home

Setup.exe

Setup Manager LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file Setup.exe by Setup Manager has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This downloadble file is typically blocked through Google's Safe Browsing technology in Chrome web browser.
Publisher:
Setup Manager LLC  (signed and verified)

MD5:
49e980873dbe84b2e200cdd1165b3b85

SHA-1:
3ab93b2fffe76229023b7f570bacac905a702de1

SHA-256:
addfa5ce93c731b0b59f1be166bba03c6f6fad0fe318631aed70f8421f0f6d38

Scanner detections:
12 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/27/2024 11:16:52 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.SoftPulse
2015.05.18

Avira AntiVirus
PUA/Softpulse.Gen
8.3.1.6

AVG
Adware AdPlugin.DHL
2014.0.4311

Dr.Web
Trojan.Domaiq.265
9.0.1.05190

ESET NOD32
Win32/SoftPulse.AD potentially unwanted application
7.0.302.0

IKARUS anti.virus
PUA.Bundler.SoftPulse
t3scan.1.8.9.0

K7 AntiVirus
Adware
13.204.15935

Panda Antivirus
Generic Suspicious
15.05.17.08

Reason Heuristics
Threat.Softpulse.Bundler
15.5.17.16

VIPRE Antivirus
Threat.4150696
39676

Zillya! Antivirus
Backdoor.PePatch.Win32.71864
2.0.0.2179

File size:
555.1 KB (568,384 bytes)

Bundler/Installer:
Softpulse SoftwareBundler

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Setup Manager LLC

Authority:
thawte, Inc.

Valid from:
12/17/2014 7:00:00 PM

Valid to:
12/18/2015 6:59:59 PM

Subject:
CN=Setup Manager LLC, O=Setup Manager LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
64F82246387934B733705C8D1E4ED21A

File PE Metadata
Compilation timestamp:
4/27/2015 11:31:43 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:VdjURclzwQTu87jBNOhqUnT0vLjd7iP3UIKxcXUNYMc:VdgSZi871Nx4T0Djd7CqukKMc

Entry address:
0x1DF3CB

Entry point:
60, E8, 00, 00, 00, 00, 58, 05, 5A, 0B, 00, 00, 8B, 30, 03, F0, 2B, C0, 8B, FE, 66, AD, C1, E0, 0C, 8B, C8, 50, AD, 2B, C8, 03, F1, 8B, C8, 57, 51, 49, 8A, 44, 39, 06, 88, 04, 31, 75, F6, 2B, C0, AC, 8B, C8, 80, E1, F0, 24, 0F, C1, E1, 0C, 8A, E8, AC, 0B, C8, 51, 02, CD, BD, 00, FD, FF, FF, D3, E5, 59, 58, 8B, DC, 8D, A4, 6C, 90, F1, FF, FF, 51, 2B, C9, 51, 51, 8B, CC, 51, 66, 8B, 17, C1, E2, 0C, 52, 57, 83, C1, 04, 51, 50, 83, C1, 04, 56, 51, E8, 5E, 00, 00, 00, 8B, E3, 5E, 5A, 2B, C0, 89, 04, 32, B4, 10...
 
[+]

Entropy:
7.9545

Packer / compiler:
ASPack v1.08.04

Code size:
1.2 MB (1,284,608 bytes)

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.