» Setup.exe
Overview
Analysis
File Details

Setup.exe

Fileprotected

This adware bundler is distributed through Adknowledge's advertising supported software managers. The file Setup.exe, “Premium Installer ” by Fileprotected has been detected as adware by 40 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. This downloadble file is typically blocked through Google's Safe Browsing technology in Chrome web browser.

File name:

Setup.exe

Publisher:

Premium Installer (signed by Fileprotected)

Product:

Premium Installer

Description:

Premium Installer

Version:

2.4.8.1

MD5:

003e1245a41aa97ec8047d818eb06188

SHA-1:

7ae627e587659f15b0627e0a0a8968f5c467a905

SHA-256:

6e11be5665f8e4a7b1f3ab4dfe08e23ba04d63bd072c43ccf9a9e4d1bc28b818

Scanner detections:

40 / 68

Status:

Adware

Explanation:

This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/24/2024 4:57:19 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.25

5823004

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

Adware/Win32.IBryte

2014.11.22

Avira AntiVirus

ADWARE/Adware.Gen7

7.11.188.28

avast!

Win32:IBryte-HL [PUP]

141119-1

AVG

Found Win32/DH{gRKBEyAlflCBB3lUTxVRgQkcU04}

2014.0.4189

Baidu Antivirus

Trojan.Win32.Clikug

4.0.3.141122

Bitdefender

Gen:Variant.Application.Bundler.25

1.0.20.1625

Clam AntiVirus

Win.Adware.Ibryte-592

0.98/19086

Comodo Security

Application.Win32.Optimum.DS

20155

Dr.Web

Trojan.DownLoader11.43772

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.25

9.0.0.4570

ESET NOD32

Win32/Adware.iBryte.BS application

7.0.302.0

Fortinet FortiGate

W32/Malware_fam.NB

11/22/2014

F-Prot

W32/A-138dbbfa

v6.4.7.1.166

F-Secure

Gen:Variant.Application.Bundler

11.2014-21-11_6

G Data

Gen:Variant.Application.Bundler.25

14.11.24

IKARUS anti.virus

not-a-virus:AdWare.iBryte

t3scan.1.8.3.0

K7 AntiVirus

Unwanted-Program

13.185.13853

Kaspersky

Backdoor.Win32.Bredolab

14.0.0.2910

Malwarebytes

PUP.Optional.iBryte

v2014.11.21.09

McAfee

IBryte-FSW

5600.6939

Microsoft Security Essentials

TrojanClicker:Win32/Clikug.A

1.10401

MicroWorld eScan

Gen:Variant.Application.Bundler.25

15.0.0.975

NANO AntiVirus

Trojan.Win32.Badur.dhhunu

0.28.6.62995

Norman

IBryte.PDB

11.20141122

nProtect

Trojan.GenericKD.1618449

14.04.10.01

Panda Antivirus

Trj/Genetic.gen

14.11.21.09

Qihoo 360 Security

Win32/Trojan.Dropper.c9f

1.0.0.1015

Quick Heal

TrojanDownloader.Badur.A5

11.14.14.00

Reason Heuristics

PUP.Installer.Fileprotected.CC

14.11.21.23

Rising Antivirus

PE:Malware.iBryte!6.192B

23.00.65.141120

Sophos

Mal/Inject-CEE

4.98

SUPERAntiSpyware

PUP.OptimumInstaller/Variant

10222

Total Defense

Win32/Tnega.WHYEFHC

37.0.11219

Trend Micro House Call

TROJ_CLIKUG.A

7.2.326

Trend Micro

TROJ_CLIKUG.A

10.465.22

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.3

VIPRE Antivirus

Threat.4798837

34948

Zillya! Antivirus

Adware.iBryte.Win32.854

2.0.0.1790

File size:

375.9 KB (384,888 bytes)

Product version:

2.4.8.1

Bundler/Installer:

Adknowledge Fusion

Language:

English (United States)

Common path:

C:\users\{user}\downloads\setup.exe

Digital Signature

Signed by:

Fileprotected

Authority:

COMODO CA Limited

Valid from:

7/14/2014 1:00:00 AM

Valid to:

7/15/2015 12:59:59 AM

Subject:

CN=Fileprotected, O=Fileprotected, STREET=4600 Madison Ave FL 10, L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00EFEBA775B69C3717980399C96E5323EC

File PE Metadata

Compilation timestamp:

11/21/2014 3:00:19 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

6144:SOjFiv7qCQdW8UpzdWW3PpK8n1Ct9uLSnCJupdOFiDx:SOxizUdrCWW3PppneeSnmuZx

Entry address:

0x20431

Entry point:

E8, 3E, AC, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, E4, 73, 44, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 60, 70, 44, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63... 
[+]

Entropy:

6.4204

Code size:

277.5 KB (284,160 bytes)

Remove Setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.