home

vdownloader_setup.exe

Catuhacun

Setup Alpha ((New Media Holdings Ltd)

The application vdownloader_setup.exe, “Catuhacun Setup ” by Setup Alpha ((New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.vaultbytehead.com and multiple other hosts.
Publisher:
Setup Alpha ((New Media Holdings Ltd)  (signed and verified)

Product:
Catuhacun

Description:
Catuhacun Setup

Version:
4.7.1.5

MD5:
9dcd79166aa4a3185349f6415abfaf53

SHA-1:
95d04e0abe237cccfc5b6f2b2b8f5158a5672324

SHA-256:
1dda1e2378e19c0391dc8f2822115ecd1b1f358e64bd459f2b1ff448bea36ab8

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/20/2024 11:20:49 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.5.22.14

File size:
1.3 MB (1,344,856 bytes)

Product version:
3.6

Copyright:
Wizard Lite Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\vdownloader_setup.exe

Digital Signature
Signed by:
Setup Alpha ((New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 10:41:44 PM

Valid to:
5/25/2016 8:42:13 PM

Subject:
CN=Setup Alpha ((New Media Holdings Ltd), O=Setup Alpha ((New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216F55CB04783E0F0E5AC4C45115E1BCCC

File PE Metadata
Compilation timestamp:
6/20/1992 7:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:qd0glPmINSKRkXb/2JKqTnWb875uqzslsBc2qPx0hOtNj0Rpv:qqcRkXFqTWbmuq5BclHN6pv

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file vdownloader_setup.exe has been seen being distributed by the following 50 URLs.

