home

spsetup.exe

Search Protect

ClientConnect LTD

The file belongs to the ClientConnect (Conduit/Perion) platform, a utility that bundles and monetizes search toolbars and browser add-ons. The application spsetup.exe by ClientConnect has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from dl.newstatsdemosrv.com and multiple other hosts. While running, it connects to the Internet address cms.dmccint.com on port 80 using the HTTP protocol.
Publisher:
Client Connect LTD  (signed by ClientConnect LTD)

Product:
Search Protect

Version:
2.19.30.69

MD5:
454a0a8296dd04b061141513a96779f9

SHA-1:
de07a45db8e9db4b0b8b99ddee6a0d7fe78c74fa

SHA-256:
b6ec14ca89359628eae03a378e12b22ac5fc627872cef0324ba1da8c7a81b68b

Scanner detections:
18 / 68

Status:
Adware

Explanation:
Bundles the Conduit Toolbar and/or Conduit Search Protect.

Analysis date:
4/18/2024 6:24:06 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.SearchProtect.R
759

avast!
Win32:Conduit-B [PUP]
2014.9-150106

Baidu Antivirus
Hacktool.Win32.Downloader
4.0.3.1516

Dr.Web
Adware.Conduit.45
9.0.1.06

F-Secure
Application.SearchProtect.R
11.2015-06-01_3

G Data
Win32.Application.SearchProtect.AA@gen
15.1.24

IKARUS anti.virus
PUA.Conduit.SearchProtect
t3scan.1.8.5.0

Kaspersky
not-a-virus:Downloader.NSIS.Agent
14.0.0.2681

Malwarebytes
PUP.Optional.SearchProtect.A
v2015.01.06.08

McAfee
Artemis!454A0A8296DD
5600.6893

MicroWorld eScan
Application.SearchProtect.R
16.0.0.18

Panda Antivirus
Trj/CI.A
15.01.06.08

Qihoo 360 Security
Win32/Application.7ea
1.0.0.1015

Reason Heuristics
PUP.Installer.ClientConnect.H
15.1.6.20

Sophos
Conduit Search Protect
4.98

Trend Micro House Call
Suspicious_GEN.F47V0106
7.2.6

VIPRE Antivirus
Conduit
36442

Zillya! Antivirus
Trojan.Katusha.Win32.36166
2.0.0.2027

File size:
7.5 MB (7,854,784 bytes)

Product version:
2.19.30.69

Original file name:
Search Protect Search (R)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\content.ie5\6v1sttnl\spsetup.exe

Digital Signature
Signed by:
ClientConnect LTD

Authority:
VeriSign, Inc.

Valid from:
12/31/2014 4:00:00 AM

Valid to:
12/27/2016 3:59:59 AM

Subject:
CN=ClientConnect LTD, OU=Safe Search, O=ClientConnect LTD, L=Ness Ziona, S=Israel, C=IL

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
354F4C7E49A131A6E4BF89B253C78A2D

File PE Metadata
Compilation timestamp:
7/6/2011 6:31:20 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
196608:P3WtQ+VqSRU7NmAu7BZZZYxvih1Gt57KQq/:PwQKqSi7NmAu7DjYxu4D4

Entry address:
0x354B

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 84, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 98, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 86, 40, 00, FF, 15, 80, 81, 40, 00, 68, 04, 86, 40, 00, 68, A0, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Entropy:
7.9943

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file spsetup.exe has been seen being distributed by the following 7 URLs.

http://dl.newstatsdemosrv.com/50/all/cp/.../setup.exe

http://s3.amazonaws.com/www.informativesetup.com/.../STS.exe

http://d1vvmh84tatj87.cloudfront.net/.../STS.exe

http://113.171.224.204/.../SPSetup.exe

http://kmp.de.resource-efiles-drive.com/35/333/CT3332535/KMP/Downloads/External/1.0.0.0/.../Setup.exe

http://sp-storage.spccint.com/Installer/.../Setup.exe

http://sp-storage.spccinta.com/Installer/.../SPSetup.exe

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):
Connects to cms.dmccint.com  (23.67.242.80:80)

 
http://cms.dmccint.com/DynamicOffer/15894632/15915755/?mainofferId=15891198&CurrentStep=2&TotalSteps=4&DownloadBrowser=IE&CType=-1&UserMode=-1&DMVersion=1.3.5.59.15914621.01&Language=US-EN

Remove spsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.