home

setup.exe

Fileangels

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application setup.exe, “Premium Installer ” by Fileangels has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from cpadominator.com.
Publisher:
Premium Installer   (signed by Fileangels)

Product:
Premium Installer

Description:
Premium Installer

Version:
2.4.8.1

MD5:
af722c1ba31918941c5325433f923034

SHA-1:
6e0a29f99c05c7fad088e8711b3f08500d934754

SHA-256:
be9f4cf0957cd19d7a4a6d14669faa1f84cd1ca8044ff4c51285d554d6f2802d

Scanner detections:
33 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 6:17:07 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.25
5727669

Agnitum Outpost
PUA.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.IBryte
2014.09.15

Avira AntiVirus
TR/Dropper.Gen
7.11.30.172

Arcabit
Trojan.Application.Bundler.25
1.0.0.425

avast!
Win32:Adware-gen [Adw]
2014.9-150609

AVG
Adware AdPlugin.BQZ
2014.0.4311

Bitdefender
Gen:Variant.Application.Graftor.152464
1.0.20.800

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Ibryte-6001
0.98/20557

Comodo Security
Application.Win32.AgentCV.HWYE
19489

Dr.Web
Trojan.iBryte.521
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.25
10.0.0.5366

ESET NOD32
Win32/Adware.iBryte.BO application
7.0.302.0

Fortinet FortiGate
W32/Zbot.AAN!tr
6/9/2015

F-Prot
W32/A-34fffba4
v6.4.7.1.166

F-Secure
Riskware.Gen:Variant.Application.Bundler
5.14.151

G Data
Win32.Adware.IBryte
15.6.24

IKARUS anti.virus
AdWare.AdPlugin
t3scan.1.7.8.0

K7 AntiVirus
Unwanted-Program
13.183.13345

Kaspersky
not-a-virus:AdWare.Win32.iBryte
15.0.0.543

Malwarebytes
PUP.Optional.OptimunInstaller
v2015.06.09.09

McAfee
Program.IBryte-FRT
17.6.569.0

MicroWorld eScan
Gen:Variant.Application.Graftor.152464
16.0.0.480

NANO AntiVirus
Riskware.Win32.IBryte.desauy
0.28.2.61942

Norman
Gen:Variant.Application.Bundler.25
02.06.2015 14:23:46

nProtect
Trojan-Clicker/W32.iBryte.83312.E
14.10.01.01

Quick Heal
TrojanDownloader.Badur.A5
6.15.14.00

Reason Heuristics
PUP.Adknowledge.Bundler
15.6.9.17

Sophos
PUA 'iBryte Optimum Installer'
5.15

Vba32 AntiVirus
AdWare.iBryte
3.12.26.3

VIPRE Antivirus
Threat.4778314
33706

Zillya! Antivirus
Trojan.Buzus.Win32.122155
2.0.0.1929

File size:
60.4 KB (61,808 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) Premium Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Fileangels

Authority:
COMODO CA Limited

Valid from:
7/13/2014 8:00:00 PM

Valid to:
7/14/2015 7:59:59 PM

Subject:
CN=Fileangels, O=Fileangels, STREET=4600 Madison Ave FL 10, L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1D54F646CB5A85211464AF0FDAB3D591

File PE Metadata
Compilation timestamp:
10/28/2014 7:00:30 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
768:LT2eJY2qY2rOyoI88MIONy3LMi5ccOaKv999999999999999999999999999999D:LT562qY2rOyoI88MJMOtNctqpqzDy8Ir

Entry address:
0x499B

Entry point:
E8, 48, 05, 00, 00, E9, 36, FD, FF, FF, CC, FF, 25, 3C, 61, 40, 00, FF, 25, 40, 61, 40, 00, CC, CC, 68, 0D, 4A, 40, 00, 64, FF, 35, 00, 00, 00, 00, 8B, 44, 24, 10, 89, 6C, 24, 10, 8D, 6C, 24, 10, 2B, E0, 53, 56, 57, A1, 1C, B0, 40, 00, 31, 45, FC, 33, C5, 50, 89, 65, E8, FF, 75, F8, 8B, 45, FC, C7, 45, FC, FE, FF, FF, FF, 89, 45, F8, 8D, 45, F0, 64, A3, 00, 00, 00, 00, C3, 8B, 4D, F0, 64, 89, 0D, 00, 00, 00, 00, 59, 5F, 5F, 5E, 5B, 8B, E5, 5D, 51, C3, 8B, FF, 55, 8B, EC, FF, 75, 14, FF, 75, 10, FF, 75, 0C...
 
[+]

Entropy:
5.9898

Code size:
18 KB (18,432 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://cpadominator.com/.../index.php?g=mplayeradc&src=ADC&kw=149483&lp=4

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.