http://www.vaultbytehead.com/c?x=m2FmHu1jbKwhtffQXqqG7twzzHf00RSGVJMxqegZ6RM=&c=UBR2/dqtwJ2XirIXIYiLeam38y1v38Eel8/NKLo4KlY/yuW8qsj6APNve19ZA7LeSx5VA8EmFmsP8ZBnTlzqBW0UtGYJT6ZLS/TeowRwl4jyxcb/H8ehgz8/DObrDeEmzl2f46D7K62v6Spj1WwIHCfqDOQyzwHVjOxcz4j xw4=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=6FTsioCufhnTutnEJ/a0Rg94zDMwpUFBOKq4CeY2lXo=&c=HNYVMguRn2UxO36T827yYR9Huv3m4475Lv/TFcq/ypj8Xh8fK2bgvQSXdQq9NIYEVb9jTAnGgpRg392A7PgP8nw98Zic1LBXiT9LvKXNJGFfbWsFmeUsp9V1P4Qh1i1jdvw/oN/mRfy9JKDDivR39/3hRCTzPErrxuaAwYm0rDo=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=Aa6HBD8cqzsSuVCdLVLbrTHcITqTET3MCDsOMon3opw=&c=tfIeCC5frzgCsLWwnG1c7R/Yq0ebCEjWGqIK4mzd95a rkNCi0mD Ps1G7hrNu9gdUdaolzCVOV7vC6jyEGGkHR8WSoB282GxkMR6kaQPVbqve2UMeNHEp2EGbjlZeA4yuswWeM2keJItcGZbhKQymwNact2l20S7yx3SsVCZ6E=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=/jUPAPAAZRPiZ9N SvM5 7Agjqrd0QTbNvtvmL7Iss4=&c=DXhP5UaspjY0JdT7qKT7fW1EQb2oDAqdTYmIUI6K5vJoFZM1YMZINDjMWahebFyiFo VnZ6c48l4iO0ULojdonFrCZMrp83ItSduICldRhIlFmVFHsKD5on75ib3fd6DsREqJ/u5DAak7quKJ2PI0KWMxRCIyoP7D3qSFH9ByZQ=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=giVbBaAwLPq6CJ37BNsI9Zt1/xMwXZBR2LnfvXpi0zI=&c=W/XT54qEja1MpX0kPccWmqVRWLtmHanNP9piLV3Ftvs1CBNAiiPNL8p1ZNIQFxYPK/ZrUird6qXVdZPXoH3IFkk3FuiSqH4TgRihvlFUNjjE41uxI77CnRIBYSsnL1TAVs91fZPqtcQ3A/5igC0rhVX4LhqHboqxRkQ1yo ft c=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=RqChjRkJ6DtlbgqidMRsQqMna U80vzqbC2pzcFAhu0=&c=mf171CKS/D11OP5NyFlvH3QKQEE0D6p6JatHnLdi1697gnMswSii6Sz/Ver99kzzxLmJMLX5P7C1UA50Pj2PORc1o kJTSUiOwOaNIR987Zz0wZWqgI3VL4EmJDcg3a2kwr23nv2yaLMoHcjD9CdefUCpn4Z/vdicuNbbA1ywuM=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=L42YaZ 5jHebnDPFHZjOBSCd0JQiNUu0fKdWzJI0Nz0=&c=l2e2RTqdj cL3aaL5iotAdoKCYPn DKBiG5ywhAnW5/WRKBU0fl0eDXbZRhcOFSjAbWOnMkReBPpkqgJl5mpetXhnp7TCa/MGuWXClXWEzcPjvpZnP43cpBiyS4Ll9KJCg48t wveqQKlvCLQfPdc0s1fy1TWj2jaBfP2RX2 Ow=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=qaMWXe1E8UAFFiTAQIZGRhgzW763fpRr4ybE3rlRig4=&c=GYXyocBweOzM0Q8N3vUpXgJdsh1ZFQ7xl2e523qucnG1IaJjP3Jbut g5iNwTrTR7rN2JznNW6A AK9r2OXOSWxWPYboqv2pBGENTR8C9sHoYMszxSmoesMTxnzDcii39vWSnO56VSkYpqZyTWh1tw==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=PKUY8sTIW2ABVxndOflWVGGszWNTbibTPik4h0ekC5U=&c=c7wLWyzOhZNayLO0W/jMu0viFQFm7NR9NZl3bdmV mXrHz0WtKFFHXtG7CR4Drpdfl910EFCL7onnBdsdlS6tOyjulngQj1y4/mO2qcpp5fZlBHq3X5BLoao2qTMVJwD8p8ppRP3bpYF9L20i/Wa9V/knTeBS7V0J09B/JWGO0c=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=jclPkOk6dXRRbw1q8YNQnYNh3ek6NjIjNnn4ytD6RSY=&c=oltcnp/xqNil1ATnWOTBntL02ZG18Ho3qs4EQNJh/Sn85yTNCfjlou2vq8vfNjfZFGYnMX5MjatAIiiXw0vM1hBee6bEN7EVLo29uDA2DHgJ635aqrjM/O6q E10/WRS9zIoBcv5FpyZspYZx0ExHw==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=0uz5D