home

setup.exe

Installer

Stepitapp LLC

The application setup.exe by Stepitapp has been detected as adware by 10 anti-malware scanners. The file has been seen being downloaded from nym1.ib.adnxs.com and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Stepitapp LLC  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
cd11a8fc01ed9e63e7501fcb20d721e6

SHA-1:
3fbcef63fd5becebfb4768d48bdc099404961a13

SHA-256:
f24ac77e0746a96173a5a2a5030091b0a72952855557c8cfe190a3f07d576383

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Part of the Conduit/ClientConnect toolbar/extension distribution.

Analysis date:
4/19/2024 2:40:15 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Dropper-gen [Drp]
2014.9-140710

Fortinet FortiGate
Riskware/Agent
7/2/2014

Kaspersky
not-a-virus:Downloader.Win32.Agent
15.0.0.494

McAfee
Artemis!8A2ED863690C
5600.7081

Panda Antivirus
Trj/Chgt.A
14.07.02.05

Qihoo 360 Security
HEUR/Malware.QVM03.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Stepitapp.F
14.7.17.10

Trend Micro House Call
Suspicious_GEN.F47V0620
7.2.183

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
Conduit
30702

File size:
395.9 KB (405,424 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2013

Original file name:
FinalInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Stepitapp LLC

Authority:
COMODO CA Limited

Valid from:
12/10/2013 4:00:00 PM

Valid to:
12/11/2014 3:59:59 PM

Subject:
CN=Stepitapp LLC, O=Stepitapp LLC, POBox=1252, STREET=9 W. 31st Street, L=Bayonne, S=New Jersey, PostalCode=07002, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00EA7DEF51F4F715C2C81433CCD6B15766

File PE Metadata
Compilation timestamp:
6/29/2014 12:21:23 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
6144:FlGvtlC6ibqI59PpOPf201/z7ppmJI9ftR1O7X:FlGC6ibqI59Pk2cb7ppmJ0ftRaX

Entry address:
0x6117E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.1874

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
380.5 KB (389,632 bytes)

The file setup.exe has been seen being distributed by the following 36 URLs.

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fP2ZmZmZmZgJAqxxaZDvf3z8zMzMzMzPjP77veqkDGCMHX6mRhIVRk3WDtrhTAAAAAA3pKQCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAH7AAAgUAAQIAAJAA_yMj3QAAAAA./cnd=!KAeGQgj01IYCENfc1wcY4vsZIAA./referrer=http://www.a10.com/racing-games/traffic-slam-2-3/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CN_SxqTYsNTJdRACGL7f68u6gMaRByIMMTIuMTkuMjMyLjEwKAEwg-3inQU.&tag=2746637

http://nym1.ib.adnxs.com/click?6oWckrGmBECN1VOq9CMBQDMzMzMzMwNAjdVTqvQjAUDqhZySsaYEQOAc_muTSM1ExL4jerl6mhZipLVTAAAAAA3pKQCTBwAAdgIAAAIAAABDpvoA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAbtUAAgUAAQIAAJAAtCdkVQAAAAA./cnd=!xAZCPQj1hYECEMPM6gcY4vsZIAA./referrer=http://www9.buyerpricer.com/landing.aspx?slk=tango free video calls download/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMT9jtGX157NFhACGOC5-N-2ktLmRCIOMjA4LjEwMS4xOTcuOTQoATDiyNadBQ..&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CMTvwafj2P-nIhACGJnnkuPBmLaxGyIMNzAuMTI3LjM3LjEyKAEwsvPmnQU.&tag=2239505

http://lax1.ib.adnxs.com/click?ZEGqlJFsAEDdJAaBlUP7P90kBoGVQ_s_CacD0gCCAUAkfAf9ABgFQAuCyDr__MAGGHT7skSVRlGgw7ZTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAM8EAAgUAAQIAAJIA9COBHgAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=107,113,240&clientId=61a43668-c9da-4f0e-a069-f14649c6e6ea&l=http://community.ancestry.com/messages/view.aspx?id=47974268&fId=0&rid=&r=http://community.ancestry.com/messages//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CJjo7ZfLqKWjURACGIuEotbzn7_gBiINNjkuMzUuMjE2LjE4NSgBMKCH250F&tag=3087481

