» setup.exe
Overview
Analysis
File Details
Downloads (6)

setup.exe

Digital Plugin SL

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe by Digital Plugin SL has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from z4lsan6u.gyw8rfu.com and multiple other hosts.

File name:

setup.exe

Publisher:

Digital Plugin SL (signed and verified)

Version:

1.0.0.1

MD5:

843f95717666446608d364ed77809883

SHA-1:

9e2f208fbb8886d78e42c58f8525f219ae53a750

SHA-256:

84ee317cbb8f1a40af87a4e41b2540e95c0dbcac75cb28f5a47cfafda0f1d457

Scanner detections:

26 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

6/3/2024 9:09:00 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.SoftPulse.2

839

AegisLab AV Signature

AdWare.W32.Agent

2.1.4+

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.DomaIQ

2014.10.19

Avira AntiVirus

APPL/Softpulse.Gen8

7.11.179.120

avast!

Win32:SoftPulse-AK [PUP]

141003-0

AVG

Generic

2015.0.3317

Bitdefender

Gen:Variant.Application.Bundler.SoftPulse.2

1.0.20.1455

Clam AntiVirus

Win.Trojan.Softpulse-57

0.98/21411

Dr.Web

Trojan.DownLoader11.36367

9.0.1.05190

ESET NOD32

Win32/SoftPulse (variant)

8.10584

F-Secure

Gen:Variant.Application.Bundler

11.2014-18-10_7

G Data

Gen:Variant.Application.Bundler.SoftPulse

14.10.24

IKARUS anti.virus

Trojan.Win32.Buzus

t3scan.1.7.8.0

K7 AntiVirus

Trojan

13.184.13727

Kaspersky

Trojan.Win32.Buzus

15.0.0.494

Malwarebytes

PUP.Optional.DomaIQ

v2014.10.18.11

McAfee

SoftPulse

5600.6973

MicroWorld eScan

Gen:Variant.Application.Bundler.SoftPulse.2

15.0.0.873

NANO AntiVirus

Trojan.Win32.LMN.dgkmmt

0.28.2.62671

nProtect

Trojan/W32.Buzus.1623056

14.10.17.01

Reason Heuristics

PUP.Installer.DigitalPluginSL.F

14.10.18.21

Sophos

SoftPulse

4.98

Vba32 AntiVirus

BScope.Adware.Softpulse

3.12.26.3

VIPRE Antivirus

Threat.4150696

33706

Zillya! Antivirus

Adware.Agent.Win32.14266

2.0.0.1959

File size:

1.5 MB (1,623,056 bytes)

Product version:

1.0.0.1

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Softpulse SoftwareBundler

Language:

English

Common path:

C:\users\{user}\downloads\setup.exe

Digital Signature

Signed by:

Digital Plugin SL

Authority:

Thawte, Inc.

Valid from:

5/25/2014 5:00:00 PM

Valid to:

5/26/2015 4:59:59 PM

Subject:

CN=Digital Plugin SL, O=Digital Plugin SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

4DFD897866A8F5930B794CCCDAA3E5A1

File PE Metadata

Compilation timestamp:

10/9/2014 3:11:04 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

24576:mzD5urNhRWx2Mk4JJQByw7Imlq3g495S0PwbphrpgXXOZuv/rTWeR5j4UwJZQUYY:u6/ye0PIphrp9Zuvjqa0Uidv

Entry address:

0x6978

Entry point:

E8, DB, 40, 00, 00, E9, 7F, FE, FF, FF, E9, B4, 26, 00, 00, FF, 35, 20, CD, 4A, 00, FF, 15, DC, 50, 41, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, D2, 38, 00, 00, 6A, 01, 6A, 00, E8, 7C, 47, 00, 00, 83, C4, 0C, E9, 93, 47, 00, 00, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, D3, 47, 00, 00, 59, 85, C0, 74, 0F, FF, 75, 08, E8, A6, 2B, 00, 00, 59, 85, C0, 74, E6, C9, C3, 6A, 01, 8D, 45, FC, 50, 8D, 4D, F0, C7, 45, FC, C4, 30, 4A, 00, E8, 4D, 2F, 00, 00, 68, 1C, 94, 4A, 00, 8D, 45, F0, 50, C7, 45, F0, BC, 30... 
[+]

Entropy:

7.4826

Code size:

76.5 KB (78,336 bytes)

The file setup.exe has been seen being distributed by the following 6 URLs.

