home

setup.exe

Setup Module

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application setup.exe, “Setup Application” by Babylon has been detected as adware by 19 anti-malware scanners. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. It is also typically executed from the user's temporary directory.
Publisher:
Babylon Ltd.  (signed and verified)

Product:
Setup Module

Description:
Setup Application

Version:
9.1.4.6

MD5:
af98f139ddd151db5231e822b922b740

SHA-1:
c2054c7fe6d96e2d0d7a5c597ab704dcb4858868

SHA-256:
092b6698b83cf358b2a1c6cdbea863320993268c01dd44a38c7abf2044b94300

Scanner detections:
19 / 68

Status:
Adware

Analysis date:
4/23/2024 2:41:53 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
Win32/Kashu.E
2014.07.24

avast!
Win32:Kukacka
2014.9-141011

Baidu Antivirus
Adware.Win32.Bbylon
4.0.3.141011

Bkav FE
W32.Clod2b6.Trojan
1.3.0.4562

Comodo Security
Application.Win32.Babylon.id
17372

Dr.Web
Trojan.StartPage.56734
9.0.1.0284

ESET NOD32
Win32/Toolbar.Babylon (variant)
8.9027

K7 AntiVirus
Virus
13.181.12819

Malwarebytes
PUP.Optional.Babylon.A
v2014.10.11.06

Microsoft Security Essentials
Threat.Undefined
1.179.842.0

Norman
Sality.ZHB
11.20141011

Qihoo 360 Security
Malware.QVM19.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Babylon.F
14.10.11.18

Rising Antivirus
PE:Win32.KUKU.kj!1522176
23.00.65.141009

SUPERAntiSpyware
Trojan.Agent/Gen-Nullo[Short]
10305

Trend Micro House Call
TROJ_GEN.F47V0927
7.2.284

Trend Micro
PE_SALITY.RL
10.465.11

Vba32 AntiVirus
suspected of Trojan.Downloader.gen
3.12.24.3

VIPRE Antivirus
Threat.4721115
31208

File size:
1.2 MB (1,233,968 bytes)

Product version:
9.1.4.6

Copyright:
Copyright © Babylon Ltd. 1997-2014

Original file name:
Setup32.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

Digital Signature
Signed by:
Babylon Ltd.

Authority:
Thawte, Inc.

Valid from:
2/11/2014 6:00:00 PM

Valid to:
3/7/2016 5:59:59 PM

Subject:
CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
4A3CB79EE8B7A32A0263FE5D13CC5291

File PE Metadata
Compilation timestamp:
9/3/2014 3:26:53 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:/lP4AEaph3713Uf6FQDMGUH+Sr7yUXKEWgqCGV:/lP4APz37I60nA+4pXK/glGV

Entry address:
0x6A6EF

Entry point:
E8, 86, BF, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 78, A6, 4B, 00, E8, CB, FB, FF, FF, E8, E2, 2C, 00, 00, 0F, B7, F0, 6A, 02, E8, 19, BF, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, CC, 34, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
5.7013

Code size:
566 KB (579,584 bytes)

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.