home

setup.exe

Web installer

Generic Internet

The application setup.exe, “Web installer Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.appsbodyupdate.com and multiple other hosts.
Publisher:
Generic Internet

Product:
Web installer

Description:
Web installer Setup

Version:
2.0.1.2

MD5:
7d4e0336b2cc967937044f2b0c1b9316

SHA-1:
2889a5cbd3ef45af53f9282453cfcf7025100da6

SHA-256:
37ea1b2d57d5462995a5eb491a61ad550bf5116501c75d902f9e9732dead405d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/26/2024 7:50:56 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.1.11.0

File size:
934.7 KB (957,170 bytes)

Product version:
5.6.7

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:M/pbluHEM31WqZ2F/+YuWys1PI9mOt0tEtPnvEDo6/6i:M/LuZlnu/+3PsIRtxtPvF6z

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file setup.exe has been seen being distributed by the following 13 URLs.

http://www.appsbodyupdate.com/c?x=egUJpZlY6pQmz XZg398vDGZPUQZ1tk3JVd6YFOgQ5Q=&c=mojxbiO KAq/CdX/u6Hf6yzGmZpT3Gdg/7yokOJa3sUDj6V57VmGnahki27LknnT65wKILAYZGOM4m2LAJ4557GQnE 4UOQoWAogeBSR5RJckln5RE91fxv99In4QdcZrjt7jQtSyGVG5bCaQDV82A==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://deploy.digitaldnagames.com/deploy/.../setup.exe

http://ttb.dllsgetsoftlist.com/download/request/.../PCu0vkJK?__tc=1414855695.78&lpsl=0e176d03d087959446482ae42f9f5df0&expire=1414942080&dp=-_-OWI1N18xNzNfNDA3M180MTE0X0JSXzE4OS4xMjMuMTYuMTU5X2RiZV84NzI4X0FEUw-_-ADSYS-a8ad2427-61db-11e4-a7c7-8690849e6cfc&vurl=10472&fileName=Setup

https://mg.mail.yahoo.com/.../download?m=YaDownload&mid=2_0_0_2_66024_AIR2imIAABFbVrNj5AILcI6bvMY&fid=Sent&pid=2&clean=0&appid=YahooMailNeo&ymreqid=125cbf1f-4131-2b62-01ea-0f0079010000

http://nowplay.myrewardsfilmz.eu/AIRmediaplayercpaBR.html

http://www.todaycurrentsigns.com/c?x=E8Al8sCriJ4xa1S9NCy5TFkTLQh0R3B7Q8U5FqYnEsA=&c=9H UcLY6W2r6Lq/3pPnBgeNSUVyi1cd8tVBLP8CoRr4jcu 4QfiU xBBZ8Ja7uQkSHaWTGz3Z8ARJLNw 4sd 4cj7Mh3V4UhUa8h DyScOxvlN4yfjm2mocgKEG ieCMaeCkjDLMaJ1yzy3/xM1tFw==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.appsbodyupdate.com/c?x=V7l8T6hbYCvqC2msWamfIR2F28caRu3Tr96zvsmw r8=&c=jIVKBk46U7O rEtYAdT6fh1zhUgVGhiZokpJCQcuiydsl/SkeA044pQZoHmJNiYHP7wPgvZUdxBKTsTUUzLX2dsFlvz8wTwo3ixtNRYa4fNKUwiIqLRomeeblf19WwANYti8Vm6FCh8Aem0JG76DdQ==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.shareappsend.com/c?x=5mgxBotY3B1yZBwuMigzwWX0TYTtaq0mO6TbfvG9S7I=&c=/UdFzwzlh5y3qfK1ZYaLpSP8r5tUuS/qEJK3SMbNEF4yjuQH1Sq0iGGHW4j9ncadXe7IDCsi/7sPFOjRnxnOzHyfC/QXP9hvb6KwXMrKp858AqLjqLZY/Lbp5P4jnWKq9j4mo2upMrPfDxjhUjs3RQ==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bodymetahosting.com/c?x=XmsfnX2X8gyGxsVzrjgZnHmROI7v/gU9OUo8yPTbJ g=&c=3JsmzANaNFofjr5cM8Xuozivx9t3xL/7DrZupfPR8nmKWt/uC M w7EmAvesFnnYtwlfQUWx3HlNCFY07BC6GMgElC7ZzOUbhMRR4CzRUhmLMInF6xgqI8q4PJsFnae 4t0oeBE1kfQnlHYPS5poLQ==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://get.file2desktop.com/.../Get?p=2328&d=8873&l=8351&n=1

http://www.appsbodyupdate.com/c?x=qbdUBO9eGX6aDr9AFvnLBYop2jXukYH3gFKfVacs/ Y=&c=5SCOpU2jDBLUuC58fkmfhwLLNZPcdW7Dj8NATrWLBh O34wtrDXovrgXT2ImnPkJXLQrkXF0ukzW/j/bJxVK/kZudw6EeYUwyIVJrfshw9WIj91F5mF3wS9M1fnpRiMz1cZx Cvwa7CKOkKWtsvVBw==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.appsbodyupdate.com/c?x=j0X8SMl8EwWS9TXxZbv9/aJVndwmaQJ5AhaJd4yL1iw=&c=Uwxub8mk5DJp6cgUPbBNoX53HPRNPK6nKiCQo/HkMThhUVLYGDFethDWnLwC5GLQ T5/wP1eCmyQc9J9qbBaMygY Us7pjmeJ gSQuWyqdT4DpGJdtBaOySUCeVYMw/Gc0fa6smE8sF8a6U7WkGeJA==&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.anysend.com/dl.php?data=null&anyprotect_id=1&r=as_mtm1_nc&pr=si&prm=b3JnY2g9YXNfbXRtMSZhdXRvPTEmc3ViMT0xMDU4MjEmc3ViMj0xNzY2ODEmc3ViMz0yMHI1TDEwZDljMXRsZUhIM3NWcDhxMXZPS0VaMDAwLg==

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.