http://nym1.ib.adnxs.com/click?Qku67mPi_z8QWDm0yHb6PxBYObTIdvo_0k1iEFg5C0BmZmZmZmYQQOm3fqzmMCpFLC3uZ8M32VVFGrZTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAADrAAAgUAAQIAAJIAuiWjHgAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=21,101,107&clientId=cb4fadbe-f681-4f6c-8003-096321bc6c25&l=http://www.championselect.net/champions/talon&r=https://www.google.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CKzauL-2-M3sVRACGOnv-uPqnIyVRSIOMTczLjE2LjEwNC4xMzAoATDFtNidBQ..&tag=3087481

http://lax1.ib.adnxs.com/click?AAAAAAAA8D-QwvUoXI_qP8HKoUW28wRAkML1KFyP6j8AAAAAAADwP-V86U_G614D3rM2dde0bwW0qLNTAAAAAA3pKQCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAA4qwAAgUAAQIAAJAArCd0-wAAAAA./cnd=!wwa9PAiysIcCENfc1wcY4vsZIAA./referrer=http://www.babycenter.com/404_can-you-get-pregnant-right-after-your-period_7094.bc/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CN7n2qn3mu23BRACGOX5pf_k-LqvAyIOMTA4LjIzLjEyNS4yMjAoATC00c6dBQ..&tag=2746637

http://nym1.ib.adnxs.com/click?Qku67mPi_z8QWDm0yHb6PxBYObTIdvo_0k1iEFg5C0BmZmZmZmYQQOm3fqzmMCpFLC3uZ8M32VVFGrZTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAADrAAAgUAAQIAAJIAuiWjHgAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=21,101,107&clientId=cb4fadbe-f681-4f6c-8003-096321bc6c25&l=http://www.championselect.net/champions/talon&r=https://www.google.com//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CKzauL-2-M3sVRACGOnv-uPqnIyVRSIOMTczLjE2LjEwNC4xMzAoATDFtNidBQ..&tag=3087481

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fP5qZmZmZmQVAqxxaZDvf3z8zMzMzMzPjPwWekjxOlQt5eC5XkcZCDmF4x7JTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAArc8AAgUAAQIAAJAAmSQgCAAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.ragdoll-games.org/play/114.html/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CPjc3Irp2JCHYRACGIW8yuTjqeWFeSIMMjQuMTkzLjI3LjUzKAEw-I7LnQU.&tag=2746637

http://ams1.ib.adnxs.com/click?AAAAAAAAGkAAAAAAAAAaQPLSTWIQWBpAAAAAAAAAGkAAAAAAAAAaQHHZzqyng0EarbP5AxnRsDo-sMVTAAAAACQsIgB2AgAAdgIAAAIAAAARkP8A1YYFAAAAAQBVU0QAVVNEANgCWgABYQAALrcAAgQAAQIAAIwAahhaiwAAAAA./cnd=!NQYJOwjA440CEJGg_gcY1Y0WIAQ./referrer=http://www.win-install.com/openoffice/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CK3n5p-Qo7TYOhACGPGyu-b69OCgGiINODYuNjguMTg3LjI0MigBML7glp4F&tag=2239524

http://nym1.ib.adnxs.com/click?AAAAAAAA4D-QwvUoXI_aP83MzMzMzAJAkML1KFyP2j8AAAAAAADgP7sFljBmaSNqi2EbsbQW_VJ-_7pTAAAAAA3pKQCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAA4dQAAgUAAQIAAJAANSbRfAAAAAA./cnd=!2wb-PQih24UCENfc1wcY4vsZIAA./referrer=http://www.punchng.com/news/page/6//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CIvD7YjL1sX-UhACGLuL2ITjrNqRaiIONzQuMTc3LjIzNy4xMDIoATD-_uudBQ..&tag=2746637

