home

setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from getfplayer.com and multiple other hosts.
MD5:
644c505467e484352816a70ec290cf1b

SHA-1:
5712ff82b074d8b439e6f216c8c115986d73ebc2

SHA-256:
24abde42b4be6eb1a5c497d8c001a6f18eca45f6ff9170fe9c4cb5363e85a0ee

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/26/2024 1:38:11 AM UTC  (today)

Scan engine
Detection
Engine version

SUPERAntiSpyware
Trojan.Agent/Gen-Downloader
10632

File size:
183 KB (187,429 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:YgXdZt9P6D3XJ8Ma0Xdsnr3yW/OK4UjeTv//XzlQFkFFu/HrJ6iXYgW3P5/2zBNp:Ye34/a0XqriW2KET/XCKb4vXnmPRb4

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.8757

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file setup.exe has been seen being distributed by the following 13 URLs.

http://getfplayer.com/get.php?c=ZnJvbT1vb28tc2V4LmJpejtsZnJvbT1vb28tc2V4LmJpejtpZGNoZWNrPTEzOTg3MTI5NTM7dnM9b29vLXNleC5iaXp8O0hzdENmYTIwMzg4Nzk9MTM5ODcxMjk1MjE3MDtIc3RDbXUyMDM4ODc5PTEzOTg3MTI5NTIxNzA7Y19yZWZfMjAzODg3OT1odHRwOi8vd3d3Lm9vby1zZXguYml6Lz9yZWY9MTh5by1naXJscy5jb207SHN0Q2xhMjAzODg3OT0xMzk4NzIwNzM2MzM2O0hzdFBuMjAzODg3OT0xO0hzdFB0MjAzODg3OT0yO0hzdENudjIwMzg4Nzk9MjtIc3RDbnMyMDM4ODc5PTI7dG89fHVybDtsYXN0X3VybD1jb250ZW50O1BIUFNFU1NJRD1hM2JhMGZiMGFjMmUzOWMwNmJhYzUzZDZmZDEwODU1YztIc3RDZmEyNTk4OTM4PTEzOTg3MjA3NjA1OTA7SHN0Q2xhMjU5ODkzOD0xMzk4NzIwNzYwNTkwO0hzdENtdTI1OTg5Mzg9MTM5ODcyMDc2MDU5MDtIc3RQbjI1OTg5Mzg9MTtIc3RQdDI1OTg5Mzg9MTtIc3RDbnYyNTk4OTM4PTE7SHN0Q25zMjU5ODkzOD0xO2luZGV4X3BhZ2U9MTtyb3RfaW49MTs=&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1oYXJkcG9ybnZpZGVvLnVzO2xmcm9tPWhhcmRwb3JudmlkZW8udXM7aWRjaGVjaz0xNDAwMzUwODgzO3ZzPWhhcmRwb3JudmlkZW8udXN8O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgzPTE0MDAzNTA4OTQ0MDQ7SHN0Q211MjAzODg4Mz0xNDAwMzUwODk0NDA0O2NfcmVmXzIwMzg4ODM9aHR0cDovL2hhcmRwb3JudmlkZW8udXMvO2xhc3RfdXJsPWNvbnRlbnQ7SHN0Q2xhMjAzODg4Mz0xNDAwMzUwOTEzODIxO0hzdFBuMjAzODg