home

pdfcreatorsetup.exe

InstallCore Ltd.

The application pdfcreatorsetup.exe by InstallCore has been detected as adware by 4 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
InstallCore Ltd.  (signed and verified)

MD5:
76393548a08ce29a8b89b8fe5d0e6d4b

SHA-1:
b9f69f74dd3bb708e786153c0d080ebf2f4dc012

SHA-256:
a5ba43b65d50f646db3e49e6613406d546c99e7e784177e6f68afe33c91f1722

Scanner detections:
4 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/23/2024 10:05:48 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.InstallCore.43
9.0.1.05190

ESET NOD32
Win32/InstallCore.T potentially unwanted application
7.0.302.0

F-Prot
W32/InstallCore.C.gen
4.6.5.141

Reason Heuristics
PUP.installCore.Installer (M)
16.2.13.10

File size:
1014.3 KB (1,038,608 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\pdfcreatorsetup.exe

Digital Signature
Signed by:
InstallCore Ltd.

Authority:
COMODO CA Limited

Valid from:
2/21/2012 12:00:00 AM

Valid to:
2/20/2013 11:59:59 PM

Subject:
CN=InstallCore Ltd., OU=Support, O=InstallCore Ltd., STREET=Nisim Aloni 21, L=Tel Aviv, S=N/A, PostalCode=62919, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0088971791FBF6CE4920268CDF6A0A825F

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:VY0iF7lv4a9vyRvrD0ahLP9xH01rkoi8:GbF799Kh009B0pK

Entry address:
0xC1163

Entry point:
55, 8B, EC, 83, C4, F0, B8, 2C, 80, 45, 00, E8, A4, F7, FF, FF, B8, E4, 55, 48, 00, E8, 6C, FE, FF, FF, 84, C0, 75, 13, 68, 00, 80, 00, 00, 6A, 00, 8B, 03, 50, E8, D9, FD, FF, FF, 33, C0, 89, 03, 5F, 5E, 5B, C3, 90, 53, 56, 57, 55, 8B, D9, 8B, F2, 8B, E8, C7, 43, 04, 00, 00, 10, 00, 6A, 04, 68, 00, 20, 00, 00, 68, 00, 00, 10, 00, 55, E8, A5, FD, FF, FF, 8B, F8, 89, 3B, 85, FF, 75, 1F, 81, C6, FF, FF, 00, 00, 81, E6, 00, 00, FF, FF, 89, 73, 04, 6A, 04, 68, 00, 20, 00, 00, 56, 55, E8, 80, FD, FF, FF, 89, 03...
 
[+]

Entropy:
6.9088

Developed / compiled with:
Microsoft Visual C++

Code size:
787 KB (805,888 bytes)

Remove pdfcreatorsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.