http://ams1.ib.adnxs.com/click?MzMzMzMzF0AzMzMzMzMXQAAAAAAAABxAMzMzMzMzF0AzMzMzMzMXQOH0npPMjkRQBWO4Gv7r0gFrGMRTAAAAABksIgB2AgAAdgIAAAIAAAARkP8A1YYFAAAAAQBVU0QAVVNEANgCWgABYQAAiLoAAgQAAQIAAIwApBphYgAAAAA./cnd=!NQYJOwjA440CEJGg_gcY1Y0WIAQ./referrer=http://www.pc-file.com/geogebra/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CIXG4dXh_7rpARACGOHp-5zJ2aOiUCIOODIuMjUwLjEyNy4xNjcoATDrsJCeBQ..&tag=2239513

http://nym1.ib.adnxs.com/click?AAAAAAAAOkAAAAAAAAA6QAAAAAAAADpAAAAAAAAAOkAAAAAAAAA6QHfeV7WzJW0WaPlljV32nCltMdFTAAAAACQsIgB2AgAAdgIAAAIAAABN7vUAuIYFAAAAAQBVU0QAVVNEANgCWgABYQAA_qQAAgQAAQIAAIwAyRYHhgAAAAA./cnd=!Ogb4OgiW3o0CEM3c1wcYuI0WIAQ./referrer=http://www.win-install.com/malwarebytes-antimalware/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1COjyl-vYy73OKRACGPe836q7tsm2FiIMNzQuMTEwLjEwLjYyKAEw7eLEngU.&tag=2239524

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CI_5vcnbptO3RRACGLy_zajdv4DACiIONzUuMTQ4LjEwMS4xMTQoATDGgMydBQ..&tag=3087481

http://lax1.ib.adnxs.com/click?F46tUJoJ9T9Lxa7hDHbxP6JFtvP91PY_S8Wu4Qx28T8Wjq1Qmgn1P7xfE9X9AYAKj3wvuTVNb0VGALNTAAAAAHkcLwCTBwAAdgIAAAIAAABX7vUA4n0GAAAAAQBVU0QAVVNEACwB-gC9LQAAM60AAgUAAQIAAJIABygEEAAAAAA./cnd=!qQZlOwjFhIYCENfc1wcY4vsZIAA./referrer=http://cdn.sharedaddomain.com/slider_anchored5_300x250_203.htm?cat=298&clientId=45c8dfe7-0bf1-4032-91d5-b0d03b3248fd&l=http://popnhop.com/7-best-boob-jobs-in-hollywood/10/&r=http://popnhop.com/7-best-boob-jobs-in-hollywood/9//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=lax1CI_5vcnbptO3RRACGLy_zajdv4DACiIONzUuMTQ4LjEwMS4xMTQoATDGgMydBQ..&tag=3087481

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=fra1COqLjNaS94O_RRACGOmE9tGBo4OWHyIOMTg4LjE5My4xNTUuNDQoATCu68WeBQ..&tag=3246096

http://fra1.ib.adnxs.com/click?mpmZmZmZuT_Xo3A9CtezPwAAAAAAAPA_16NwPQrXsz-amZmZmZm5P2mCPRoYDSwf6gXDKrkPfkWuddFTAAAAABCIMQCZBwAAdgIAAAIAAAB4kP8AkTkGAAAAAQBVU0QAVVNEANgCWgCO5AAAyswAAgUAAQIAAJIADSVvkAAAAAA./cnd=!hwZdPAi2sJUCEPig_gcYkfMYIAA./referrer=http://get.adobe.com/de/flashplayer/completion/aih//clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=fra1COqLjNaS94O_RRACGOmE9tGBo4OWHyIOMTg4LjE5My4xNTUuNDQoATCu68WeBQ..&tag=3246096

