home

setup.exe

wangjianfen

The application setup.exe by wangjianfen has been detected as adware by 16 anti-malware scanners. The file has been seen being downloaded from www.downrapid.com and multiple other hosts.
Publisher:
wangjianfen  (signed and verified)

MD5:
2e4779370545e3b5ff1d8e8d1dc99761

SHA-1:
bacaa50e0fb7946de12bd18127d1b7d2300c7578

SHA-256:
d47d4d7d23faf01bfa62e1395032e91c5802799b02f944996533424953ae25b7

Scanner detections:
16 / 68

Status:
Adware

Analysis date:
5/12/2024 4:34:19 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
APPL/Downloader.Gen
7.11.171.22

avast!
Win32:Adware-gen [Adw]
140908-2

AVG
Generic
2015.0.3341

Clam AntiVirus
Win.Trojan.Squarenet-7
0.98/19429

Dr.Web
Adware.Downware.8400
9.0.1.0267

ESET NOD32
Win32/SquareNet.C potentially unwanted application
8.7.0.302.0

F-Prot
W32/A-7d9416f7
v6.4.7.1.166

IKARUS anti.virus
PUA.SquareNet
t3scan.1.7.5.0

Malwarebytes
PUP.Optional.SquareNet
v2014.09.24.10

McAfee
SquareNet
5600.6997

Microsoft Security Essentials
Threat.Undefined
1.183.1804.0

Panda Antivirus
Trj/Genetic.gen
14.09.24.10

Reason Heuristics
PUP.Installer.wangjianfen.F
14.12.18.11

SUPERAntiSpyware
PUP.SquareNet
10339

VIPRE Antivirus
Threat.4150696
32210

File size:
317.6 KB (325,272 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
wangjianfen

Authority:
Unizeto Technologies S.A.

Valid from:
3/3/2014 12:00:00 AM

Valid to:
3/3/2015 12:00:00 AM

Subject:
E=info@eosmsg.com, CN="Open Source Developer, wangjianfen", O=wangjianfen, C=CN

Issuer:
CN=Certum Level III CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:
386A62E0B0A08C9F45A436674170DBB2

File PE Metadata
Compilation timestamp:
8/22/2014 6:34:43 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:eWafiWHr8bZknitH68otvZbonCdXQp5oObhfLTs85PnNnAsh9QR:dafiWHY3t688Zbop5oObx/s85PnWsUR

Entry address:
0x24CBB

Entry point:
E8, 28, A1, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, FF, 75, 08, FF, 15, 30, A1, 43, 00, 85, C0, 75, 08, FF, 15, AC, A0, 43, 00, EB, 02, 33, C0, 85, C0, 74, 0C, 50, E8, 96, 19, 00, 00, 59, 83, C8, FF, 5D, C3, 33, C0, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 0C, 53, 57, 8B, 7D, 08, 33, DB, 3B, FB, 75, 20, E8, 4E, 19, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 2F, F1, FF, FF, 83, C4, 14, 83, C8, FF, E9, 66, 01, 00, 00, 57, E8, E7, 90, 00, 00, 39, 5F, 04, 59, 89, 45, FC, 7D, 03, 89, 5F, 04, 6A...
 
[+]

Entropy:
6.5196

Code size:
227 KB (232,448 bytes)

The file setup.exe has been seen being distributed by the following 3 URLs.

http://www.downrapid.com/node/.../loader.exe

http://www.downswift.com/entry/.../index.html?offer_id=100037&aff_id=9982&transaction_id=9e1a090b-a37a-4a66-bc4a-48f044984edd

http://www.yupdownload.com/trace?offer_id=100037&aff_id=9982

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.