4Mz0yO0hzdFB0MjAzODg4Mz0yO0hzdENudjIwMzg4ODM9MTtIc3RDbnMyMDM4ODgzPTE7cm90X2luPTE7&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT16b29wb3JuLnVzO2xmcm9tPXpvb3Bvcm4udXM7aWRjaGVjaz0xMzk4NDYwNzM2O3ZzPXpvb3Bvcm4udXN8O19fQkhEPTE7bGFzdF91cmw9Y29udGVudDtpbmRleF9wYWdlPTE7&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1nYXljbm4uY29tO2xmcm9tPWdheWNubi5jb207aWRjaGVjaz0xMzk3OTQzMTA0O3ZzPWdheWNubi5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgwPTEzOTc5NDMxMDQ0OTY7SHN0Q2xhMjAzODg4MD0xMzk3OTQzMTA0NDk2O0hzdENtdTIwMzg4ODA9MTM5Nzk0MzEwNDQ5NjtIc3RQbjIwMzg4ODA9MTtIc3RQdDIwMzg4ODA9MTtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO2NfcmVmXzIwMzg4ODA9aHR0cDovL3d3dy5nYXljbm4uY29tLzt0bz18dXJsO2xhc3RfdXJsPWNvbnRlbnQ7cm90X2luPTE7SHN0Q2ZhMjU5ODkzOD0xMzk3OTQzMTE3ODkyO0hzdENsYTI1OTg5Mzg9MTM5Nzk0MzExNzg5MjtIc3RDbXUyNTk4OTM4PTEzOTc5NDMxMTc4OTI7SHN0UG4yNTk4OTM4PTE7SHN0UHQyNTk4OTM4PTE7SHN0Q252MjU5ODkzOD0xO0hzdENuczI1OTg5Mzg9MTs=&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1nYXliZWFyc3R2LmNvbTtsZnJvbT1nYXliZWFyc3R2LmNvbTtpZGNoZWNrPTE0MDAxNzMzOTA7dnM9Z2F5YmVhcnN0di5jb218O2luZGV4X3BhZ2U9MTtyb3RfaW49MTtIc3RDZmEyMDM4ODgwPTE0MDAxNzMzOTQwODk7SHN0Q2xhMjAzODg4MD0xNDAwMTczMzk0MDg5O0hzdENtdTIwMzg4ODA9MTQwMDE3MzM5NDA4OTtIc3RQbjIwMzg4ODA9MTtIc3RQdDIwMzg4ODA9MTtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO2NfcmVmXzIwMzg4ODA9aHR0cDovL2dheWJlYXJzdHYuY29tLzs=&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT13YXRjaGFtYXRldXJwb3JuLmNvbTtsZnJvbT13YXRjaGFtYXRldXJwb3JuLmNvbTtpZGNoZWNrPTEzOTkyMDU3ODg7aW5kZXhfcGFnZT0xO0hzdENmYTIwMzg4ODM9MTM5OTIwNTc4ODk2NjtIc3RDbGEyMDM4ODgzPTEzOTkyMDU3ODg5NjY7SHN0Q211MjAzODg4Mz0xMzk5MjA1Nzg4OTY2O0hzdFBuMjAzODg4Mz0xO0hzdFB0MjAzODg4Mz0xO0hzdENudjIwMzg4ODM9MTtIc3RDbnMyMDM4ODgzPTE7Y19yZWZfMjAzODg4Mz1odHRwOi8vd3d3LndhdGNoYW1hdGV1cnBvcm4uY29tLztsYXN0X3VybD1jb250ZW50O3RvPXxhYmNuYXN0eXNleC5jb207dnM9YWJjbmFzdHlzZXguY29tfHdhdGNoYW1hdGV1cnBvcm4uY29tfDtyb3RfaW49MTs=&id=2&exv=

