home

slideshow_maker_setup.exe

Icecream Slideshow Maker

Raberles Investments Ltd

The application slideshow_maker_setup.exe, “Icecream Slideshow Maker Setup ” by Raberles Investments has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from files.downloadnow.com and multiple other hosts.
Publisher:
Icecream Apps   (signed by Raberles Investments Ltd)

Product:
Icecream Slideshow Maker

Description:
Icecream Slideshow Maker Setup

MD5:
db628f3327d518d6821b791810b7c956

SHA-1:
22f0d1bb504b9b44abdec955e4d1c8f9ddc93cbc

SHA-256:
5c417c7502af3508a26a098da7170a75e033d48623295bd62bbbffe475108d2a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 12:56:23 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Raberles.Icecream.Installer.Meta (L)
16.6.17.16

File size:
38.8 MB (40,712,976 bytes)

Product version:
1.50

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\slideshow_maker_setup.exe

Digital Signature
Signed by:
Raberles Investments Ltd

Authority:
COMODO CA Limited

Valid from:
1/28/2016 5:30:00 AM

Valid to:
6/11/2016 5:29:59 AM

Subject:
CN=Raberles Investments Ltd, O=Raberles Investments Ltd, STREET="3, Kyriakou Matsi fl.6", L=Limassol, S=Limassol, PostalCode=3040, C=CY

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00E7D54C7BBAE7C81F6CB0A2D2913EE5F0

File PE Metadata
Compilation timestamp:
1/15/2016 1:52:50 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
786432:+AnhCiWPqar/8oidV35P1y54vvzmaN8hh9vajffCI5Qi:oFtEX7d1y56zmHhhOffCIGi

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 34, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 1E, D8, FF, FF, E8, 6D, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 33, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 54, 86...
 
[+]

Entropy:
7.9982

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file slideshow_maker_setup.exe has been seen being distributed by the following 5 URLs.

http://files.downloadnow.com/s/software/14/68/66/.../slideshow_maker_setup.exe

http://dw.uptodown.com/dwn/EssSKEjSi84tkiAx0GLAZ7ZPo1tRAND-RMzrBuvxBE-YI7dmTHu5aHCswU9_My_4A6KCyo44F3n_29BfcjVx35G2888KRbLlg-z1h2WaFKf9BmXsq3kVpVPeX2zS1OXg/qR1wnE2X5Qbyi2WvFUvtR0DfTIOhTU4iuBCPYPnygIDa1q28MkJOotIPrnTWfKxaEt0QQJs1eZgK4xhoOBHvy0VwIhN1eJocEDGcaftCwxNxfpnI2Ty2LLq7qtI0kVGC/hcOYkumELkQOY4Jo8cmGUTNSmSSHkeAOrQszvQ0P2galZ8zF6QygbLYHIey0V-In89JLzV_eOPx_hAi_fUOCNgu4tnp0Zg5W3_tRNnmtvg1pk_MpTkT376Qss31YaokF/.../

http://dw.uptodown.com/dwn/9ADa64ixwIwNqL5Fdi0bMh9IirZQPk5o2ZRPzGTdgHEYKcOUuZkqpBJofYE4Hb1sBY3xto7ERlsh0C8WuQQA4_VoKV9SvoJwiep7e616DSMKkYTDNVOL1oL7ovvYjmZE/SnS8NyR5e-7JFUljzhudKhEKIOmNTXdfJybvSgYQ00DV-WmrizGTlmM_NUguDce8M_H5t4j7S_8BCwIZkRq6cDU0bStv-XCrJ3IYcGKw3DeXY8JcrQhBJKA5wvSmQS7C/h2N-eVFPDzNivEHNI9XmeVLk9ZPc3yo9LL-Bz9MvmFjw6tnDVyeV9eQO9h-FjJouS3l__MEuZO_bFBmNBHXLEuHzjYjCljXCAfQziATDh63Sp7pXuiKaXM0NL86l8vKf/.../

http://www.bytesendclear.com/WVl6OTRQWE5CUlZGWlNUQkpNWFJxVXpWdFVFcHNKVEpHYnpGQloxcGlVelZ1U3pCTUpUSkdaekZOVW0xWVRISnpTbWc0SlRORUptTTljMU4zUzFZbE1rWlVjVWhNVkhGRFRXVmhiR055UVVOeFVqQkJUSGhtTUdKelVIcGlaRTl6Ym10MWFXcGxNMUJwZEZveU16RkZWVUV5UkZvbE1rSnJjVk0zT0VoM0pUSkNSVlJvY3paeloyVnJVblJrSlRKR1pHZDVXRWhtTUVKYVFtRlhTRWwxWmt0NGFHRnZibnA1Y0RaTGFWbHphMmRwU1hBMVpXYzFVRlI0V0RFbE1rWjJTVmhJTjA1WmMwbEdaM3BCY2toQ1N6ZzRWa1lsTWtacGEwRlJKVE5FSlRORUptVTlNU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6WVNVeVppVXlabVpwYkdWekxXUnZkMjVzYjJGa0xuQnZjbUZrYm1sclpHOW5jbmt1Y0d3bE1tWkhjbUZtYVd0aFNVWnZkRzluY21GbWFXRWxNbVpRYjJ0aGVubGFaR3BsWXlVeVprbGpaVU55WldGdFUyeHBaR1Z6YUc5M1RXRnJaWElsTW1aemJHbGtaWE5vYjNkZmJXRnJaWEpmYzJWMGRYQXVaWGhsSm1SdmQyNXNiMkZrUVhNOVNXTmxRM0psWVcwclUyeHBaR1Z6YUc5M0swMWhhMlZ5S3pFdU5UQXVaWGhs

http://icecreamapps.com/.../slideshow_maker_setup.exe

Remove slideshow_maker_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.