home

setup code.exe

The application setup code.exe has been detected as a potentially unwanted program by 20 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from download8.mediafire.com.
MD5:
017cb4d1ce2001402b498db5c6933e5d

SHA-1:
7a0a40cbd0d0f1e2c25ceaabb5df0214c21ebba8

SHA-256:
98b818d93e4c8fe918a60ad7a1217572ed465c6206f21a1ef43739a7748789a3

Scanner detections:
20 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
4/26/2024 4:05:25 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Dropped:Application.Bundler.Outbrowse.L
197

AhnLab V3 Security
Adware/Win32.OutBrowse
2014.08.19

Avira AntiVirus
APPL/Downloader.Gen
7.11.167.222

avast!
Win32:Malware-gen
2014.9-160722

Baidu Antivirus
Adware.Win32.OutBrowse
4.0.3.16722

Bitdefender
Dropped:Application.Bundler.Outbrowse.L
1.0.20.1020

ESET NOD32
Win32/OutBrowse
10.10275

F-Prot
W32/Outbrowse.B2.gen
v6.4.7.1.166

F-Secure
Dropped:Application.Bundler.Outbrowse
11.2016-22-07_6

G Data
Dropped:Application.Bundler.Outbrowse
16.7.24

IKARUS anti.virus
PUA.OutBrowse
t3scan.1.7.5.0

Kaspersky
not-a-virus:AdWare.Win32.OutBrowse
14.0.0.-132

Malwarebytes
PUP.Optional.OutBrowse
v2016.07.22.08

MicroWorld eScan
Dropped:Application.Bundler.Outbrowse.L
17.0.0.612

Panda Antivirus
Trj/Chgt.B
16.07.22.08

Qihoo 360 Security
Win32/Virus.Downloader.b82
1.0.0.1015

Reason Heuristics
PUP.OutBrowse (M)
16.7.22.8

Sophos
Generic PUA HK
4.98

Trend Micro House Call
Suspicious_GEN.F47V0811
7.2.204

Vba32 AntiVirus
AdWare.OutBrowse
3.12.26.3

File size:
709.6 KB (726,620 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup code.exe

File PE Metadata
Compilation timestamp:
12/6/2009 12:50:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:5LwRf97t4Atfzaq4pgSLRQ/HxMseljA2ThJYpdY9L3kmdwiFpuE3C:5L+f972nASLy/HSNbqe9LvdwQK

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file setup code.exe has been seen being distributed by the following URL.

http://download8.mediafire.com/8awybv577b0g/.../setup code.exe

Remove setup code.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.