home

setup.exe

Overall Media, Inc.

This is published and distributed via an Adknowledge's advertising supported (adware) software installer. The application setup.exe, “Fusion Install ” by Overall Media has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Adknowledge Fusion installer. The file has been seen being downloaded from 662014.installic.com.
Publisher:
Fusion Install   (signed by Overall Media, Inc.)

Product:
Fusion Install

Description:
Fusion Install

Version:
1.00

MD5:
0bd67b6706314d83bca000a0ae656339

SHA-1:
ea3467c23e25ba923589ed7149f3ed0f7034e734

SHA-256:
bc265c8c1e17e4e24e18f3ca7df9d4dab0d5316a4ff294a642d402585ab3664d

Scanner detections:
1 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/30/2024 8:42:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Adknowledge.OverallM.Installer (M)
16.5.9.13

File size:
56.3 KB (57,656 bytes)

Product version:
1.00

Copyright:
Copyright (C) 2014 Fusion Install

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Overall Media, Inc.

Authority:
COMODO CA Limited

Valid from:
5/14/2014 7:00:00 PM

Valid to:
5/15/2015 6:59:59 PM

Subject:
CN="Overall Media, Inc.", O="Overall Media, Inc.", STREET=855 Village Center Drv, STREET="Suite #336", L=St. Paul, S=MN, PostalCode=55127, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
20CC4646E1A4400DB7FA2D15D1C8F1CB

File PE Metadata
Compilation timestamp:
5/27/2014 3:57:23 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
384:/srBb2JXF5HZUgWaIYM4Ggm8qFWdMOf3OyBZhDlMLKy8/i+Q1l8ez9lb:fJXf53WaIB4XHMo3lg386+Q0U91

Entry address:
0x144C

Entry point:
68, 18, 18, 40, 00, E8, EE, FF, FF, FF, 00, 00, 48, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, B2, 2C, D5, C5, 21, 91, 9A, 43, 8A, AC, 24, 69, BA, 76, 4D, 50, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, 00, 00, 00, 00, 50, 72, 6F, 6A, 65, 63, 74, 31, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 90, 00, 00, 00, 00, 00, 00, 00, 02, 00, 00, 00, 01, 00, 00, 00, 30, 7C, 20, 59, 90, 53, 66, 4F, 8C, 94, 2D, 64, 5C, 5D, 8B, A8, 01, 00, 00, 00, A0, 00, 00, 00...
 
[+]

Entropy:
4.1846

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
20 KB (20,480 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://662014.installic.com/o/.../Setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.