MDeqTL16OmXKlDHyEmYTszWz5VQsNGSB9by3Y=&c=mM0GcAa7PMjvyaDHquyjG/8IARGNDfxalcXKxZo7Y8VdVpH47npOKhl5p7pr9q3bZHUR45yZ1IolOU788HfChQkvWW4T3uEIoRD12D5/29OxwOT96To0 KfbC8ZzknavMym3i44iaXJIYmGvsEjhyF8D2AHtjG2Qe2kabFHIGjs=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=UrFcA2HOrWW77PvxATMGhCrPpWhYAei85f9ozBXLLvE=&c=XZqn3bBlxdbqgRwjsnNGSCtz0dqaSf4KLGPRhHvRXLc/BtlsFJfGfUva5T/pE5Bv9wXADJ1LAs8irlqiCe5gE00wLOso8bbOy6FUE/nZgnnV1B71ty526cuAyU2jryHcQPXxVJhKp4E2p vZ9BSXeJL/V6q9QcUjkMEhXu6lB54=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x= mmUUzMRfDtM5KBbUz0BE0vguzC9Q5ox30Uzo5l/jeY=&c=J1ZU8PIBFy7o2jwiDFf0cBay85LFgacGppbzt5VLAHbXm4zl8usEWNCQviqW4F1ujSDzF/PiWkHdxAAFQt8S6hmjOlrTB3ckzbE4MTh BHjLrN0Lt ao00zbGM034yEZaN/6bL4ioD tOjfRcV 3Ew==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=P5AevlJUvZQg20hbwUEvrMr6olY71EUJlOkyw3PSquM=&c=FE8siij5h5 jFMoglLlzr7OOQ0e umLMKs5JoDuSr/ZqTHdUjT G3MS1Gf9oev0xu04 YoEQpKcQaVxd5CWM6Z HfT/VRZM qf25zpbBsG6ptGFhI/AXu1MKNwTsmmjSK3JVeFf/RXVfQL ISK5kA==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=mB9xbrcBEvfxY4U083g8sJFIgYnZeaBF79nzk5iGFNs=&c=ox3wLt2So6eGM7jv0jrXds4HtdIq3I25oG4zAdBotNTqk5UNRSuRTQ2zbRGsv TtQJf3PZj7pB/YaF5en/5AK4fmK58FJKile91/Mz1UX9g daCxTUjRPXZJHeKpr5Evf8mI6pBoG2aXUo2hHAW cg==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=FI4fJPPnJWw2lvujDL TZw85WXGrXX6/a35RA/4dS U=&c=iI4A4ikNUcHKlO 2SE4Hy4UMF8V4HSFQ5MYiDmjZsJjmlvVUQ8ePHZDT4qGC6V7F8tsTSGOZ/OL/Eb34LDqfbTXPYcPzCthYQaowOT3kBjVBlWFoCOIJgUC1EcZ8sGglL44u7fFhtE7FQobH9cKTKAQ3HILk83sn4VZmAoEuIpE=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=/kKDQNb2eyJDPJffcw4IShyH7vMH2MvsjFtOEFzYSrQ=&c=qBMjQD2BFHU/3bX9jeA7fihlRoFSlxXeq88PeA6k2oBSDSQHULdljlMOuFPqW0yUbpXRf1KQkOXJQ37TfXF9rI74CFjbWJ9GQbkNbzcvutrotI75reL/aHTKEbLEcXhv4ERuSZ04bMby0 P6ioyyQUKPz2lewe0V3IPcKv1H 80=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=kMIckWt6TJusRr4lRcf34Fs8GeQBHpIVepwruxhbBOA=&c=UwBcr4Zq33IWPFwm/WHnXO9L8LuSsaLPPfn1AXWfKt2MYJlYKFZWBozgS8NYd vovQz/VR7x/VhqvF8YLqioZusIgfZxmVnN4GuzkdSunzK4achseXGNlsvjDSOkhzFvxCyTU6DKgF 6mxMqddnI4g==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=3ii94cGEtvhwWQk8X7fovgTMUnwWZ28cKAs5uK Bt30=&c=ykboq NnG1xKg480 3R16N8f9XOv00ekoPFZDvxVNU6nK XW0gg c7bDozwlh7AJuDSovUev1bzJoPfNa4vo9DzjCRBqMHZBNEgEzoYPd5FE0XJ5Ht0S0juJi0FyME9LYPy039v9mEq2QfdQ93JRxrwlO t18u64sZ75mP0mbvU=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=nCrULpkguYLyG2oouifdMJDaTBYiVoBm7P9qGB9fPKY=&c=d6TevFwDms8jTDF5vCahjIrUs92zVly428TI0cter8Jdp90Izc4e8mBSySgFS25nuoUCEcrkYnkcOu9Gfwl/zNyUgXgLO8XfLJ69rBgSYlz1pLUsw2Sj0WAbmQcEKrjnll1wqhEuOdFVmsBZd/Ezyxv5UYO8vEMrGS80Q3 CL90=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=07pQzcMUZCcbFzGHB9nBaBk1BSZAnrSlP/aew9lGUDQ=&c=WaC3p/oCkHiowjV8omsJa95TVD8CsIzuAwjdElIoZxxKmKKD0RsYoAy 