c?x=LeZR19utUaLXrie47A4oNKd3J86BlsVJEH23P9owsM0=&c=qgtA/hqh NYR03bBgiy9P3XFV0sdXmCBrlSeFpaQgp 1BcF4zAOmQ3wA1EnoMpWcCDqEY8pNdUrc4DMvK1TUBKL7552O8zoQB1qgKgqgC/Rw8xpPDTQgmsZpSE56LhATmeG12 oBPMFVBKgej16VXg5qLqcIskpEkOm8Z67XG4=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://cdn.mp3rocketdownloadfiles.com/c?x=3dzSqt7OPRKpnJv8OevLCspOGdUr/q8rFT vbFMet/Q=&c=eJkFqAD8UZvl6oH/p2YX8RE6ARJKBvKCNw11vsdMtLXspjgXKDoGFgZa8Uq1/4R3Y//VWqsCNZyRNCdKk7lEuGkjHNhAxtJGU6SIvwAwFiflTqbU1F0L/NArBR219re/IyIM0Hqz57mNJWTT/ay083mAqCnnMuvqntV4 9yDhCU=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

http://www.mp3rocketconecptdownloads.com/c?x=66EyP5SG4/orutpdP32qsa7D/j nhYADBRXa32uyd5I=&c=rZlLUtDtkotdR LcpjeLHVtDrBZcF5uKqVrVvU8N8W5H7k7OT7vc6IPEf5I7NuuMTXxYX0 1tsS0u3AWh tCdWY/jacDJeKBeSqOJ6znHbYsmBkQGQ3yjGu7NXJnjxEhIqpg93 yOuon1daHH5pFBcSlDqa68IF9wMANt / Pvk=&downloadAs=MP3Rocket_Setup.exe&fallback_url=http://www.safefiles.net/.../mp3rocket.exe

Remove mp3rocket_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.