home

horizon-setup.exe

Web Program

Daring Development Inc.

The application horizon-setup.exe, “Web Program Setup ” by Daring Development has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from cdn.perkydownloadwindow.com.
Publisher:
Installer   (signed by Daring Development Inc.)

Product:
Web Program

Description:
Web Program Setup

MD5:
de56aff054b59dad10b62f4f55e6e502

SHA-1:
19ae3988a2e24fb5b3ef4b75a7de867309ae553c

SHA-256:
97ae93deb5a425662d186a27360e98d4db0e3f8eb24fc82fd7d4e65b0163f359

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
5/14/2024 2:03:19 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.15824

Comodo Security
Application.Win32.InstallCore.KT
22850

ESET NOD32
Win32/InstallCore.WQ potentially unwanted (variant)
9.11986

herdProtect (fuzzy)
variant of jse_install_app-1437685832921.exe
2015.8.24.18

Malwarebytes
PUP.OPtional.Bundle
v2015.08.24.06

Panda Antivirus
Trj/Chgt.O
15.08.24.06

Reason Heuristics
PUP.installCore (M)
16.1.13.13

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
3.12.26.4

File size:
801.9 KB (821,104 bytes)

Product version:
1.3

Copyright:
Installer Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\horizon-setup.exe

Digital Signature
Signed by:
Daring Development Inc.

Authority:
VeriSign, Inc.

Valid from:
10/18/2013 5:00:00 PM

Valid to:
10/19/2015 4:59:59 PM

Subject:
CN=Daring Development Inc., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Daring Development Inc., L=Mamaroneck, S=New York, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
459F52EE0DAEC49DD60050DD4433D2C7

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:dcu5zWVnnNS5dHT1YnV+8oEzI5WYBMmVw8NT2:dZVECdHTD5WlQ6

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9229

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file horizon-setup.exe has been seen being distributed by the following URL.

http://cdn.perkydownloadwindow.com/c?x=4iBG6FzVvFC3RmfDGUgZciESAeCwAg7n8D3k6I/r7oc=&c=MBl8hYuL67MOysM77T/fXOHSlpaf7CBepTOMk3pmqjsCwJPzf0HAA5akum08QKdoG058UAmeCj8MEjr akddr7gVoJ2K2oEhk9tRvvRtqk5BWAkyQ1zMvS3tYHeDDA2HDk9fg2SgCrCqEQLJ5WWg/A==&fallback_url=https://www.horizonmb.com/client/.../latest.php&downloadAs=Horizon-Setup.exe

Remove horizon-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.