home

setup.exe

InstallVibes

This is the installer and setup program from the InstallVibes branded Yontoo adware web browser extension. This adware injects various forms of advertisements in the user's web browser based on the HTML content and URLs viewed. Ad include banners, in-line context text links, coupons, and search. The program will install an auto-updating background service that will update the software with additional features. The application setup.exe by InstallVibes has been detected as adware by 26 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software.
Publisher:
InstallVibes  (signed and verified)

MD5:
2c0323b74da6b66093f20dec751cad4c

SHA-1:
964848dbf2f3565c8ca6b1ecdb74629a114ff0ac

SHA-256:
5e6a848bd58d5b55aa3ef68458e4a76e90ba80a0fa7cb6f743c59fb89597c6fa

Scanner detections:
26 / 68

Status:
Adware

Explanation:
Belongs to the Sambreel/Yontoo progam that inserts various forms of advertising in the user's web browser, installed with minimal or no user consent.

Analysis date:
4/25/2024 1:24:10 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.12390473
6498366

AhnLab V3 Security
Win-PUP/Bundlore
2015.02.01

Avira AntiVirus
APPL/Downloader.Gen9
7.11.206.64

avast!
Win32:Malware-gen
150101-1

AVG
Bundlo
2016.0.3213

Bitdefender
Trojan.Generic.12390473
1.0.20.155

Clam AntiVirus
Win.Trojan.Bundlore-18
0.98/21511

Comodo Security
Application.Win32.Bundlore.L
20910

Dr.Web
Adware.Downware.7973
9.0.1.05190

Emsisoft Anti-Malware
Trojan.Generic.12390473
9.0.0.4799

ESET NOD32
Win32/Bundlore.M potentially unwanted application
7.0.302.0

F-Prot
W32/A-036e92b3
v6.4.7.1.166

F-Secure
Trojan.Generic.12390473
5.13.68

G Data
Trojan.Generic.12390473
15.1.25

K7 AntiVirus
Unwanted-Program
13.193.14818

Kaspersky
not-a-virus:Downloader.Win32.InstallVibe
15.0.0.543

Malwarebytes
PUP.Optional.Bundlore
v2015.01.31.08

McAfee
PUP-FLY
5600.6869

MicroWorld eScan
Trojan.Generic.12390473
16.0.0.93

NANO AntiVirus
Trojan.Win32.InstallVibe.ddtibg
0.30.0.65070

nProtect
Trojan.Generic.12390473
15.01.30.01

Reason Heuristics
PUP.Installer.Yontoo
15.1.31.8

Sophos
PUA 'Bundlore'
5.09

Vba32 AntiVirus
Downloader.InstallVibe
3.12.26.3

VIPRE Antivirus
Threat.4150696
36694

Zillya! Antivirus
Downloader.InstallVibe.Win32.13
2.0.0.2049

File size:
263.3 KB (269,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
InstallVibes

Authority:
COMODO CA Limited

Valid from:
3/20/2014 2:00:00 AM

Valid to:
3/20/2016 1:59:59 AM

Subject:
CN=InstallVibes, O=InstallVibes, STREET=Ehad Haam 21 St., L=Tel Aviv, S=Israel, PostalCode=6515103, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00F29201EBC1EAD2B751F2854AD68C6244

File PE Metadata
Compilation timestamp:
7/13/2014 11:57:51 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:lryA1BncZbS4btIxFuWZZvGBcV6aSaOlo1h:lrysBnUSDuW7OBa6aWof

Entry address:
0x575F

Entry point:
E8, B9, 48, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 68, C3, 41, 00, E8, CB, 1D, 00, 00, E8, A0, 2F, 00, 00, 0F, B7, F0, 6A, 02, E8, 4B, 48, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 0A, 40, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.4523

Code size:
82 KB (83,968 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to wac.edgecastcdn.net  (72.21.81.13:80)

TCP (HTTP):
Connects to service.yontoo.com  (8.25.35.148:80)

TCP (HTTP):
Connects to api.yontoo.com  (8.25.35.15:80)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.