setup.exe

The executable setup.exe has been detected as malware by 1 anti-virus scanner. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.lpmxp1002.com.
MD5:
c8a4a804e0334df0c093665af9301d5e

SHA-1:
dd49a0d37284361a24d509ed410ff1caf8785c4f

SHA-256:
ecfaf1cc31cd8a9bea2c7866e68d9438b2a699f79264593be3a22614e8a5c7c7

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
5/4/2024 10:27:39 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.4.23.17

File size:
1 MB (1,085,416 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
7/9/2014 1:42:35 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:gAkN7U/SF7uCIf5wzl/Lf3KWuIcD0vOFieuPFz3PoNEq9LpRiKottnD5UtsMpNqD:aQ/+Iw9zEIgFsPFz3bpRttNk4eG

Entry address:
0x53EC

Entry point:
E8, F6, 61, 00, 00, E9, 39, FE, FF, FF, E9, 85, 15, 00, 00, FF, 35, 90, 00, 43, 00, FF, 15, 28, 41, 42, 00, C3, FF, 35, 90, 00, 43, 00, FF, 15, 28, 41, 42, 00, 85, C0, 74, 02, FF, D0, 6A, 19, E8, 73, 59, 00, 00, 6A, 01, 6A, 00, E8, DF, 68, 00, 00, 83, C4, 0C, E9, F6, 68, 00, 00, 55, 8B, EC, 56, FF, 35, 90, 00, 43, 00, FF, 15, 28, 41, 42, 00, FF, 75, 08, 8B, F0, FF, 15, 24, 41, 42, 00, A3, 90, 00, 43, 00, 8B, C6, 5E, 5D, C3, 55, 8B, EC, 83, EC, 10, EB, 0D, FF, 75, 08, E8, 33, 6B, 00, 00, 59, 85, C0, 74, 0F...
 
[+]

Code size:
137 KB (140,288 bytes)

The file setup.exe has been seen being distributed by the following URL.

Remove setup.exe - Powered by Reason Core Security