setup.exe

Bohr­-ium Group

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application setup.exe by Bohr­-ium Group has been detected as adware by 4 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from dl.loadclientinputsrv.com. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:
Bohr­-ium Group  (signed and verified)

Description:
Zfizlthzvj

Version:
4.9.16.3

MD5:
b091f4d2a299bc9080f751848b0678f2

SHA-1:
22581c6a96b3633125d38f816fbd28a27df2293f

SHA-256:
4f8d3bfd0df5a3566b1deafcbd8018c5207380c150436fadeb1139e4ccfdb5d6

Scanner detections:
4 / 68

Status:
Adware

Analysis date:
4/25/2024 7:22:53 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3367

IKARUS anti.virus
PUA.ScrambleWrapper
t3scan.1.7.5.0

McAfee
Artemis!B091F4D2A299
5600.7023

Reason Heuristics
PUP.Installer.BohriumGroup.F
14.8.29.14

File size:
8.7 MB (9,096,960 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
8/14/2014 2:00:00 AM

Valid to:
8/15/2015 1:59:59 AM

Subject:
CN=Bohr­-ium Group, O=Bohr­-ium Group, STREET=Athinodorou 3, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
79AE90FF01AB303C263027AB2FC84409

File PE Metadata
Compilation timestamp:
12/4/2012 2:54:47 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
196608:K2KObP7IDj0cFdAjQgZEBgCwQzQwTH9QoostBk4:q07IDgc7QEBgCSwJQvuH

Entry address:
0x4327

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, B3, 7C, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, B4, 7C, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, B4, 7C, 00, 56, A3, 7C, 23, 7C, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, D8, 23, 7C, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, B4, 7C, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.9988  (probably packed)

Code size:
33 KB (33,792 bytes)

The file setup.exe has been seen being distributed by the following URL.

Remove setup.exe - Powered by Reason Core Security