» onaylanmayan 699442.crdownload
Overview
Analysis
File Details

onaylanmayan 699442.crdownload

Setup Factory Runtime

Dey yazilim ve internet hizmetleri san. tic. ltd. sti.

The file onaylanmayan 699442.crdownload, “Setup Application” by Dey yazilim ve internet hizmetleri san. tic. ltd. sti has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Setup Factory installer.

File name:

Publisher:

Dey yazilim ve internet hizmetleri san. tic. ltd. sti. (signed and verified)

Product:

Setup Factory Runtime

Description:

Setup Application

Version:

9.1.0.0

MD5:

d4d65a825279a8b96e41113038032587

SHA-1:

7ed0e1f1da91420a399844e5998dffdf1194d39f

SHA-256:

22dd7e8b8d1868b0504de304147969c7eca3f6188bf99a72f34cbea7642ba072

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

4/26/2024 1:25:59 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Amonitize (M)

16.10.5.18

File size:

2.9 MB (3,052,024 bytes)

Product version:

9.1.0.0

Trademarks:

Setup Factory is a trademark of Indigo Rose Corporation.

Original file name:

suf_launch.exe

Installer:

Setup Factory

Language:

English (United States)

Common path:

C:\users\{user}\downloads\onaylanmayan 699442.crdownload

Digital Signature

Signed by:

Dey yazilim ve internet hizmetleri san. tic. ltd. sti.

Authority:

COMODO CA Limited

Valid from:

3/12/2014 2:00:00 AM

Valid to:

3/13/2015 1:59:59 AM

Subject:

CN=Dey yazilim ve internet hizmetleri san. tic. ltd. sti., O=Dey yazilim ve internet hizmetleri san. tic. ltd. sti., STREET=kuloglu mah alyon gecidi sok, STREET=beyoglu, L=istanbul, S=istanbul, PostalCode=34433, C=TR

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00FD3AA42CD883A6D47CC56CDA9837EB85

File PE Metadata

Compilation timestamp:

6/14/2012 7:16:10 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

49152:YShySkASzCNzcvi57bxUxw2d6uIccIIy2MmppRhPGaSsb3MtVKy2hv:jqBQzcahitd6uxc9jnzOaSsb8tVIhv

Entry address:

0x29E1

Entry point:

E8, A6, 1D, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 56, 57, 33, F6, BF, C8, AB, 40, 00, 83, 3C, F5, 54, A0, 40, 00, 01, 75, 1D, 8D, 04, F5, 50, A0, 40, 00, 89, 38, 68, A0, 0F, 00, 00, FF, 30, 83, C7, 18, FF, 15, C0, 70, 40, 00, 85, C0, 74, 0C, 46, 83, FE, 24, 7C, D3, 33, C0, 40, 5F, 5E, C3, 83, 24, F5, 50, A0, 40, 00, 00, 33, C0, EB, F1, 8B, FF, 53, 8B, 1D, C4, 70, 40, 00, 56, BE, 50, A0, 40, 00, 57, 8B, 3E, 85, FF, 74, 13, 83, 7E, 04, 01, 74, 0D, 57, FF, D3, 57, E8, 18, FD, FF, FF, 83, 26, 00, 59, 83, C6, 08... 
[+]

Code size:

22 KB (22,528 bytes)

Remove onaylanmayan 699442.crdownload - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.