home

setup.exe

Setup Module

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application setup.exe, “Setup Application” by Babylon has been detected as adware by 20 anti-malware scanners. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. It is also typically executed from the user's temporary directory.
Publisher:
Babylon Ltd.  (signed and verified)

Product:
Setup Module

Description:
Setup Application

Version:
9.1.4.7

MD5:
209f2a0c494a0de5ffca8ca9603ed182

SHA-1:
b3cb1c71d8dd526a35d6841a5de1b054829ed0da

SHA-256:
9c71f6bbe17926f54c7f1e168178f2feaa700c608b9727ce3dfc02677e393e10

Scanner detections:
20 / 68

Status:
Adware

Analysis date:
4/24/2024 4:50:03 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win32/Kashu.E
2014.07.24

avast!
Win32:Kukacka
2014.9-150524

Baidu Antivirus
Adware.Win32.Bbylon
4.0.3.15524

Bkav FE
W32.Clod2b6.Trojan
1.3.0.4562

Comodo Security
Application.Win32.Babylon.id
17372

Dr.Web
Adware.Searcher.2861
9.0.1.05190

ESET NOD32
Win32/Toolbar.Babylon.AD potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/Babylon
6/9/2015

K7 AntiVirus
Virus
13.181.12819

Malwarebytes
PUP.Optional.Babylon.A
v2015.05.24.04

Microsoft Security Essentials
Threat.Undefined
1.179.842.0

Norman
Sality.ZHB
11.20150524

Qihoo 360 Security
Malware.QVM19.Gen
1.0.0.1015

Reason Heuristics
PUP.Babylon.Installer
15.5.24.4

Rising Antivirus
PE:Win32.KUKU.kj!1522176
23.00.65.15522

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
9857

Trend Micro House Call
TROJ_GEN.F47V0927
7.2.144

Trend Micro
PE_SALITY.RL
10.465.24

Vba32 AntiVirus
suspected of Trojan.Downloader.gen
3.12.24.3

VIPRE Antivirus
Threat.4721115
31208

File size:
1.2 MB (1,280,560 bytes)

Product version:
9.1.4.7

Copyright:
Copyright © Babylon Ltd. 1997-2014

Original file name:
Setup32.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

Digital Signature
Signed by:
Babylon Ltd.

Authority:
Thawte, Inc.

Valid from:
2/12/2014 2:00:00 AM

Valid to:
3/8/2016 1:59:59 AM

Subject:
CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4A3CB79EE8B7A32A0263FE5D13CC5291

File PE Metadata
Compilation timestamp:
10/6/2014 1:42:17 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:NkqhDUsh0Z1DfEc0HYBSRZpTYtSKyilHwwkc9xIEX:NkqGe0j0cS3RYJXlHwwkaxIEX

Entry address:
0x6D74F

Entry point:
E8, F6, C3, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 30, 54, 4C, 00, E8, CB, FB, FF, FF, E8, 50, 31, 00, 00, 0F, B7, F0, 6A, 02, E8, 89, C3, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 3C, 39, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
5.7644

Code size:
587 KB (601,088 bytes)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.