» setup.exe
Overview
Analysis
File Details
Downloads (41)

setup.exe

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 9 anti-malware scanners. The file has been seen being downloaded from www.downanapp.com and multiple other hosts.

File name:

setup.exe

Publisher:

Stepitapp LLC (signed and verified)

MD5:

7e4ae134b206379e6870438da746bd7f

SHA-1:

1c14ebc5e30810b159735d5401b57e4a7ad27ed5

SHA-256:

fc8e772db3e418db2ecfa0460801dd22bbe5c7cdaaccd9163523995d10e06477

Scanner detections:

9 / 68

Status:

Adware

Analysis date:

4/19/2024 12:42:17 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

TR/Dldr.Agent.216048

7.11.201.138

avast!

Win32:Dropper-gen [Drp]

2014.9-150129

ESET NOD32

Win32/Downloader.Agent.AI (variant)

9.11021

McAfee

Artemis!F4CD8201B97A

5600.6871

Reason Heuristics

PUP.Installer.Stepitapp.F

14.12.22.6

Sophos

Generic PUA OF

4.98

Trend Micro House Call

Suspicious_GEN.F47V1219

7.2.356

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

36688

File size:

211 KB (216,048 bytes)

File type:

Executable application (Win32 EXE)

Common path:

C:\users\{user}\downloads\setup.exe

Digital Signature

Signed by:

Stepitapp LLC

Authority:

COMODO CA Limited

Valid from:

12/11/2013 1:00:00 AM

Valid to:

12/12/2014 12:59:59 AM

Subject:

CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata

Compilation timestamp:

12/11/2014 11:09:08 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:Dbm6l7b9RZtLiNZsWFel4UDP5i/7VgmpW7+oJ0y8FIPCgHRw5:Db7l7b9zt+No4G5+Vg6W7+oJmIP10

Entry address:

0x145C1

Entry point:

E8, CA, 6B, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 14, 75, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, A4, 70, 42, 00, C9, C2, 08, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81... 
[+]

Entropy:

6.3972

Code size:

151 KB (154,624 bytes)

The file setup.exe has been seen being distributed by the following 41 URLs.

http://www.downanapp.com/.../300?sub_id=apn630_lax1CKfxnsnY6fGebBACGJG06dWGtqemHSIKNzEuMTQuNDEuOCgBMJaC3aQF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_nym1CI_0r6iBps_3UBACGJWn9YKPt6LKBSIPMTkwLjIwOS4xNDIuMTAwKAEwgpiNpQU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_nym1CP3ykMHlt7vTZBACGKOEzOL6yoWGUiINMjQuMTM5LjExMi41NCgBMNfZ8aQF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_ams1COXL4N_60ePyBRACGIPe1cG0kNq2XSILMTc4LjE1MC45LjYoATCQhtukBQ..&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CPSdr-zkyoTYEBACGO6i69rmgOaAXCIOMjE2LjE4NS4zOS4xOTkoATDP1-akBQ..&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_ams1CNG12_DJ0ZzRTRACGKuPkpSKhIDaESINNDYuMTY5LjEzLjEzNCgBMOiK3KQF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_nym1CO-V1ri536WmahACGKztl9H2u4TrKCIOMjA3LjIwNC43MC4xMzYoATCnoIelBQ..&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_nym1CPq7xunf3Y2kNhACGJKm0_qO3dzDVyINNzQuMTk2LjQ0LjEyMigBMLrD2qQF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CNPa18Tg7sfgLxACGOSc4rvUiZ3adCIMOTQuMjEuMjM3LjE2KAEwr_PxpAU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CJ-354eKzoOCEBACGNnzwNrtqfGpDSINNDYuMTczLjk3LjEzMCgBMKnM9qQF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CKDl_Iy6gLbqBhACGKeshdKh25rvZiIOMTg4LjEyMS4yMTEuNjYoATD1sIGlBQ..&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CIu44MaY2qWgQxACGJju85Py7rH9fSIMNzguOTYuMTM5LjI0KAEw9b7hpAU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_lax1CNy-nq_R3pb7UxACGM3679_8jqKaWSINMTcyLjU2LjM5LjExMCgBMIz6jqUF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_ams1CJrpkMLam97SSBACGNn89fO7ufDPGiIOODkuMTM3LjIxNC4yNTAoATDe8PakBQ..&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_ams1CLjf39WqwdGdDRACGKDH7r_4is-tJyIPMjEzLjE0OS4xNTcuMTIyKAEwxZiBpQU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CNSmqdmX7K2oOBACGO2q-sDZ6bGNLCIPMTkzLjEwNi4xNTUuMTQyKAEwgOSApQU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_ams1CKirh8Ke8dbOXhACGMeY8N65xpaODyIMODQuMS4xMTEuMTAyKAEw07KKpQU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CM7r_vTCvJSfJRACGPew5Or0i-KAHCINODQuMTA4LjEzMS4xOCgBMITWz6QF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_sin1CJfimqWyhrmsbhACGLa04f7Kva-JayIMNzkuMTcwLjU0LjU5KAEwg9XLpAU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_ams1CIX1g6ON2oGsdBACGOaFxMHrrsgzIg04OS42OS4xMjkuMjUyKAEwttjapAU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_nym1CJm_ma7esLK4HBACGJ2AtKihqtSmBCIMNzIuMjIuMTU1LjE0KAEw1eGMpQU.&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_nym1CKOiv83C_Y_vOBACGJ_l4ZD265atRCILOTkuNzIuMTczLjEoATDxjIClBQ..&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CNbKhd7ygMzbZBACGK7hiNmU_rqqCSINOTUuMTM1LjU4LjI1MSgBMI2Z3KQF&pub_id=337&template=lp

