home

Setup.exe

O S U

Traffic Space, LLC

The file Setup.exe, “ Open Software Updater” by Traffic Space has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This downloadble file is typically blocked through Google's Safe Browsing technology in Chrome web browser. The file has been seen being downloaded from softwareupdateproduct.com and multiple other hosts.
Publisher:
Traffic Space, LLC  (signed and verified)

Product:
O S U

Description:
Open Software Updater

Version:
3.1.0.0

MD5:
e1cb6deb560eaf4c0eeeb8e64061a360

SHA-1:
a60f1afaace53bfbfbe2361736fcbe03b39d2cf2

SHA-256:
1be5cacc769144872b4be84b0a862808a04792bb81d79cc05b0beda0bbdbb722

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/13/2024 9:28:43 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.TrafficSpace.Installer (M)
15.9.5.12

File size:
694.2 KB (710,888 bytes)

Copyright:
Copyright 2015

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Traffic Space, LLC

Authority:
Symantec Corporation

Valid from:
3/16/2015 5:00:00 PM

Valid to:
4/15/2016 4:59:59 PM

Subject:
CN="Traffic Space, LLC", O="Traffic Space, LLC", L=Woodcliff Lake, S=New Jersey, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6C4417841FFCEC12D6EFE825A6723A4E

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:yKatHI/2feC7lSzvqmvQ0U2dBjZP2dBToKI7SOI0WQdxdngf/LoOBnxfAiv3h4xB:yKaNDtlSRM2dV9IC5m0xwfT/Aiv3h4r

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9433

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file Setup.exe has been seen being distributed by the following 23 URLs.

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

http://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://cloud.securedownloadcdn.com/r.php?iGjlsydO1zrYzwDofvkD8zMc11KlDXZVDih6QvUS4mQDSt27YmL7WxkXz4ic2h8GApNqVIjZ49DXCF5B1QIYo2VX7daaujQ4JDvElOEqYhnAWtbYkUWIXRG44Reza5EUJaz5ZdvXuTyqmKoGElpBc6GhXUR80w2JHBOGPkEjecKAW9hBuHcGNSYLNPTOlWx2ymJnGnHUArvwAN74ukLidJ30yWOUTmXrIHPp5wkFXQbyDjC8DnqQ6tRFqGAk2yLLfBbk8wZ5mbE0ug98EAZL4Qruw1OzzAlPcw9k29qpl4qPlAYZaXKeNbJkdxTN8fCkLMFOW5eh9E7ue5to2eDQqmbDU4q2j3n5P2TL782hM9L1ffqhu38VqjykoZnI3KNSNHEVPHcCRYE6e5oJ8wEzQcTecgWf1K8PsNKiuXVlWzsbFQUNnymdLgsXwpdy9mnC98VE6Q02qsd5j8TGGgUrwmp3LDCV0Zx98sOejOhJgvPzDIgkZaLv

https://cloud.securedownloadcdn.com/r.php?abAiAwB2hsOtaGT513wr82hyfBXw8qUjCuBd1dfjG4NQKHWMKtdTvvrK7phfQczsGbFIoV24ZPVKwRwhkKaQgCBn2TDS5clMn0uMWxQVmMFTDcbYXmPdYqB1jeToreaPfFBbcs7zeMtSZEQW0F9Z6L0p0UOr9ZgoFSARkHrztVrszipAXzA4kBukwiLFi23XVDOgkgPObhhLzGmxfXBzy5U4oGJGJNDErsUMIKAU1SGAy27OZIoxOiCcZmSI9vmAXhnG1XA2QgCpjKditBQhUttTPlBZQYAOfXugV5jLmVaGGnY9ZPqUjTO8eq85oIUEGpVBvemSaxyQVxZVmqPFjEOy4WEtFy8lY3XtiklsRTiMqiINIyt2ciAhffKUNTgLWdfexAHpt0cUiUI1sb3EuEVJTGEHzUtw8ILGis5MshHLbpMDBQi5veOoVt5uny1whMczehlHz3tKsgo36H9BVX0Qr6lOFmlW9xvoPR5pUy9nOyqVgAxb

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/startdle.php

https://cloud.securedownloadcdn.com/r.php?15ByHmqlgei7Os3PA7lltyotk9V6hioin0R4nhqDwIKkaO9LVv7o4vRoFNvW5UftU6yhoYVUGGfQupCpVJOZfGnUuTRAN73HdBZCzUxgAM74cJu7sj6IZuDtnu3aC7SPIRsiMZymMFrZpW6SfdAeHdI5ILfkT8aBZCUMCs9o8AnxxupMHZ1pdJuVvKgoSq0S3UFFnO4vps2WWsIErK4FtzAZkRodhp6kjLZGz4cYweVtHD89ocOSMpR6ggjxFpSZbSGKWSJs7EWOi4XGhLy3aqarHuYmURl5J1QFUA81e4Px9NdqzMuKdFbU9ah41D9KE0qzAzAOEqlNdzeMmJwzpItySKCToME2N5CnFccjDy7R8mEu5a3uTx3LiGFGtkJgqlE5yQobow3xSH1YS5sLCwwVdcCGwmXWHB2grqsQWvnPcpN4ugQ7Mm3ZzFG61D3Jf50GvsxsYVhbl4fPk5X7s072GO8IrbrGgsnMUVfTRx4cCk1XqZ4T

https://softwareupdateproduct.com/campaign/.../fixdl.php

http://urlology.blob.core.windows.net/.../StartSetup.exe

https://softwareupdateproduct.com/campaign/.../fixdl.php

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.