home

setup.exe

Setup Module

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application setup.exe, “Setup Application” by Babylon has been detected as adware by 20 anti-malware scanners. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. It is also typically executed from the user's temporary directory.
Publisher:
Babylon Ltd.  (signed and verified)

Product:
Setup Module

Description:
Setup Application

Version:
9.1.3.12

MD5:
029c3581f627c7592fa34a5a884d934f

SHA-1:
b9bed5ef492ac6914772d24c5a1f409e54ed564d

SHA-256:
fe2c0dc33a0e55401c7d15abed21c12f0c644673b186bef14074b4a4759884ed

Scanner detections:
20 / 68

Status:
Adware

Analysis date:
4/20/2024 1:04:24 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win32/Kashu.E
2014.07.24

avast!
Win32:Kukacka
2014.9-160215

Baidu Antivirus
Adware.Win32.Bbylon
4.0.3.16215

Bkav FE
W32.Clod2b6.Trojan
1.3.0.4562

Comodo Security
Application.Win32.Babylon.id
17372

Dr.Web
Adware.Searcher.2861
9.0.1.046

ESET NOD32
Win32/Toolbar.Babylon.AD potentially unwanted application
10.7.0.302.0

Fortinet FortiGate
Riskware/Babylon
2/15/2016

K7 AntiVirus
Virus
13.181.12819

Malwarebytes
PUP.Optional.Babylon.A
v2016.02.15.03

Microsoft Security Essentials
Threat.Undefined
1.179.842.0

Norman
Sality.ZHB
11.20160215

Qihoo 360 Security
Malware.QVM19.Gen
1.0.0.1015

Reason Heuristics
PUP.Babylon.Installer (M)
16.2.15.15

Rising Antivirus
PE:Win32.KUKU.kj!1522176
23.00.65.16213

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
9322

Trend Micro House Call
TROJ_GEN.F47V0927
7.2.46

Trend Micro
PE_SALITY.RL
10.465.15

Vba32 AntiVirus
suspected of Trojan.Downloader.gen
3.12.24.3

VIPRE Antivirus
Threat.4721115
31208

File size:
1.1 MB (1,181,264 bytes)

Product version:
9.1.3.12

Copyright:
Copyright © Babylon Ltd. 1997-2014

Original file name:
Setup32.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\latest\setup.exe

Digital Signature
Signed by:
Babylon Ltd.

Authority:
Thawte, Inc.

Valid from:
2/12/2014 7:00:00 AM

Valid to:
3/8/2016 6:59:59 AM

Subject:
CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4A3CB79EE8B7A32A0263FE5D13CC5291

File PE Metadata
Compilation timestamp:
2/17/2014 3:52:27 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:cCTi/M5puuMel2uUwqlb2XNrbyIH94UwTq:cnM5pFMnlbkJ9H94UCq

Entry address:
0x62FFF

Entry point:
E8, 76, C1, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 78, E5, 4A, 00, E8, CB, FB, FF, FF, E8, 11, 2E, 00, 00, 0F, B7, F0, 6A, 02, E8, 09, C1, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, FC, 35, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
5.6673

Code size:
532 KB (544,768 bytes)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.