home

songr.exe

Hibepako

The application songr.exe, “Hibepako Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Hibepako

Description:
Hibepako Setup

MD5:
92359b10535539c2e1c2259e77b5babb

SHA-1:
38e8e5d282f312449d1311d99b648ed24cabc939

SHA-256:
b70d1a7220d723c4c7acb738aa69dd1bc8d535c57680d94f96bb014d8fc7a004

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 5:41:04 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.4.13.12

File size:
968.1 KB (991,313 bytes)

Product version:
4.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\songr.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:NIHkAQqfeqq6g8thll4DJld6SHuhIdx/NHwu1QnhES:NQHQGlgg0JSSxdxV3QhES

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file songr.exe has been seen being distributed by the following 17 URLs.

http://www.towncyclesigns.com/c?x=/ 2FBchEXCrmwo56CNxqEdR1aioS64Wz9ztt45f41bI=&c=l0JQI01Ia9rFFDUCBKpQHDfLMlhM/cc LBiW6apHs6net XjL QoLxBZmvsCqKIEYl 84mTq2p6 n9si7Zus6ib/Z9oIk 7bAotfviR3rrKH RNN5VShJQhI7BQxX89Q0LUyo WEsiJ6rOT cGeCLIHkH4ntUNB6MsOYfZYAj0ze5aksfL82ADfoCUYQV/V&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=sOoTW6q1F3TMUA36zMx_tQ&e=1461277644&downloadAs=songr.exe

http://www.repositoryuniversegift.com/c?x=4Ud1YniKQ3 iI8aLHE2IHRoOPfd7Khq0ok2Ka0Wy3Y4=&c=j1MQAm8Ntzr8pkorpwOqHB52ijjmtPeyhx2kZVGTBp5GHvXNyEZ4sSW6FKo8TUnz8mSbkoZ2SgoZeXpVyY0d6HzG1oWVMdtecTqC/ZbPP7FqhwIsrplbyqu0P2t8WNGFfLZ/FcJ3Wzs58SRXVtOYLIlxKMJKvsO3Z1okzVC2qhq6 NIGzfyXKPcg3q/Df7NB&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=AiABXQBHJFaSlp6LmWurvA&e=1460594615&downloadAs=songr.exe

http://www.conecptquickrepository.com/c?x=l fW5GARf JhYiWvGePkUlk/Zwk7mQyp5MTBKOvD/UU=&c=/65eezWXIkFk4dwhCCHJHhrxuZU8PugJkXXkiQezjRFUm2xiqmn856ZfAjhAJ3M2aHxI9IB8BOiwrucfPUKOfbueJaTRrePDADNjqGo/0omYGLQKHAWenxm85Nz8hccN6SbbLAw39rP1GJ3WBIOtOCX5HpqFW72FrVr8y0nmIMrxbBdCFsRGY8HXYNeUG/fX&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=bztuRiz07uaiy-3nDBaD4A&e=1460668874&downloadAs=songr.exe

http://www.towncyclesigns.com/c?x=h577N03bnfS1LeA A3JAoTedppECW1oWZ1vvuBmxVdQ=&c=zpAvkWNZ5AY/y1MMUAxYYynze9Qa9PeZ2EeNnx5T5TpmIKUzQEUH/drTrQG/Oirh/QTBRj02fLRVgmHy9VC AtxNaRzPkrQraBWK1wtUM2416aB/ECqcpqi9AMhElU3yQ6B9h59jRTSCcuZwKqpW3 dYUmrz8H/1EnPN4D3upnnkYNmrfGc1fNFYedWQD2da&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=LtssIyPb8H55LVq8nf7VvA&e=1461257408&downloadAs=songr.exe

http://www.conecptquickrepository.com/WVl6OTRQVFZ5U1ZoTGJXRjRPR2h3TWxWRk1rWmlOMDVtWmxBeWFVSmlZeVV5Um05bE9WZFhkV3c1WkhoMVJrRjFTU1V6UkNaalBXNXBZVEY1T0VSSVRtZG1OM0pFVFZweVltWTRlQ1V5Um5kcVpUUWxNa1pJYkdGMVJGWkpVbVJJYjJoTVFXTmljVXhNZG0xYVYxSnRTa1Z3WmtwRk1rcEdPRXQ2VVZaT1IxQkhkQ1V5UmxodVIxVnlPRmRuWlhkaU1scEJjMU56YW1oM0pUSkNKVEpHTkhnbE1rSnZlaVV5Um5WS00wTXlkMDlLTkd4eGVqQlplVmwyT1RaeFp5VXlSazUxTkU1WmJrZEZWa05PWVRnM2IybFJiRXRCYWtseE1sVnpVMUVsTTBRbE0wUW1aVDB3Sm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3Y3lVelFTVXlSaVV5Um5ObFkzVnlaUzVwYm01a2JDNWpiMjBsTWtaQ1VpVXlSbk52Ym1keUxucHBjQ1V6Um5OMEpUTkVlREF3VTBGVGVqUnFkRm81TFV0ME9YZHhkWEF6VVNVeU5tVWxNMFF4TkRZd056VTFPVGt6Sm1SdmQyNXNiMkZrUVhNOWMyOXVaM0l1WlhobA==

