» setup.exe
Overview
Analysis
File Details
Downloads (3)

setup.exe

Digital Plugin SL

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe by Digital Plugin SL has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from rflch5m.hpq81fs.com and multiple other hosts.

File name:

setup.exe

Publisher:

Digital Plugin SL (signed and verified)

MD5:

bca71b1bd4d05fc513ff7d02147e3a14

SHA-1:

46668fc31da340f44f198281c45aed11a21b1586

SHA-256:

bab4a21585f874fa0e59e6c5ce6368849aceb4f34bc650d1deea966c913a3158

Scanner detections:

24 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/1/2025 4:04:06 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.GL

816

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.SoftPulse

2014.11.11

Avira AntiVirus

APPL/Downloader.Gen

7.11.183.246

avast!

PUP-gen [PUP]

141025-0

AVG

Generic

2015.0.3294

Bitdefender

Application.Bundler.GL

1.0.20.1570

Dr.Web

Trojan.DownLoader11.36367

9.0.1.05190

ESET NOD32

Win32/SoftPulse.B potentially unwanted application

7.0.302.0

F-Prot

W32/A-27350659

v6.4.7.1.166

F-Secure

Application.Bundler.GL

11.2014-10-11_2

G Data

Application.Bundler.GL

14.11.24

IKARUS anti.virus

PUA.SoftPulse

t3scan.1.8.3.0

K7 AntiVirus

Trojan

13.185.13965

Kaspersky

not-a-virus:Downloader.Win32.DriverUpd

15.0.0.494

Malwarebytes

PUP.Optional.DomaIQ

v2014.11.10.12

McAfee

SoftPulse

5600.6950

MicroWorld eScan

Application.Bundler.GL

15.0.0.942

NANO AntiVirus

Trojan.Win32.Agent.dhyfaa

0.28.6.62995

Panda Antivirus

Trj/Genetic.gen

14.11.10.12

Reason Heuristics

PUP.Installer.DigitalPluginSL.K

14.11.10.12

Sophos

SoftPulse

4.98

Vba32 AntiVirus

Downloader.Agent

3.12.26.3

VIPRE Antivirus

Threat.4150696

34232

File size:

377.5 KB (386,512 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Softpulse SoftwareBundler

Common path:

C:\users\{user}\downloads\setup.exe

Digital Signature

Signed by:

Digital Plugin SL

Authority:

VeriSign, Inc.

Valid from:

9/24/2014 2:00:00 AM

Valid to:

7/29/2015 1:59:59 AM

Subject:

CN=Digital Plugin SL, O=Digital Plugin SL, L=Guia de Isora, S=Santa Cruz de Tenerife, C=ES

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

457A2C44F936DD8EEF974AFC80E53578

File PE Metadata

Compilation timestamp:

10/28/2014 9:47:36 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:4clplmpqjhAUlAVBUHKpi/ghUlsdZt/VZNwU8htyjuZisqpNRsYhk4Ijzb:3lplmpmHAVBVg/8ZXGyWisqaYhk4

Entry address:

0xEE6C0

Entry point:

60, BE, 00, B0, 49, 00, 8D, BE, 00, 60, F6, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Packer / compiler:

UPX 2.90LZMA

Code size:

336 KB (344,064 bytes)

The file setup.exe has been seen being distributed by the following 3 URLs.