http://z4lsan6u.gyw8rfu.com/7DeUEi4AYmSDI5GSCtnomT_fKr_3qR4tOCwswtQODLpqlhWSChfgSscRtuqPvEoEetQUP0vlRg_kaFMqxt6SLRyPQGQIYSDLqOQPnkP3IkOSAbYucCl3BiL91bSMQrsp?sbb=xYLBKPqmcNj5ZSKiyxkWVFPUPan7ULvF9JorwkZ2HG7cirHJDb1o123GbFMhap2MzuFWipbUjZPsaXbkZW5F3T1z2paQoGsZpAG0k5q6NkNLgPwC5yMdBwQIn4Yx0AOl4TkrdtpZBBlV1WbrRGSZjZ5OAfFGZ81s6Diu7IeWo9wBLqBGmyDoqnECUcbGS3us96oT2XEveuRGEi7dXUrynNTeCv1li6OZLGUPBiR4qfxtz86Wi1YLDn6rhrGyCz2eX1ZpCfxKyeYAllwnypotl0R4S3zXH0eMXszktndNWZ3gAWSnMJ2EvCOfLVtQwHYSu1CiXMWOVPjF6VzVbVQ5PMjHGnR95YrATmzlQgEdbF6PDAfEyGb7HgEnDCPch5MRTTttZcV3whrw82milhWxkeQLNvvk0xLdSoOOyjpYoZ09aKqhc2wTVxT8AUvplvoJWHpBomNT39JNSZS4q1DyGTTdxXFxXI0qoRoD5h7XW7YJRBlY9VJ4Dhk9bs44Yp3aGjgRrdzJrkdhIaJnzRadsE3G3uY4O59KBAwwXUdkyGtbR6UZ4yjVKMyB3I1dBljqNH7DeSGabDy5PbCYBsxt9x72w6FzA1wvFMY0ctHaBrtNKPzU0S58ESbkKgtVyN9c7BVM6FpHkWmwGjM2WFfeWKnhcXNrLsP8NjGDBzzk8kaA1zc2OSBR17X1tC40EE0KvbfeReDgVj2lR2Y9sPCl3WpGGgk3fke3vaPZKVKVKHvSejOw7XY45xm9OGX8NdDpe9e7yn2pBNRADawiqEL7rYy9d4Ycu66zQMJU0rn5LXFZ0oVpKPcoHSTpJrp1jXGoPvXaTqs

http://ttb.2s9z6f60hx.com/download/request/.../pGQ7tZMY?__tc=1413078307.887&lpsl=7cc9f57abb01bf094458fdf1c6d2a8fc&expire=1413164690&PubID=9700-1043&tgu_src_lp_domain=www.dwnllistsoft.com&ClickID=YnJzcj0zODQxJmJvPTEmY2lwaWQ9NDQ3MDAwJmNpc2lkPUVEQzM1NTU2RUIxNjMyODkxMTY2MTI4Mjc2NiZjaXJpZD1FREMzNTU1NkVCMTYzMjg5MjE5NTMxOTI1NjEmc2xpZD0wJnN1YmlkPTEwNDMmY2l1aWQ9OTg2MzI3NTIxNTI0ODM2Mzc2JnNvPTEmY3JpZD0xMTc3NzM4JmV4Y2lkPTIyJm1tdD0tMSZvc2lkPTUzMyZjbnRyeT0zOCZjaWNtcD0xNTQ5MzgmY3U0PTkmcHViaWQ9OTcwMA==&fileName=Setup

https://install.fusioninstall.com/o/.../setup.exe

http://yourinstaller.com/o/.../setup.exe

http://download1476endpoint.com/track/install?gluid=V/bq5WGDXRlEpKtEYFHwuCB7OY89n4owDBr3yKyTa3e IShZeT35dYG14x6aFnChL5LvQSLvU0pmofiKGe6LNdLNktcXlbkjWfs/3yVwtzf2opn1PM/Kx9foE6Voi09z8xDMt6z41lrrvqGtvNHK6lUREMLvRqKhqVPvuj0OI/EMFxDHgjkr792MscE1bW9yKBe6k5w7N/3wL/2V0rHmdQBt2XDqzQH5 vfdN9h2boT6dzMZ2Osf5ouIuvPr0CvxjDHCNMrPwfVOonxpGa088aFMTXiMdPLDw1dZy 3IwCF5/yEa7upOKJ7jm9FCgRGMczHOMWXSe2l2Ww8gRxG 6RL8N0vOPJQWICBLnPFHpub/bjhxREsuIgJKjh3HTVf3zN6o2P YvrwaaKtB2Y/squLMtUVwaMYh7q3pX9oBDSXo2737brgsEq9PZ4/x2y4Od7XHkD7koAWAZlkUen8M4VaEDhFxfvoiMSL19XW4L/CggTVhdYj86MzbE0DTKBM2YzzaqZlSJoyAbc3S0lwbpSG6F0xtVTPZuT/tJ 3gezadIp1 ya1IPn8aPUDiPuhK/2FRbN5xIIenHyFT0rKg8l/7sMi8KL1f 5I98EZJ4deDAm 9A pN58Q4x2nOxylxQJQvHRTjlbQ0s16Ig5A6Jc6tG2yGn2rSceES9pubbMhsnytywc3tiBTSLz7ERltHEe6JuT6M51wcRqfDY4nPYBx7KcimW4XK4gq6plWAGfJ3umgNKeQD/KYswGoO2XykZu2DeRP6i4XYz6InLqZUFp5Tb0lLZV7UAQH/fxubybpW3odGmWbR6lB10XankVxGL19ZKUYRonvkDrfD9t3jNQ==&dlink=http://yourinstaller.com/.../DriverPro_Pi

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.