home

setup.exe

The application setup.exe has been detected as a potentially unwanted program by 20 anti-malware scanners. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from d24p1vpeyzkq4h.cloudfront.net.
MD5:
2f3cceaf541c209033f69d08a08e0b8f

SHA-1:
d79a846794014c862eb9e57a84fe9b3d55c43383

SHA-256:
16733925d79e5d6ff33e999195654c0381a9e0beab9aea08dbea9eb58ffb05a4

Scanner detections:
20 / 68

Status:
Potentially unwanted

Analysis date:
4/29/2024 12:06:09 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
ADWARE/DealPly.A.40933
8.3.2.2

Arcabit
Trojan.Application.Bundler.60
1.0.0.593

avast!
Win32:Adware-gen [Adw]
2014.9-160124

AVG
DiCrypt
2017.0.2854

Baidu Antivirus
PUA.Win32.DealPly
4.0.3.16124

Bitdefender
Gen:Variant.Application.Bundler.60
1.0.20.120

ESET NOD32
Win32/DealPly.BX potentially unwanted (variant)
10.12569

Fortinet FortiGate
Riskware/DealPly
1/24/2016

F-Prot
W32/DealPly.C.gen
v6.4.7.1.166

F-Secure
Gen:Variant.Application.Bundler
11.2016-24-01_1

G Data
Gen:Variant.Application.Bundler.60
16.1.25

IKARUS anti.virus
PUA.DealPly
t3scan.1.9.5.0

K7 AntiVirus
Adware
13.212.17858

McAfee
Artemis!2F3CCEAF541C
5600.6510

MicroWorld eScan
Gen:Variant.Application.Bundler.60
17.0.0.72

Qihoo 360 Security
HEUR/QVM05.1.Malware.Gen
1.0.0.1077

Rising Antivirus
PE:Malware.Generic/QRS!1.9E2D [F]
23.00.65.16122

VIPRE Antivirus
Trojan.Win32.Generic
45220

ViRobot
Adware.Dealply.104960.A[h]
2014.3.20.0

File size:
102.5 KB (104,960 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
3072:VBTmGQBQSp1OER4dxKT8e1Ov+J/4+g5O7LKn8r3caZNw:VB2QSaTxKT8Pv8/4+Kk3Jw

Entry address:
0x16870

Entry point:
55, 8B, EC, 83, C4, F0, B8, 10, 68, 41, 00, E8, 30, E2, FE, FF, E8, 67, BE, FE, FF, 3D, C1, 00, 00, 00, 0F, 85, D8, 00, 00, 00, 00, 2E, 79, 05, 70, B5, 7C, 00, 57, 66, 0C, 00, 67, B3, 7C, 00, 1E, 5F, 0D, 00, A7, 49, 7E, 00, 49, 98, 91, 00, 61, 47, 00, 00, 79, 78, 0C, 00, 00, 2E, 79, 05, 70, B5, 7C, 00, 57, 66, 0C, 00, 67, B3, 7C, 00, 1E, 5F, 0D, 00, A7, 49, 7E, 00, 22, B5, 7C, 00, 61, 47, 00, 00, 79, 78, 0C, 00, 00, 2E, 79, 05, 49, 98, 91, 00, 57, 66, 0C, 00, 67, B3, 7C, 00, 49, 98, 91, 00, A7, 49, 7E, 00...
 
[+]

Entropy:
6.8009

Developed / compiled with:
Microsoft Visual C++

Code size:
86.5 KB (88,576 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://d24p1vpeyzkq4h.cloudfront.net/.../setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.