home

ares setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application ares setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.grabpresentapplication.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
1616987c4e4db3dd69464269d51d1c48

SHA-1:
2b207178410c5b5aa3b2f8ae1a902d7bdc984ac8

SHA-256:
f6fa869436662261e8bb235e3d03d827ae460697c7450e08bc138d654e2092b0

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 10:28:30 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.30.3

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\ares setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 4:25:15 AM

Valid to:
9/2/2016 3:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:g5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:gdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file ares setup.exe has been seen being distributed by the following 13 URLs.

http://www.grabpresentapplication.com/c?x=HFwhFJ2p7Gl2bfaxjvmSgYRc/XYleW9LXa/o422e8/k=&c= igU4C8J3an3Hl2ZlKS IoRcALyBjpLW QOCuxzgCxktmO8YPwW0rOwM1aQPuQ4NGaaxEFKkYjaVPNmpLlrlAQUj /LWJbpxUZPb8og1RUhVplpdLk3wwCUe/Ka1os0u4iDInmQrOzQSpGLAbfVkPQ==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.filescleartag.com/c?x=CXI6brYQdSBZAgR5s21DZ8dPABbb8g5C3F2xzUw84Es=&c=NCNrqvQ8cW0L/9B1R1kO1ccVIYyk6h8 zjaU5blEWG dRBDeimZUeqg2CG3SwxsTE7KJw13DvZQMTeNcPoSIhJwvgI9zWaTfy5tOcWMcFSCpZoMR44dQ14pvflowZzm5IPlRTebaVUMG1SkT6Cgk0w==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signssafebulk.com/c?x=s3Rm4L4HScEpRBY5yrPIrwDQW1NcTVot0urWM4Fenrs=&c=RIVlTgMlq5ZmjSOgw3VhLrEV8r cwLCXUNJIFWeeTnawv45gxf8zIGOvuiz8zUJM85aTHHhtvej/wILINVc1gtPkc9iSrW91csyXnt joY4yppime2j3pIRz6CEwZRPTgC3dfmoEL5HlMhaRRREyQg==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.universecontentvault.com/c?x=Jm0mC1piEkZzvProU8vinmW27 ohFuxyZqLTzy/Q5o8=&c=E6O3VOKohO26TR6JyT3j5 cdfinXcx2C7AbsfHvwQweAw92VsmaKOnxCtEhoUVyXXdw7VOtEWLzZBcAmTzq8eo41RGRJavf3268Xzh5fD0EEyRNWyJLC87XkFr23VI2gdP3nNsbqGqcLsGc3DOWlEA==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=Zj8O87itb5BC0P3uxNS3cMTpjX2vhDGRO3pTZOG9rMo=&c=LtMCiAxfdYi8WYUyfrRYrKDdLldG2kH5iHip6y34yZaJYQPD1nkQLSFW0RvXu9d5b738a25HWEWCdWwSqsPZA43FqEq4Tav3pLBlgYj/ZTnBnUWHnZE/tORmj6ujDGErJAkpkaQynA0WVQ4ZMLV6xg==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=FXvTNe7HN8QAL05OmUxtLXW21kWAo2btUOFeJ3/XoU8=&c=hkAZT5Q1gQ9ZXC3tqaccLGkfAECnimrDlZeeJ2pXAxsfZ6XIQAPP69AmZus75zIHn94e0kpA43Ru3knpINF9Hf7NE Y1TWRe7JvTRbrJ2XdsTBkwYnQvnOtFhSnXvHMsJjBDdeJMfcfJkLxRTzCKgQ==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=Rw1FezF4x02vUwdoOIfdMigPqjb0aJGBs4j07BWDlpY=&c=q VySBYuqJbUhA6B5/jcxY2hEa1ey3REXDERYaJYW8yj4ZgZSwOUMA02/vP9t1 wpH1FqU7Z06tGS EG4MuxtOeBNQSUBIp8bw9wS XeZqimB1Yt1shQPrKcMSmGlRIe 0esdGYs3PEacQuir2Sllw==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=0NZh7e4GpR8UccTxNiVyoPapHaBLMhsEfOXm3GqNqSk=&c=aQwYE0e5LLxy/y O3RxEsSvjqgTKdwgJaMB4K6I32Oj/LmQ EJ/XhzruEN24769dVzg6DQv6Rnj2CNU2DgG6NTlMhYZpMtguvC06Y9d2X5epfOGuEnNsZz3uoR9ixdZm2FSn7VFFIKcYKkPxJ/zU6w==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=Qdha/6PO06syHr9mwHVlz99/QYJJyUi4QDVzEdw36h0=&c=16EEr2jhM/owB6eEI2K IUwpdCiediJVtdC5sKs8z50FYH3/06b1GW6W/WSJoAniPZEtyt6GhNs4xC4f9FnzQRrO5o54kAzmHS3q9ukUyz6jIk8UViKsRFT557z6kgGJQpdr1fW0SvU3LCCXbmbkfQ==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=9YI7 /8mDhYBjcSDbLpqQ3pyLmHk0/UlbRutbpH4sro=&c=EsCCQSOjBGENPAPxvK5gsfkyOuznbyjycPItD8 xOAplhEKrszdh9IL3bpGTusM16xlWaUf5aSmnCZ3XWYAyMFG7yNbKmtji4s2awxwb/igZ7SiDTNe6fIRXtZ6CD2ND6Y0ZogO8ksbX9xXln388rA==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.currentbundlescontent.com/c?x=aA8JCrOjlFX33o0bRyjQevI6Fd/r4eJvFHZoGk84b5M=&c=UO42eIdjat/g2hNNn7m4qyhOs5ci05nPN975sa2C21WmO/65knOAQGPb1p3/CYXz3uYzZ55BjnuqMTvpaWV1VV7CyOCGJOEse2uTfMOOQW4zc9jXeoE67/dYtYUBd7sSHYzUfeEwQQ xMDRa2JFbYA==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=RHZjopcEpAhuwbeOkJYc4T72kxlDcqDlHc6pclD Nr8=&c=lQFPdkTSfYMz9IFu3 ywEN5L7gEjRbV0doF HJP/Z7 THw/T1Wmov185rixJJrXt8si 6 3b2WfpC3pZuRhXX3s3d4pVhO0rDNmiFCpELL5MHjA8wDBQSV0KXLWERcOYR9 QSq U2nM6iIqavtVaKg==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=wSXxqRJMXlXa2mxvSng5MYg2fyX lZcLBPdO1RZLAQ0=&c=yYX8Kh5WmmJCEWAhuF15n1qdQBGK4BXalBQHp5 QDs4vYwMMWH3FeAEcZa0NNFcAxsdPB gi5AqgtMK0A K0 NCHiUbwUclt7mhkDSvoDiMudoert44A6f8EWSPBA3LZUAdN5Hl0wIqUYHjpqhd02A==&downloadAs=Ares Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove ares setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.