home

setup.exe

The application setup.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from i.funmoods.com.
MD5:
c6499b9de6f6089c466a7c857db009f1

SHA-1:
f2f4da8f757acf83cf40ed27c1fecffd9b58fd17

SHA-256:
16e2eadd8897984e74498b71de4467a75b76a164333bd830dbacec5e11ae0f8c

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/26/2024 4:21:00 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
PUA/InstallCore.Gen
8.3.2.4

Dr.Web
Adware.InstallCore.64
9.0.1.0163

ESET NOD32
Win32/InstallCore.AU potentially unwanted (variant)
10.12883

Fortinet FortiGate
Riskware/InstallCore
6/11/2016

Reason Heuristics
PUP.InstallCore.ENG (M)
16.6.11.14

Rising Antivirus
PE:Malware.Generic(Thunder)!1.A1C4 [F]
23.00.65.16609

SUPERAntiSpyware
PUP.InstallCore/Variant
9088

Vba32 AntiVirus
BScope.Malware-Cryptor.InstallCore.2691
3.12.26.4

File size:
1.1 MB (1,105,496 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:jeKZ2IA2C8NhZHjxW/KMvfTykKa9TfT/ANGVNypbwxjpcxMshUSPco:jeu62C8NhNx+v7ykt9INGSj1OSP

Entry address:
0xCEB10

Entry point:
55, 8B, EC, 83, C4, F0, B8, 10, 65, 41, 00, E8, 32, E7, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.8511

Developed / compiled with:
Microsoft Visual C++

Code size:
847.5 KB (867,840 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://i.funmoods.com/fm/a4g/wr/.../Setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.