6uPQ0xG3j3tVAy3SxqyJ/pyPBMY/s3Zr27EuZTmbWf82B2OalbArq/BfN8aELCTZ4I3rSHFX3zZ/3Hid3xDqkbfCBblCtGnkGVW0qu1Xa zVwgL7Xyw=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=faqbD6g238h BZ54excIOd9pg0I54ZzwIALmxiU/uw8=&c=i5b9YGG8N9z41vpy9wmUa BbKiMbZmQVMWNNe1gt4NBe1g8CjMDhe0zl18MH7N /bghEU eDonzr3gi xntKUxZleEoZaL z5p3QydXgdDAlM4x49kZ4FA MMek5muGsZdJwpjRRUXr/rKIBRViqsI7QH2pCp2nv2iQspJd IUo=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=obZripAbowbvfBxlJOeiYiji28/11ipXbcqai6vI ME=&c=bJzHsKnZpZriXplYu9W0q3D2ipi2l2rSXk8ZE3gNAOUcUuY5kqDeC9S0p3eeqeOnVfxoqpSc cyGTVWzsdnWfV8997FlM8elgY0lehAbs57/ONjPAwbDXOsyPrv/Tos2BdpK9ug0qZeIZdn26aDlfePUcr5YoySn0tOY6EeFOqY=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=4nTHg5w8xo3EPykh VBTn3OEW1vYu5j79/LPM/GVcQ=&c=q9CSAZ4f5pM6ELtfGb3wmVCJ4FUMdXjDmRRM uzsme9n7/JsxBWwoBuqC1AcRsudfSQ iFATzM80uO1xKgTB8gb Q3FtAWuLoxvQQe o2LrivKJxQgSc/FL3aq1NQ UP7Pxgs3S6wXvf4KEFH9MVAQ==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=VcIoA9UwuuYllU4UHkUAYboH0iRpSdKvGa77UQI1FVk=&c=frGJNy0HjlR6K6mKrn3ix92Fv6sKruEcpF9GXYaZB9MDjKU7P/3uD7D0/O2YPYC8bZQ0z48MVL7R9OhqzslDfX7gropeTiSQ61jyEj0Xe9DEkPWDuRmLZeOq6shDuvyCZidxamYKIHQHUPB0QcVhS35Ssy3MqUs04nuPs6S3CRQ=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=05KMV0n0OO61 JvxW9I6aVZjF8tEg9yv01c3B5/4WSo=&c=lkckmEkC/gFAt45gS2R0LRLxXuIavz9D0De176wiyR3irLEQuh0 uSKjOVnWgIePpy4MbXir 6OyZzw0e6NbmJ5E4Xb5lDDxVEfiHt5m3r5yUaveR03vCnyBTwdNA2GTpYe0WDe4CjbomBHJXjzbOPAegF3O6JIe6R9pFg2zwBI=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=k7Aelw3WsbNXqGYInNkvOuXAyD5MGgP vF0hW040Yyw=&c=wAtK5efuwK2qZkVELuU 5bR1Eamvzcq8W46mIsErEJsctrZ9B9Cz7O8U/ Y7n4LIV cFLE1YSzoybVHz1z WWo0/RGQG8qew1ClCykqN4UjK2Hxt/0QzGetxFuDWQ/8LxNfWIdd4RVD 9MXJZ1ITnDwrOr2EjGix5tovrbjmHUA=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=RbKRy 8oJcIPv897jKd oSJWym/wnK9wrLZZKTi74sU=&c=TYSDHhwEO78Hgo7OEcVz/4575M rYgyy0brcnCm8aGxhTOqFKFbKVf1Z6CSf4jRpkKsFfKweaeyOh fZhslSUct 1Dxl2A61ItVmU/OgomKkrBwighgu/2Dwf MRhYogfyN0fxSpqq kUz5RmALG/JsBn4zNac6BcJUfr/5KsC8=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=WJiQQXMMHTn1DGLOJlnl0psddlUyhbHr kLMM0AEoKk=&c=Hah8xHu0hGu Wq0AjIn3yvcE1ICEmOMFW9hRM3SsSeEV iUmw5jlsXJNd0sJSVwaBQlN4sYa/elnOasv Tg2SplN2JwvmF9hXcHLxSnykEkPbNpsKJ1lVq8x3XZju1d09BGvD0aOWpEUf5/BlOSwIos/ yCFqzmDNCBrIIIdFts=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=TMfAZAvUGw3QLCdwqzlDiFD4dhWxTwDIr/qDrJMjJec=&c=ltLXR8VoEIxlxlTXpkWTGtfmZUmzGAjMkLSLqXdzRkLywqjLRKDUws3CBTp2dFfApKiKN16s1LB1mMViXc54dsnFqcqwZIfbJuWbSX9gPlzTU3XVg/zlmg/o0u/uZxKyv2EG7DtqMGv31sxCX1KVfewekzsmUydzdw4MIJYxekk=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

Latest 30 of 61 download URLs

Remove vdownloader_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.