http://rflch5m.hpq81fs.com/3KNE5t-ywzZmVDw8sTCnTxYREZe_Ji9u9YxhZ9T9e6dG1beY7DOdrRIiGXOKrLD5Ws32ZyQQnvwv6E_SYUDYo-8dviHZQluhQRJK_iKtVU4uC1cd2f2lpjYDfMY0Nvua?sbb=['UoBkM5pWvfRwmgYkBEqEg3OsrCZb5XMti7aXkILucDAFzbWl5ePuDFW7H4DWl5bNEMbzLhn8FjqzqOASqGK6XdR91mOMqxU5IfpiYbQGaKs9tfeyGzaoQC9WAh66GhNw8SsQ4katsBGakIyKKji5qxGcsHMk3wq9f7SSj4Iq2CE4y41ErHPZM2VU0H0mHfmcd9BoZWBVK8xaLVh8AyT8x4ZankNhGHnLbOCiKQpMxJwEzpvI8I5z3aozPzseoikCQXJVetZKMPWFSSuCDWAO93NlNLjwJ5u1JzSG6ijOSNacCzngtOe580urgvX8icK6VQ0NOvBXPiz7qIFSMk2cm0ZCJrGcDlBVvukjMjS1nRn8tgyzW3WbqWYztYb3SnSUthhBRk9nEoy0bYUKuNcdOVp3F6IfVPfPFsCYpRcM242hPCoqTnqaSt7W9shhG4Z7uIBt4zMnGph8Uk2k79jdyujgSbwlIWddtC5CCjeUJVMxsha6khK16I0RzRsfoE8uwhE1205C6nWrcTUYnM8dxAD9Kl1hBth406KAbN41OrC7ujUl3VAktRp9tDOIJmjlCeA6DMx8GLESnPvcwX57ltzkASc2pQHm9I3JoRyGqvwUvPIaanq0Ndp9YCqglpW0rlomT7ByHFJwQYfcu0JFJ4ZTSeN9Ow28mU6uY6jloszJeAddbUM8JFnmakJMd2C5g7VoJGhWVyHkdksSrJaAq8HUjpWbYXkfbZlvOnSVtFpJ8GTWceBW0Yn0EcCUq91sOOzcONf7MkWYXaC8Q1cz5EfyAWor9JH6XjKHKwTz5O8vAe1ZtCg2B5JhFcTOeLVygT

http://rflch5m.hpq81fs.com/3KNE5t-ywzZmVDw8sTCnTxYREZe_Ji9u9YxhZ9T9e6dG1beY7DOdrRIiGXOKrLD5Ws32ZyQQnvwv6E_SYUDYo-8dviHZQluhQRJK_iKtVU4uC1cd2f2lpjYDfMY0Nvua?sbb=UoBkM5pWvfRwmgYkBEqEg3OsrCZb5XMti7aXkILucDAFzbWl5ePuDFW7H4DWl5bNEMbzLhn8FjqzqOASqGK6XdR91mOMqxU5IfpiYbQGaKs9tfeyGzaoQC9WAh66GhNw8SsQ4katsBGakIyKKji5qxGcsHMk3wq9f7SSj4Iq2CE4y41ErHPZM2VU0H0mHfmcd9BoZWBVK8xaLVh8AyT8x4ZankNhGHnLbOCiKQpMxJwEzpvI8I5z3aozPzseoikCQXJVetZKMPWFSSuCDWAO93NlNLjwJ5u1JzSG6ijOSNacCzngtOe580urgvX8icK6VQ0NOvBXPiz7qIFSMk2cm0ZCJrGcDlBVvukjMjS1nRn8tgyzW3WbqWYztYb3SnSUthhBRk9nEoy0bYUKuNcdOVp3F6IfVPfPFsCYpRcM242hPCoqTnqaSt7W9shhG4Z7uIBt4zMnGph8Uk2k79jdyujgSbwlIWddtC5CCjeUJVMxsha6khK16I0RzRsfoE8uwhE1205C6nWrcTUYnM8dxAD9Kl1hBth406KAbN41OrC7ujUl3VAktRp9tDOIJmjlCeA6DMx8GLESnPvcwX57ltzkASc2pQHm9I3JoRyGqvwUvPIaanq0Ndp9YCqglpW0rlomT7ByHFJwQYfcu0JFJ4ZTSeN9Ow28mU6uY6jloszJeAddbUM8JFnmakJMd2C5g7VoJGhWVyHkdksSrJaAq8HUjpWbYXkfbZlvOnSVtFpJ8GTWceBW0Yn0EcCUq91sOOzcONf7MkWYXaC8Q1cz5EfyAWor9JH6XjKHKwTz5O8vAe1ZtCg2B5JhFcTOeLVygTULZpfc

http://ttb.mt6uzf7y6j.com/download/request/.../CJzxGx39?__tc=1414594277.477&lpsl=669112b38d7fc8e1509f0d6835ec2340&expire=1414680691&PubID=208448&tgu_src_lp_domain=www.softfinaldow.com&ClickID=u5455d32954351c992dde9ba84&fileName=Setup

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.