http://www.downanapp.com/.../300?sub_id=apn630_fra1CJGmjrqlrsaWPhACGODtu52e7vizKSIMMTA5LjEwMS42Mi43KAEwqND7pAU.&pub_id=337&template=lp

http://www.supertuneup.com/downloadip_allcs_dcom.asp?utm_source=dcomnew_sec_728&utm_campaign=dcomnew_sec_728

http://www.downanapp.com/.../300?sub_id=apn630_ams1CLrAyeKBlIS0ahACGLrYq9DKhL_ydSIOMjEzLjIzMy4xMDQuMTAoATC-39ukBQ..&pub_id=337&template=lp

http://ttb.thelatestsoft.com/download/request/.../liNBDd39?ClickID=1025a4ecaea235a92a7c576aff0dcf&PubID=3326&n=movie HQ

http://www.downanapp.com/.../300?sub_id=apn630_ams1CJylrdPd8qC7dRACGLzX_KTf1Jz0VyINMTA5LjEwMy4yLjE2NygBMO3kj6UF&pub_id=337&template=lp

http://nym1.ib.adnxs.com/click?oygGR15c9D-og3t5snzrP2ZmZmZmZhNAqIN7ebJ86z-jKAZHXlz0P_1AOA4lCmQneHrw_vh-yDMDtRNUAAAAAHJAMQBNBQAAdgIAAAIAAACCqB0BDq4EAAAAAQBVU0QAVVNEACwB-gCgIwAA2OYAAgUAAQIAAJQAMySMfgAAAAA./cnd=!ZQbuPAjtqq4CEILR9ggYjtwSIAA./referrer=http://windows.microsoft.com/es-ES/windows-live/account-security-password-information/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPj0wfeP35_kMxACGP2B4fHQxIKyJyIMMTA4LjQ4LjU5LjMzKAEwg-rOoAU.&tag=3227762

http://www.downanapp.com/.../300?sub_id=apn630_nym1CO6DtYyYs4SWRxACGJTtz4bRhc6QTSINMjQuNDIuMTMwLjIxMigBMITggqUF&pub_id=337&template=lp

Latest 30 of 41 download URLs

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.