http://www.towncyclesigns.com/c?x=QBTYGcYT1T HsT1P2y/P4k9PsEAkmQ8DSIHR6bx4/xI=&c=LaN32Lrtd81jRBVphJspDhHmyyAsgaqTIrHFjx6 Tyb0F0zpAwDVZLxsKQ2oA YWxplYJIOLBXWQv8Nmwe3FzCX3e/c J4E3MHObqjN3/gku1EUPSvLAZ1oRZxrTEmFPyboAdTa/yvxS/BcZK//OHTbiAg1F5H9btvW1PbtuLEANFDp8VcPj8O0COeIKedd1&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=R8wgMvJTV9RfoFo25RJcbQ&e=1461297875&downloadAs=songr.exe

http://www.repositoryuniversegift.com/c?x=MurT4dui1C1CSQo1FJIjvYAPrNH2qFT45qFqoaW0l6Y=&c=pKKJ0dtqp ZNaLJ3APEt0Qr0k Yl88rOrF95JI0qvWgpxEdb96MohNVWstdAlZ2WyYGU9K0DwF46RcBdLHvZbgq3WSK8B6fsAMovXCMgW7UzVymVXr14fvYvoyYWQFzdIXKmFaFPjeSwshvtnIzRfW/5oDxAGXpm3LiboHMPsXdm0yrtPa/jPNg2BsZfV/f5&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=o0RsvhcigczPqbalUhQjAw&e=1460587911&downloadAs=songr.exe

http://www.repositoryuniversegift.com/c?x=MIt/ 9wfapv/bU3IS/vg4rGpBmP8uZUpaZ0eEbY2HmU=&c=V7tYiDHlagu9mulVkU 4l3K4N qJTL3EI9pq/Z1Q64YlwKF7lsrltCnbPaHittoe1RS4YiDPVAIV9l5Rmq5gLAiNWAooZ8lVPxs2oAmGfO6cVgdn6YHb976Y9gVHUWMGgRddpJZ qmLO5qz vNQgxQnh8cg5tUsJJquJofVYFnrXxP j1alWSqFhgC4iNyqR&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=lE8usHKf_rpk47jJKqvB4g&e=1460596766&downloadAs=songr.exe

http://www.conecptquickrepository.com/c?x=x3Mey15n6jciJ2AVgUabiC1anoHuqq7SpuJ9CeFfPGo=&c=bB7Rp190N3u9ZFDdEMVRASmSlFTWWz76fjj06mLHIJEHI92y8d9mKIMVQr7rgOBHppXCXKCOZ47N2kho9tghrXwyF1xsAJM9xDQzx/b85t5FUKnKU56zpNmfCMH2gDxKLnX3IAZDCAX3DSDLSqT7IZsuKkoC1dcp7ailkfVJgCSH9EV4r0KZXKmu/Xxfbj9T&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=yZYfuw47l9FyY6cj1bKFHg&e=1460684211&downloadAs=songr.exe

http://www.repositoryuniversegift.com/c?x=C/5mEyYnLkenOZm6ZJE486Vb7eY4k0ZKgKeVvCPqhW0=&c=TgViMKt72g5ApUWsni3znU/aXLovurbBliVfJch2hgLe0Xftg1T6Le2nGSRkNgdo /7pWU9f6ixdg2npldKvGhdq072zK mFVki8Q4hysgDnbl9/GBRiBZFYcnDi2jjx FCH3i5RWbMtidC7K4PbBeUW/uB1WrTF2XEyCdNp8fcEDfcAV7zMRA9S0LMod e3&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=5rB6MK-XhtxSm5kUJ69GLg&e=1460598803&downloadAs=songr.exe

http://www.conecptquickrepository.com/c?x=FdGM3BF4XD3/r0pejrU7ksqIvMk/d62Cju9wwia7tQc=&c=orPvdt6NMmVu/lcU9ZH6UmDy5/EC21qmlBfyUVmjXON3xBkH68ZjhjID1PmBGrL8wJV94ufD7/sJghLsWAZ8xWfK/qJlceD6tCV5FhbehwrN/uC6KD18ddSjyz8FgzV0ewWi ilqH5JlpvTIfwJzw3lyu52v3PKivBp4L uzwcN/auwrpHbiKWOtOyttGht&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=1VGAxevrTn2UGreUqGy2NA&e=1460683378&downloadAs=songr.exe

