home

setup.exe

AppCleaner

UpdateStar GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application setup.exe by UpdateStar GmbH has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from gsf-cf.softonic.com and multiple other hosts.
Publisher:
UpdateStar GmbH  (signed and verified)

Product:
AppCleaner

Version:
2.1.4932.29762

MD5:
a7698532de818db710d732f9e63aa6e5

SHA-1:
c967d982c771779963dad721374b34d5912b23ef

SHA-256:
3e5f9559d477bc678de8584b3ea5c489114547b5ea3cc0b33eb101b40082033b

Scanner detections:
2 / 68

Status:
Potentially unwanted

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 10:56:57 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
MalSign.InstallC
2015.0.3505

Reason Heuristics
PUP.Installer.UpdateStarGmbH.F
14.2.22.3

File size:
1 MB (1,057,664 bytes)

Product version:
2.1.4932.29762

Copyright:
Copyright UpdateStar GmbH.

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Nullsoft Install System)

Common path:
C:\users\{user}\appdata\local\temp\setup.exe

Digital Signature
Signed by:
UpdateStar GmbH

Authority:
COMODO CA Limited

Valid from:
1/2/2013 3:00:00 AM

Valid to:
1/3/2016 2:59:59 AM

Subject:
CN=UpdateStar GmbH, O=UpdateStar GmbH, STREET=Hauptstraße 20, L=Berlin, S=Berlin, PostalCode=10827, C=DE

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009ED227324380B40DDE36C8D31A33831F

File PE Metadata
Compilation timestamp:
12/6/2009 1:50:46 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:4rWjbyk6m49A8dLfToNgpZS6jTF8AsCnUBM23vqr7fu2CjrdPcJ4:yWjWkudLfkN8D2AL23ir7flCfd0i

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
6.7710

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file setup.exe has been seen being distributed by the following 8 URLs.

http://gsf-cf.softonic.com/c96/7d9/.../file?SD_used=0&channel=WEB&fdh=yes&id_file=322754&instance=softonic_en&type=PROGRAM&Expires=1481135280&Signature=HXMcTuT~0arYZ8sLRk6qkBAMU7Fy7iUS6cpCKOjX6sB4lBo2VZooF4wSM7IFBV54Xpohh6Lz6c~481tBTSH3zebCcR9FCaq9t1komN6mVjcqVm2mrDfiT~xeTH2sBl20E3vK5h1e9RcSZW1ugtaidikKd7HOKTDkoqXKtIjo2Pg_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=setup.exe

http://gsf-cf.softonic.com/c96/7d9/.../file?SD_used=0&channel=WEB&fdh=yes&id_file=322754&instance=softonic_br&type=PROGRAM&Expires=1465864239&Signature=Gx5ulyIVpJ4JS6Aclja01l46~49GrPBQXmYi5tDUF3NTmhX~STwQo8CCvNrHNNVgA0w4m5Evnmxms4oQAP6MfS4YkrYbKhThBn91~Rh0~E0DAUvM4LF7qZ0jEBlsad9cQR7gkrrrmitivOSqJZjiD2nDWE-a3V84Z8WULBu73ss_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=setup.exe

http://gsf-cf.softonic.com/c96/7d9/.../file?SD_used=0&channel=WEB&fdh=yes&id_file=322754&instance=softonic_en&type=PROGRAM&Expires=1468790227&Signature=WBI8~ek10XsXE73w0Ryx~A4entGLdFr2A2BWcC9t6H7-U2xTmjasFyHOzmGR4P0eYbCn9wpOm5Fh71S~76-Nid1UmiBGLFY5MYdI6--1rJM2RQowwyFjkaY-3ekBW1TPM5OmzDCfee9HZwXev8iSzSe41P1IyJ~-Db4-Z3pbsoc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=setup.exe

http://gsf-cf.softonic.com/c96/7d9/.../file?SD_used=0&channel=WEB&fdh=yes&id_file=322754&instance=softonic_en&type=PROGRAM&Expires=1442816856&Signature=b9SbybwDgw-LRx-JtMFRdE4eXR3R05EXX0m6y7RkrGHge5q8zdn8zo2llEL99K6syhhdpJAG-yKD8o6jAbGJd3djhRdLXYD9RN0tz2TIdd87m-SBYQit6cI948gN-1UIyznGpHV2V7uiY9ED~Hh445pX3SNh~L~mQjcjI8xf8NM_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=setup.exe

http://download1us.softpedia.com/dl/0ba5e2b4b5a3461b994537f2a6cd7d69/53b2e574/100190428/software/.../acsetup.exe

http://download1us.softpedia.com/dl/492f880c346e45007e50cb08361234a1/53d61f8e/100190428/software/.../acsetup.exe

http://client.updatestar.com/files/.../setup.exe

http://download.pcwelt.de/area_release/files/94/1E/.../appcleaner21.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.