setup.12004.exe
IronInstall
The application setup.12004.exe by IronInstall has been detected as adware by 10 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.softsoft.ru.
File name:
setup.12004.exe
MD5:
6ad743b707cb7cc9d83808dc8d6c8c8b
SHA-1:
57470a5d8d2b7494f1b704006ac157d8f98a0c3a
SHA-256:
b507d5887eb370c0ddcc458615e1b23254968059186631502a1f4f5cb4648847
Scanner detections:
10 / 68
Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.
Analysis date:
4/25/2024 6:56:59 AM UTC (today)
Scan engine
Detection
Engine version
avast!
Win32:Installer-I [PUP]
2014.9-130727
Boost by Reason
Adware.Installer.IronInstall.K
2013.7.27.1
Dr.Web
Adware.InstallCore.101
9.0.1.0208
ESET NOD32
Win32/InstallCore.BL
7.8649
Malwarebytes
v2013.11.25.01
McAfee
Artemis!6AD743B707CB
5600.7270
NANO AntiVirus
Trojan.Win32.InstallCore.bymbfn
0.24.0.53571
Reason Heuristics
PUP.Installer.IronInstall.K
14.8.7.18
Trend Micro House Call
TROJ_GEN.R0CBH01FD13
7.2.208
VIPRE Antivirus
InstallCore
20162
File size:
581.6 KB (595,608 bytes)
File type:
Executable application (Win32 EXE)
Common path:
C:\users\{user}\downloads\setup.12004.exe
Authority:
COMODO CA Limited
Valid from:
11/19/2012 4:00:00 PM
Valid to:
11/20/2015 3:59:59 PM
Subject:
CN=IronInstall, O=IronInstall, STREET=63 Rothschild Blvd., L=Tel-Aviv, S=NA, PostalCode=65785, C=IL
Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB
Serial number:
2DC5BB8E9D823CD0C4F09AE859BBBEAC
Compilation timestamp:
6/19/1992 3:22:17 PM
Code size:
36 KB (36,864 bytes)
The file setup.12004.exe has been seen being distributed by the following URL.