home

setup.exe

Pinball Corporation.

This is a component for the Pinball ad-supported platform which may deliver advertisemenst to the web browser in the form of banner and text ads. The application setup.exe by Pinball has been detected as adware by 37 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from origin-ics.mossysky.com.
Publisher:
Pinball Corporation.  (signed and verified)

Description:
Installer

Version:
2.0.550.0

MD5:
a0fda76ab04f127663e18d536b1fbab5

SHA-1:
e90e0906b9527ce068f534baa4d26892526afb08

SHA-256:
73700784cd9426cf3fe27f60226d8885f5cb841ec3840676b3f9b131f96b0335

Scanner detections:
37 / 68

Status:
Adware

Analysis date:
4/26/2024 6:46:06 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.7434036
861

Agnitum Outpost
Adware.Zango.Gen.3
7.1.1

AhnLab V3 Security
Adware/Win32.Hotbar
2014.09.27

Avira AntiVirus
ADSPY/AdSpy.Gen2
7.11.30.172

avast!
Win32:HotBar-CJ [PUP]
140908-2

AVG
Potentially harmful program Zango
2014.0.4025

Bitdefender
Trojan.Generic.7434036
1.0.20.1345

Clam AntiVirus
Suspect.W32.AdInstall.PBCXP
0.98/19441

Comodo Security
ApplicUnwnt.Win32.AdWare.Agent.DH
19626

Dr.Web
Adware.Hotbar.700
9.0.1.05190

Emsisoft Anti-Malware
Trojan.Generic.7434036
14.09.26

ESET NOD32
Win32/Adware.HotBar.K application
7.0.302.0

Fortinet FortiGate
Riskware/Zango
9/26/2014

F-Prot
W32/HotBar.S.gen
4.6.5.141

F-Secure
Trojan.Generic.7434036
11.2014-26-09_6

G Data
Trojan.Generic.7434036
14.9.24

IKARUS anti.virus
AdWare.Win32.HotBar
t3scan.1.7.8.0

K7 AntiVirus
Adware
13.183.13504

Kaspersky
not-a-virus:HEUR:WebToolbar.Win32.Zango
14.0.0.3191

Malwarebytes
Adware.Hotbar
v2014.09.26.09

McAfee
Adware-HotBar.f
5600.6995

Microsoft Security Essentials
Threat.Undefined
1.185.1205.0

MicroWorld eScan
Trojan.Generic.7434036
15.0.0.807

NANO AntiVirus
Trojan.Win32.Hotbar.rdqjj
0.28.2.62286

Norman
Pinball.A
11.20140926

nProtect
Trojan.Generic.7434036
14.09.26.01

Qihoo 360 Security
Malware.QVM11.Gen
1.0.0.1015

Quick Heal
Adware.Rugo.A
9.14.14.00

Reason Heuristics
PUP.Installer.PinballCorporation.F
14.9.26.20

Rising Antivirus
PE:Adware.HotBar!1.6AAD
23.00.65.14924

Sophos
ClickPotato Installer
4.98

Total Defense
Win32/Zango.Pinball[HOTBAR]
37.0.11200

Trend Micro House Call
HV_ZYX_BH012A00.TOMC
7.2.269

Trend Micro
HeurSpy_Zango-3
10.465.26

Vba32 AntiVirus
SScope.Injector.xg
3.12.26.3

VIPRE Antivirus
Threat.4672643
32938

Zillya! Antivirus
Adware.ScreenSaver.Win32.108
2.0.0.1934

File size:
221.2 KB (226,464 bytes)

Product version:
2.0.550.0

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\setup.exe

Digital Signature
Signed by:
Pinball Corporation.

Authority:
VeriSign, Inc.

Valid from:
3/31/2011 5:00:00 PM

Valid to:
5/19/2013 4:59:59 PM

Subject:
CN=Pinball Corporation., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Pinball Corporation., L=Bellevue, S=Washington, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
22E49C51DCD71B05713AAF786582D135

File PE Metadata
Compilation timestamp:
11/24/2011 9:01:09 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:GkK/OvQSGqUrdaGDpsOzDZrucAmurnuM/Uoryv:3MHlJaYpDzDZrucABTv/n2v

Entry address:
0x81070

Entry point:
60, BE, 00, D0, 44, 00, 8D, BE, 00, 40, FB, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.8858

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
212 KB (217,088 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://origin-ics.mossysky.com/NCIC/20111123185153494E434647493032_b4b665c1-dd93-4cfd-924b-e23b394ba4f5/.../setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.