home

setup.exe

viD PLAY

The application setup.exe by viD PLAY has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from get.sad1211.info.
Publisher:
EERMY  (signed by viD PLAY)

Product:
EERMY

Version:
9725.1596.879.9783

MD5:
3231f5310576f01f7b560d19b3ac25ae

SHA-1:
ea7a8897a31eb5e8239d6671411b90f44a1bb453

SHA-256:
e0e2e445f3f27b50f181660d28329d5885172724212fbb52bd294e1f7cfbe259

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/16/2024 4:43:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Outbrowse.Outborwse.Installer (M)
16.5.13.19

File size:
593.8 KB (608,096 bytes)

Product version:
9725.1596.879.9783

Copyright:
EERMY

Trademarks:
EERMY

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
viD PLAY

Authority:
thawte, Inc.

Valid from:
6/30/2015 1:00:00 AM

Valid to:
12/18/2015 12:59:59 AM

Subject:
CN=viD PLAY, O=viD PLAY, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
6B2D2D546ACA529FD98EE1FB0CCCE693

File PE Metadata
Compilation timestamp:
12/5/2009 11:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:d1ynROrzSp8aPD5x3Bw/D88dFQoA4nYWCaRbzPr6CDfk7:d16v865xxw/ZdFLAydRbPbDfG

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://get.sad1211.info/1441558662/.../1441558662?00249502855Z2VyLio6cHBkOCwmcDsvJy0yJFw4LTAyNzMdZz0vLjQvJm47LB1fMTspLCswMSRgKTgtLx5fLj0tLyJbLz0rKSFfNT0rLR1haWpdaVxtZTtvXG91bh5eZ2ljaWVbOHdDK09MRk5ASSs0Mi8oUEhHRy8zOkxVMB5kXm9uOy8nIXBwZDgsJmNtajQs

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.