http://www.onlinevideopctools.com/.../setup.exe

http://getfplayer.com/.../aW1hZ2VzLzR4M3gxMzQ5MzA7&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1kb2dwb3JuLnVzO2xmcm9tPWRvZ3Bvcm4udXM7aWRjaGVjaz0xMzk5MzAxMTczO3ZzPWRvZ3Bvcm4udXN8O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgzPTEzOTkzMDExNzk4NTc7SHN0Q211MjAzODg4Mz0xMzk5MzAxMTc5ODU3O2NfcmVmXzIwMzg4ODM9aHR0cDovL2RvZ3Bvcm4udXMvO0hzdENsYTIwMzg4ODM9MTM5OTMwMTIwMjM2NztIc3RQbjIwMzg4ODM9MjtIc3RQdDIwMzg4ODM9MjtIc3RDbnYyMDM4ODgzPTE7SHN0Q25zMjAzODg4Mz0xO3JvdF9pbj0xOw==&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1wcmV0ZWVuZ2lybHMuaW5mbztsZnJvbT1wcmV0ZWVuZ2lybHMuaW5mbztpZGNoZWNrPTE0MDEyMDY4MDE7dnM9cHJldGVlbmdpcmxzLmluZm98O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgzPTE0MDEyMDY4MDIxMTg7SHN0Q211MjAzODg4Mz0xNDAxMjA2ODAyMTE4O2NfcmVmXzIwMzg4ODM9aHR0cDovL3d3dy5wcmV0ZWVuZ2lybHMuaW5mby87bGFzdF91cmw9Y29udGVudDtIc3RDbGEyMDM4ODgzPTE0MDEyMDY4NDAyMzI7SHN0UG4yMDM4ODgzPTI7SHN0UHQyMDM4ODgzPTI7SHN0Q252MjAzODg4Mz0xO0hzdENuczIwMzg4ODM9MTtyb3RfaW49MTs=&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1zZXh5Z3Jhbm55dHViZS5jb207bGZyb209c2V4eWdyYW5ueXR1YmUuY29tO2lkY2hlY2s9MTM5ODE5NTcyMzt2cz1zZXh5Z3Jhbm55dHViZS5jb218O2luZGV4X3BhZ2U9MTtyb3RfaW49MTtIc3RDZmEyMDM4ODgwPTEzOTgxOTU3NDAxMTA7SHN0Q2xhMjAzODg4MD0xMzk4MTk1NzQwMTEwO0hzdENtdTIwMzg4ODA9MTM5ODE5NTc0MDExMDtIc3RQbjIwMzg4ODA9MTtIc3RQdDIwMzg4ODA9MTtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO2NfcmVmXzIwMzg4ODA9aHR0cDovL3d3dy5zZXh5Z3Jhbm55dHViZS5jb20vOw==&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1icmlnaWRhc3R1YmUuY29tO2xmcm9tPWJyaWdpZGFzdHViZS5jb207aWRjaGVjaz0xNDAwMjI3NTU4O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgzPTE0MDAyMjc1NjgzMzU7SHN0Q211MjAzODg4Mz0xNDAwMjI3NTY4MzM1O2NfcmVmXzIwMzg4ODM9aHR0cDovL3d3dy5icmlnaWRhc3R1YmUuY29tLztsYXN0X3VybD1jb250ZW50O3JvdF9pbj0xO0hzdENsYTIwMzg4ODM9MTQwMDIyNzU4ODIxNjtIc3RQbjIwMzg4ODM9MjtIc3RQdDIwMzg4ODM9MjtIc3RDbnYyMDM4ODgzPTE7SHN0Q25zMjAzODg4Mz0xO3RvPXx0cmFuc3NleHR1YmUuY29tO3ZzPXRyYW5zc2V4dHViZS5jb218YnJpZ2lkYXN0dWJlLmNvbXw7&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1hbGxiZXN0bWF0dXJlLmNvbTtsZnJvbT1hbGxiZXN0bWF0dXJlLmNvbTtpZGNoZWNrPTEzOTgyNzQyODM7dnM9YWxsYmVzdG1hdHVyZS5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgzPTEzOTgyNzQyODcyOTM7SHN0Q211MjAzODg4Mz0xMzk4Mjc0Mjg3MjkzO2NfcmVmXzIwMzg4ODM9aHR0cDovL3d3dy5hbGxiZXN0bWF0dXJlLmNvbS87bGFzdF91cmw9Y29udGVudDtIc3RDbGEyMDM4ODgzPTEzOTgyNzQyOTg1OTA7SHN0UG4yMDM4ODgzPTI7SHN0UHQyMDM4ODgzPTI7SHN0Q252MjAzODg4Mz0xO0hzdENuczIwMzg4ODM9MTtyb3RfaW49MTs=&id=2&exv=

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.