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CNCdqrv3mL7cOxACGNTn9P3tgq-kFiINODcuMTY1LjEyNy40MSgBMK_b-50F&tag=2239505

http://ams1.ib.adnxs.com/click?AAAAAAAAEkAAAAAAAAASQPT91HjpJhVAAAAAAAAAEkAAAAAAAAASQNQzvd8WvEgW0I5qd8f4uDuv7b5TAAAAABEsIgB2AgAAdgIAAAIAAAB4kP8AtYUFAAAAAQBVU0QAVVNEANgCWgABYQAASbcAAgQAAQIAAIwA9hqpZAAAAAA./cnd=!SQaJOwiQ4o0CEPig_gcYtYsWIAQ./referrer=http://www.download366.com/microsoft-office-2010/thanks/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=ams1CNCdqrv3mL7cOxACGNTn9P3tgq-kFiINODcuMTY1LjEyNy40MSgBMK_b-50F&tag=2239505

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGJj7r9SP-83RWiINNzQuMTA5LjIxOS41MigBMNH74J0F&tag=2746637

http://nym1.ib.adnxs.com/click?QbiEWuEd4j9Ob2Gb4RLeP83MzMzMzAJATm9hm-ES3j9CuIRa4R3iP5j9i_rYN6NaguPY26u1_TTRPbhTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAlKsAAgUAAQIAAJAAry0fewAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.solitairetime.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGJj7r9SP-83RWiINNzQuMTA5LjIxOS41MigBMNH74J0F&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGOztmd7hoMrkGiINNzQuMTA5LjIxOS41MigBMPWG150F&tag=2746637

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fPzMzMzMzMwNAqxxaZDvf3z8zMzMzMzPjP-x2xhsGKckaguPY26u1_TR1w7VTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAA8asAAgUAAQIAAJAAbyV--QAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.springsudoku.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGOztmd7hoMrkGiINNzQuMTA5LjIxOS41MigBMPWG150F&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGO7tlKqRuLLmBiINNzQuMTA5LjIxOS41MigBMKuE150F&tag=2746637

http://nym1.b.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fPzMzMzMzMwNAqxxaZDvf3z8zMzMzMzPjP-42RRXBycwGguPY26u1_TQrwrVTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAAltUAAgUAAQIAAJAAeCXyCQAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.solitairetime.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGO7tlKqRuLLmBiINNzQuMTA5LjIxOS41MigBMKuE150F&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGJKj4M6mzeOYSiIMNzEuMTYyLjcuMTk5KAEwwaDMnQU.&tag=2746637

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fP5qZmZmZmQVAqxxaZDvf3z8zMzMzMzPjP5IR2GlqjjFKguPY26u1_TRBELNTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAANsgAAgUAAQIAAJAAUSYPsgAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.solitairetime.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGJKj4M6mzeOYSiIMNzEuMTYyLjcuMTk5KAEwwaDMnQU.&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGPy9jsz31ZX_cyIMNzEuMTYyLjcuMTk5KAEwqJzMnQU.&tag=2746637

http://nym1.ib.adnxs.com/click?MzMzMzMz4z-rHFpkO9_fP5qZmZmZmQVAqxxaZDvf3z8zMzMzMzPjP_yeg3mvVv5zguPY26u1_TQoDrNTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAA2LUAAgUAAQIAAJAAeigDRgAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.springsudoku.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGPy9jsz31ZX_cyIMNzEuMTYyLjcuMTk5KAEwqJzMnQU.&tag=2746637

http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGMGbpeb-_pKbDSIMNzEuMTYyLjcuMTk5KAEw7KTHnQU.&tag=2746637

http://nym1.ib.adnxs.com/click?EcO4wzDu0z-gwD9v0YrQP5qZmZmZmQVAoMA_b9GK0D8Rw7jDMO7TP8FNyez3SzYNguPY26u1_TRs0rFTAAAAAA3pKQCTBwAAdgIAAAIAAABA7_UA4n0GAAAAAQBVU0QAVVNEACwB-gDztAAA6aQAAgUAAQIAAJAAiC4tywAAAAA./cnd=!EweyQQj01IYCEMDe1wcY4vsZIAA./referrer=http://www.springsudoku.com/?chromestore=1/clickenc=http://www.mydownloadhome.com/.../201?pub_id=90&sub_id=nym1CILH4969te3-NBACGMGbpeb-_pKbDSIMNzEuMTYyLjcuMTk5KAEw7KTHnQU.&tag=2746637

Latest 30 of 36 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.