home

setup.exe

Emanuil Hristov

The application setup.exe by Emanuil Hristov has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Nullsoft Install System installer. This particular feature is designed to hijack the browser in an attempt to prevent other resources from modify the browser's search and home pages. The file has been seen being downloaded from fvpn-connect.software.informer.com.
Publisher:
Emanuil Hristov  (signed and verified)

MD5:
69abe927552e7a211b936d89b3d9d0b0

SHA-1:
5400a358521e20b14f922f5008474d87caa96227

SHA-256:
384e9a8388d4d7858e7bda2e51c6f53f872d71c98315dd59c13680e4e47efed1

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
5/18/2024 10:45:54 PM UTC  (today)

Scan engine
Detection
Engine version

IKARUS anti.virus
PUA.SearchProtect
t3scan.2.0.9.0

Reason Heuristics
Threat.Win.Reputation.IMP
16.11.30.8

File size:
730.9 KB (748,432 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Nullsoft Install System

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Emanuil Hristov

Authority:
StartCom Ltd.

Valid from:
2/1/2015 9:41:27 PM

Valid to:
2/2/2017 5:02:54 AM

Subject:
E=office@media-evo.net, CN=Emanuil Hristov, L=Sofia, S=Grad Sofiya, C=BG

Issuer:
CN=StartCom Class 2 Primary Intermediate Object CA, OU=Secure Digital Certificate Signing, O=StartCom Ltd., C=IL

Serial number:
1054F386D55503

File PE Metadata
Compilation timestamp:
5/8/2010 5:56:39 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
12288:/0IWLYSNFcnuvsHxJTkKxh9xszT/CwvyOSkKjgHw+1DYiLMM3qzXNrVZLnT5M:/0IWLRNBsE0hwzT/Z6EBXwDjNPTK

Entry address:
0x3E3F

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, AC, 01, 00, 00, E8, B0, 5D, 00, 00, C7, 04, 24, 01, 80, 00, 00, E8, 04, 57, 00, 00, 53, C7, 04, 24, 00, 00, 00, 00, E8, E7, 5D, 00, 00, A3, 04, 08, 43, 00, 51, C7, 04, 24, 08, 00, 00, 00, E8, 27, 32, 00, 00, A3, B4, 08, 43, 00, 8D, 85, 84, FE, FF, FF, 52, C7, 44, 24, 10, 00, 00, 00, 00, C7, 44, 24, 0C, 60, 01, 00, 00, 89, 44, 24, 08, C7, 44, 24, 04, 00, 00, 00, 00, C7, 04, 24, 4C, B2, 40, 00, E8, 81, 5C, 00, 00, 83, EC, 14, C7, 44, 24, 04, 4D, B2, 40, 00, C7, 04, 24, E4, 08...
 
[+]

Entropy:
7.9640  (probably packed)

Code size:
35.5 KB (36,352 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://fvpn-connect.software.informer.com/.../

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.