home

safesetup.exe

O S U

Traffic Space, LLC

The application safesetup.exe, “ Open Software Updater” by Traffic Space has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from cloud.securedownloadcdn.com and multiple other hosts.
Publisher:
Traffic Space, LLC  (signed and verified)

Product:
O S U

Description:
Open Software Updater

Version:
3.1.0.0

MD5:
776933970667c4e9099f5de146fd5442

SHA-1:
8d054fc3911ddef27c35bd65cc46169eb5b0aca2

SHA-256:
1aea6e900e00962ed2c2a86c8aba7e93d275eae524de0f17a79b4683b2d72fa5

Scanner detections:
9 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
6/28/2025 11:52:38 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2016.0.2991

Baidu Antivirus
Trojan.Win32.HistoryChecker
4.0.3.15910

Dr.Web
Adware.Downware.10994
9.0.1.0253

ESET NOD32
Win32/Conduit.SearchProtect.AI potentially unwanted (variant)
9.12230

Fortinet FortiGate
Riskware/Conduit_SearchProtect
9/10/2015

McAfee
Artemis!776933970667
5600.6647

Reason Heuristics
PUP.TrafficSpace.Installer (M)
15.9.10.8

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF[F1]
23.00.65.15908

VIPRE Antivirus
InstallerTech
43610

File size:
694.2 KB (710,824 bytes)

Copyright:
Copyright 2015

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\safesetup.exe

Digital Signature
Signed by:
Traffic Space, LLC

Authority:
Symantec Corporation

Valid from:
3/16/2015 8:00:00 PM

Valid to:
4/15/2016 7:59:59 PM

Subject:
CN="Traffic Space, LLC", O="Traffic Space, LLC", L=Woodcliff Lake, S=New Jersey, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6C4417841FFCEC12D6EFE825A6723A4E

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:CDw6/FrIN2KdmnIc//MUdN8RcVDlMYHH1UTA89hKA863qfiHZIEX2VcBFu5:CD3/hrKdmzbzVhMOoAOhA63GiHG/IY5

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9425

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file safesetup.exe has been seen being distributed by the following 7 URLs.

https://cloud.securedownloadcdn.com/r.php?RPnuUgjCMJXGnOodDn05rH3alP8sWxdOmAigQCTDlQkIEIWi6WoxErI0gRsdoF1Kgk17WVKhM40qNWJUT7sxyayP102pG4aWoc4k7OCTTCkGz3Asb20KdyAezCDgHOd50hq7631ZGlGfphIBkIlxhVLRyp7fdlldCMlJPmIvHpL7GtI0b4xt0ikyIsOVNa8qWt9MQShyh2FXwoXHtvbtOv1wXQrL0AbX4kJUc1st48rAwpiZUttJZvfXlHImhTkme3gq5JU9RmKoL2oGwRpwmFtImb4E5o0jshJx0EHS0sgMvFs2wSyTx1BUdGyi4zBxQl5RZNJ0f0MKFfMc8l5GmGAzm8RrHsYyN4pNR9O79BSPQF1Z06FmNfW9oNB6gAE4E4SweGDnhvd8be7blMy92uiqiUxyucD8gvFubiStO6BZkIbGvJPyd8Zv2w4xIHGZdlupEmSsstsNcDuHmkgzsf5vL92uRIt43XtHkmaNPCB1g5JCpZcS

https://cloud.securedownloadcdn.com/r.php?PfO8JJT69cgvBb3kAflmu7o9DqRKCcEsstAcdtimGzShKVClaXHF56OJxGuaS8ClCcxPFQcmp4D9ZgvaecPjiE3PkxZdGByiO58tWkQlptvpJ0zXcphv4lloSlCyXaRLgZfck5yJz39j3Jhg9zMdU8BMtdlqocbEbqRwwpf5spow8FNhfAu9I6VbkgCJsNnEefaKEqQ7PeEYUsg93KiLReXcvzVYnjDByNmdecl4q02lsivv3OhV3e7yO2xblaMUX88cltgLti7WBDsErKzuZH3NJAY5KL0IU8UfCa15t824MvIdfiIeZL1Jl0O6LPOGXJVzTWFm5IqRd95srNHrzIaUJZ1uOPbMz6ms31P9Kg1Xp6pRU6jtPtoysp3hff3Olphor6ybmz9MFzEAGX3vqs4TR8b7neWJEd86kGiHfrtV08vH5ycw0hqSqB0OQWxvaFBumUbBlFxmN23TBgqCyQvYrvNhskMC0o7niiZEYw1Mz5Fbl5NU

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

Remove safesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.