» Setup32.exe
Overview
Analysis
File Details
Network (7)

Setup32.exe

Setup Module

Babylon Ltd.

This is part of the Babylon web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application Setup32.exe, “Setup Application” by Babylon has been detected as adware by 2 anti-malware scanners. This is a setup and installation application and has been known to bundle potentially unwanted software. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. While running, it connects to the Internet address DedLoadLM2200.babylon.com on port 80 using the HTTP protocol.

File name:

Setup32.exe

Publisher:

Babylon Ltd. (signed and verified)

Product:

Setup Module

Description:

Setup Application

Version:

8.1.0.16

MD5:

0be3417e9c42627f8e20e3bebc5db506

SHA-1:

508d438a2dd891177efe8b2636c380503d1b1ce0

SHA-256:

50352faf1e284e6360cf57bb35e49a0c2ccf42d80f3dc25b11ac6182172b2be9

Scanner detections:

2 / 68

Status:

Adware

Explanation:

The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Analysis date:

4/25/2024 5:48:12 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/Toolbar.Babylon (variant)

8.9300

Reason Heuristics

PUP.Installer.Babylon.H

14.8.7.19

File size:

1.1 MB (1,106,360 bytes)

Product version:

8.1.0.16

Original file name:

Setup32.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\babylon\setup\setup32.exe

Digital Signature

Signed by:

Babylon Ltd.

Authority:

Thawte Consulting (Pty) Ltd.

Valid from:

2/11/2010 2:00:00 AM

Valid to:

3/10/2011 1:59:59 AM

Subject:

CN=Babylon Ltd., O=Babylon Ltd., L=Or-Yehuda, S=Or-Yehuda, C=IL

Issuer:

CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:

6BA9E210D535C6932A9CE11E3A78ED09

File PE Metadata

Compilation timestamp:

10/17/2010 4:09:42 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

12288:eGXWg18p2FTYrUzN3DdV/Xx3P7wRHKfeUDw4MkOH0iVcG5Wo6fZ59HGnPP7no/Ay:9IqX5/7wRqfjMDUhG5D6BmnPzL/36

Entry address:

0x4F54F

Entry point:

E8, E1, CB, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 55, 0C, 56, 8B, 75, 08, 57, 0F, B6, 06, 8D, 48, BF, 46, 83, F9, 19, 77, 03, 83, C0, 20, 0F, B6, 0A, 8D, 79, BF, 42, 83, FF, 19, 77, 03, 83, C1, 20, 85, C0, 74, 04, 3B, C1, 74, DA, 5F, 2B, C1, 5E, 5D, C3, 8B, FF, 55, 8B, EC, 53, 33, DB, 39, 5D, 08, 75, 04, 33, C0, EB, 41, 56, 57, FF, 75, 08, E8, 13, B8, FF, FF, 8B, F0, 46, 56, E8, 31, B7, FF, FF, 8B, F8, 59, 59, 3B, FB, 74, 22, FF, 75, 08, 56, 57, E8, C6, 2C, 00, 00, 83, C4, 0C, 85, C0, 74, 0D... 
[+]

Code size:

769 KB (787,456 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to LB2200.babylon.com (69.175.64.72:80)

TCP (HTTP):

Connects to DedLoadLM2200.babylon.com (184.154.27.235:80)

TCP (HTTP):

Connects to ba-sh-us-dc1-020.babsft.com (69.175.51.134:80)

TCP (HTTP):

Connects to ba-sh-us-dc4-010.babsft.com (65.60.2.78:80)

TCP (HTTP):

Connects to ba-sh-nl-dc1-.005.com (198.20.96.179:80)

TCP (HTTP):

Connects to ba-sh-nl-dc1-007.babsft.com (198.20.106.254:80)

TCP (HTTP):

Connects to ba-sh-nl-dc-006.babsft.com (107.6.141.14:80)

Remove Setup32.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.