home

pdfcreatorsetup.exe

The application pdfcreatorsetup.exe has been detected as a potentially unwanted program by 17 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.coolpdfcreator.com.
MD5:
9bcdc11bc0978e735ec0158892e9f57b

SHA-1:
78bf4f7df3df80117f8e11a09d05c9cc773038ff

SHA-256:
0648b1d0035eae706d7ac58af9de5b677bd28759cea1d3d134933486270a83a9

Scanner detections:
17 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/23/2024 7:58:56 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Adware
7.1.1

Avira AntiVirus
PUA/InstallCore.Gen
8.3.2.2

AVG
Adware InstallCore.BJ
2015.0.4355

Clam AntiVirus
W32.Adware.InstallCore-1
0.98/21005

Comodo Security
ApplicUnwnt.Win32.AdWare.InstallCore.3
23470

Dr.Web
Adware.InstallCore.43
9.0.1.05190

ESET NOD32
Win32/InstallCore.R potentially unwanted application
7.0.302.0

F-Prot
W32/InstallCore.C.gen
4.6.5.141

K7 AntiVirus
Unwanted-Program
13.212.17639

Malwarebytes
PUP.Optional.InstallCore
v2015.10.25.08

NANO AntiVirus
Trojan.Win32.WebToolbar.rggjw
0.30.26.3947

Rising Antivirus
PE:PUF.InstallCore!1.9DE1[F1]
23.00.65.151023

Sophos
PUA 'Install Core'
5.20

Trend Micro House Call
HV_INSTALLCORE_CA2229C3.TOMC
7.2.298

Vba32 AntiVirus
Signed-Adware.InstallCore
3.12.26.4

VIPRE Antivirus
Threat.4150696
44732

Zillya! Antivirus
Adware.InstallCore.Win32.977
2.0.0.2471

File size:
1014.3 KB (1,038,608 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\pdfcreatorsetup.exe

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:eJYsNmieIUxHiCDLFMqXU1OIJcpT0vSJX:0MiRUxH/DLO0kOocpT0vSJ

Entry address:
0xC1A2E

Entry point:
55, 8B, EC, 83, C4, F0, B8, 75, 91, 4E, 00, E8, C4, E1, FF, FF, 69, 68, A7, F7, 99, 8D, 4F, 3D, CC, 08, 63, 66, 09, 71, 0E, C4, 2B, 40, 0F, 19, C3, FD, 8A, 0E, AD, 3B, 6E, 9C, 24, E1, C4, 19, 4E, D6, 92, 06, 78, 1B, 21, EC, 80, D0, CA, C7, 2C, D2, A8, D5, 62, CE, B5, D4, 87, 08, 58, F4, 7C, 2E, 4F, 17, F4, 04, 7F, 18, 1F, A2, 1F, 38, E4, A9, 32, EE, 39, A9, 6B, B2, 30, 8A, C5, 81, D7, CC, 83, 38, 1C, D4, 5F, 01, 21, B1, 15, 69, DE, 06, 98, E6, EA, FB, 97, DA, BE, 7B, 29, 5F, DF, 00, BD, 68, BD, C8, AB, 07...
 
[+]

Entropy:
6.9099

Developed / compiled with:
Microsoft Visual C++

Code size:
787 KB (805,888 bytes)

The file pdfcreatorsetup.exe has been seen being distributed by the following URL.

http://www.coolpdfcreator.com/default/ga/.../?dl=1

Remove pdfcreatorsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.