http://www.conecptquickrepository.com/WVl6OTRQVlJDVlZGaFNUQjBVVWxIUTBKaGIzbDZaakZUTVRGNlZXSlBURFp3UzJvMWJHNXNKVEpDY3lVeVJuVTJiMjUzSlRORUptTTlhVmc1V0ZCeVMyZHVVR3MyVERacmRqWmFaRWRxY0ROSmJFbFJVM2N5TTFoTmJUUjVWV0ZIWkVSRWNrSnhjSFZxUm10cE56TkpUVUkwV1RnbE1rWnlXbGhaVnpOaFRraERWWGxsYVVGeVFURjZVVEZFUkVWV1YwSmtVMGR6VWtrMGFEQjZTMVZ6TjBWTGNYTXlUVWh4Ym5aS05XOHpUR0YxVm1kRVJWSWxNa0pwYzNkTFRGRk1abEJPUkZoT2RqWnFORU5XV0V4NFRHdFhaeVV6UkNVelJDWmxQVEFtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEJ6SlROQkpUSkdKVEpHYzJWamRYSmxMbWx1Ym1Sc0xtTnZiU1V5UmtKU0pUSkdjMjl1WjNJdWVtbHdKVE5HYzNRbE0wUjNaVU5YVDJnd1NHOTRWRGswVkdobVptOVhibVozSlRJMlpTVXpSREUwTmpBMk9EVTNORGttWkc5M2JteHZZV1JCY3oxemIyNW5jaTVsZUdVPQ==

http://www.repositoryuniversegift.com/c?x=tiVYbnBq/sorZkck7mDXHtXTZ7BbjJ/LM6mKlNtt5wc=&c=4iaRpHT216LcKfGesee5qT7PZOpPNyJSDZhYNs0iRNgpEfNL8ukfLXUaJ1KZQ2JQxZ4zn3dSZJmTzmSk3JjAEguZiZ0bcifD6FZ/ vBck03nPGbfosHqCyuNOrXBQhGk10UFfsy0ojg7NWbSeTq2RaSQ06NMlGokmISFauewSwg4CuZs1RF2w 0JbKIGE2UE&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=Xh6HcW84GfF0fLN-NLnIrw&e=1460559743&downloadAs=songr.exe

http://www.conecptquickrepository.com/c?x=GNtkmR g3QocTux kgT6VUD0iplw0gt0W9mVXp3GsNQ=&c=fXTHvqWdNfa6fCDkZmKBFoEbhU QguvHPxou jcFbM0 0Rru9Wlo5dCmLRMRjH2m8ky9TkQb23lOUwG0CddDUGnik8SFI/A D90vSMTL1z6ZheT u7vOuVve18cO/ZMh7Ab2Sjcmkuv1CRECPK97od7RtjJFUg/Zvl5tCQqJnpqmn8o wVh0s6eLoRjhC1Y/&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=kLfujYsPdZhL47ZDHtsIZg&e=1460673052&downloadAs=songr.exe

http://www.repositoryuniversegift.com/c?x=hM/Gy3cgOXjOV4xVmXWo9H5T4VkL2ROqCXaa1QzawTI=&c=FTYnPSkMhpeIeQI5G871QSqSaVBqT6rs51tEB2SBVGyc3O/DxqcPXTrZq7mv6W/2EgVHxPObdb XX YgXu1lz2RRB3AtvCnCXW9I81rmCiPOqWTptz6vPCpM6Jlv9wmrmUJaR6166kO4n2C3VAP 9b/RKtCbVXlBsQnOUIUvazbJfldFjQCXHWFjHtmCOVvl&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=CLPNL_x9BhzYiEaPCdB1JA&e=1460619189&downloadAs=songr.exe

http://www.conecptquickrepository.com/c?x=H3XNvWJTb9ZFRauN/xcpwBiaZAuCKn5f65ndbVEFesY=&c=hhbuAemFuV8WXn9 Dob2w2JutZ9uU9W5caFp9MLT44s6 lGBe/dj1ENUjncejrLp9jYxT7GQezmIPh2On/7bL TYw7juH0HM4DSyAYA6WwkF3LrbgDgeHddx08M4wWF1WrrO6A sJ9XSvunfXRra9KqWKUv33JkEoSOTHo6Oq3SFovYayUEr T24qNtu0Wx5&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=dKb6ICj_7itZNmxn9I9hfQ&e=1460653535&downloadAs=songr.exe

http://www.repositoryuniversegift.com/c?x=/4xA3djgMceVzKzds 77nPdD2stfukNVOd1j20hCHGc=&c=uavQxvsJ8XTfaORINBa4GuQeOLFLQSkDdKgIKnTDajlj17jy7yGZFLFAbG2NHymKP Vf2aKEAFmScBD7v6O0UZhUgieYRQyFC46VtVI1zDFG7F1w54HA9z8q3A8c7ccVcybXV93wxZErb5cSL92vD2E4DoLDC7PvfnVOCZiJRUuRZHEgfP9UwanWFqWswRf/&e=0&fallback_url=https://secure.inndl.com/.../songr.zip?st=PYuT324-wyVHL-SYVPdl5w&e=1460561059&downloadAs=songr.exe

Remove songr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.