home

setup.exe

INSTALL MY SOFTWARE

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application setup.exe, “Software Installer ” by INSTALL MY SOFTWARE has been detected as adware by 35 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from secure.oinstaller6.com.
Publisher:
Software Installer   (signed by INSTALL MY SOFTWARE)

Product:
Software Installer

Description:
Software Installer

Version:
2.4.8.1

MD5:
64e22e80e5bea3d40a9379ad5fcb582c

SHA-1:
1833a5134d6513cbc6ea1bdf2ccc554b335ab879

SHA-256:
750bea9286f60d588591e8b94b1e14e3cdce24186f9a4ea04b2242756a45ebe1

Scanner detections:
35 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/23/2024 7:24:52 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.OptimumInstaller.3
565

Agnitum Outpost
PUA.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.IBryte
2014.08.12

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.166.114

avast!
Win32:IBryte-DQ [PUP]
2014.9-150719

AVG
Adware AdPlugin
2016.0.3043

Bitdefender
Gen:Variant.Application.Bundler.OptimumInstaller.3
1.0.20.1000

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Agent-7652
0.98/19185

Comodo Security
Application.Win32.IBryte.X
19159

Dr.Web
Trojan.Packed.28074
9.0.1.0200

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.OptimumInstaller
8.15.07.19.07

ESET NOD32
Win32/AdWare.iBryte.AN application
9.7.0.302.0

Fortinet FortiGate
Riskware/Generic.AC.13751
7/19/2015

F-Prot
W32/A-c255719d
v6.4.7.1.166

F-Secure
Riskware.Gen:Variant.Application.Bundler
11.2015-19-07_1

G Data
Gen:Variant.Application.Bundler.OptimumInstaller
15.7.24

IKARUS anti.virus
AdWare.AdPlugin
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.183.13014

Kaspersky
Trojan.Win32.Inject
14.0.0.1711

Malwarebytes
PUP.Optional.OptimumInstaller.A
v2015.07.19.07

McAfee
Trojan.Artemis!9A4A4ACDEB08
5600.6699

MicroWorld eScan
Gen:Variant.Application.Bundler.OptimumInstaller.3
16.0.0.600

NANO AntiVirus
Trojan.Win32.OpenInst.dbiauk
0.28.2.61349

Norman
Gen:Variant.Application.Bundler.OptimumInstaller.3
11.20150719

nProtect
Trojan/W32.Inject.228656
14.11.28.01

Panda Antivirus
Trj/Genetic.gen
15.07.19.07

Qihoo 360 Security
Malware.QVM10.Gen
1.0.0.1015

Quick Heal
Adware.iBryte.DK4
7.15.14.00

Reason Heuristics
PUP.Adknowledge.INSTALLMYSOFTWARE.Installer (M)
15.7.19.19

Rising Antivirus
PE:Malware.iBryte!6.197B
23.00.65.15717

Sophos
PUA 'iBryte Optimum Installer'
5.10

Vba32 AntiVirus
AdWare.iBryte
3.12.26.3

VIPRE Antivirus
Threat.4150696
31208

Zillya! Antivirus
Adware.iBryte.Win32.1235
2.0.0.1859

File size:
219.3 KB (224,560 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) 2013 Software Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
INSTALL MY SOFTWARE

Authority:
VeriSign, Inc.

Valid from:
10/3/2013 5:00:00 PM

Valid to:
9/20/2014 4:59:59 PM

Subject:
CN=INSTALL MY SOFTWARE, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=INSTALL MY SOFTWARE, L=Kansas City, S=Missouri, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
27E76F44FB423CCAF29C43D0034D244D

File PE Metadata
Compilation timestamp:
7/5/2014 2:00:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:t7ogxhFbWvFNFH/jh5xTVYj9gsWim1Xm2qYJi8LTE7v2+RXkpIl:GgxhFMN1/jhXVcZW9Nq9kpIl

Entry address:
0xED47

Entry point:
E8, 40, 36, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 48, 72, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 30, 70, 42, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63...
 
[+]

Entropy:
6.3534

Code size:
152 KB (155,648 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://secure.oinstaller6.com/o/.../Setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.