setup.exe

Bohr­-ium Group

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application setup.exe by Bohr­-ium Group has been detected as adware by 4 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from dl.loadclientinputsrv.com. It is distributed as part of the Brightcircle group of browser-extensions.
Publisher:
Bohr­-ium Group  (signed and verified)

Description:
Pgqxvoygp

Version:
4.9.16.3

MD5:
cbb8b00c244130229fc8e91a1cd364db

SHA-1:
318075706cfdcfe843e926e2333abd33b699a23e

SHA-256:
173c68027f601b999a941205a88ea4bf60396a1306e28c7f7019b24a86f2ed08

Scanner detections:
4 / 68

Status:
Adware

Analysis date:
4/25/2024 11:19:45 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3367

IKARUS anti.virus
PUA.ScrambleWrapper
t3scan.1.7.5.0

Panda Antivirus
Trj/Genetic.gen
14.08.29.06

Reason Heuristics
PUP.Installer.BohriumGroup.F
14.8.29.18

File size:
8.7 MB (9,075,280 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
8/13/2014 5:00:00 PM

Valid to:
8/14/2015 4:59:59 PM

Subject:
CN=Bohr­-ium Group, O=Bohr­-ium Group, STREET=Athinodorou 3, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
79AE90FF01AB303C263027AB2FC84409

File PE Metadata
Compilation timestamp:
12/4/2012 5:54:47 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
196608:ahRoafKBlxunsJLEhja6yfkag12xKRwjyWIyC2qQ7vfftluA:CRRA3JYOgso7WIvxQ7vbuA

Entry address:
0x4327

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, FF, 15, 74, B3, 7C, 00, C7, 04, 24, 01, 80, 00, 00, FF, 15, 58, B4, 7C, 00, 53, C7, 04, 24, 00, 00, 00, 00, FF, 15, 98, B4, 7C, 00, 56, A3, 7C, 23, 7C, 00, C7, 04, 24, 08, 00, 00, 00, E8, 8D, 3B, 00, 00, A3, D8, 23, 7C, 00, 8D, 85, 84, FE, FF, FF, 57, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 01, B3, 40, 00, FF, 15, AC, B4, 7C, 00, 83, EC, 14, C7, 44, 24, 04, 02, B3, 40, 00, C7...
 
[+]

Entropy:
7.9988  (probably packed)

Code size:
33 KB (33,792 bytes)

The file setup.exe has been seen being distributed by the following URL.

Remove setup.exe - Powered by Reason Core Security