home

coreaacsetup.exe

This is a setup and installation application. The file has been seen being downloaded from download1980.mediafire.com and multiple other hosts.
MD5:
1a216df3e4a5dc41f65640f3d2d84efe

SHA-1:
f764a312a18957282d88e30b54a887a4ca7e507d

SHA-256:
3b9fa35864192f51b38beeffdb62d4999033f0f0d382f2dfeab9d450980e370d

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 11:18:50 PM UTC  (a few moments ago)

File size:
253 KB (259,032 bytes)

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
12/13/2004 8:16:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:Qy9qA5da3mH1H2780L2f+Y5mDe8bdtXOKiVzhSNeC+:Qy9zu78zvADPv+K3NeC+

Entry address:
0x3D02

Entry point:
83, EC, 20, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 18, 92, 40, 00, C6, 44, 24, 14, 20, FF, 15, 28, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 68, B8, 93, 40, 00, 68, 80, 3C, 42, 00, A3, 30, 45, 42, 00, E8, 01, 2B, 00, 00, BE, 00, B4, 42, 00, BF, 00, 04, 00, 00, 56, 57, FF, 15, C8, 70, 40, 00, E8, 7A, FF, FF, FF, 8B, 2D, 8C, 70, 40, 00, 85, C0, 75, 21, 68, FB, 03, 00, 00, 56, FF, 15, C4, 70, 40, 00, 68, B0, 93, 40, 00, 56, FF, D5, E8, 57, FF, FF, FF, 85, C0, 0F, 84, 45, 01, 00, 00, BE, 00, A0...
 
[+]

Code size:
23 KB (23,552 bytes)

The file coreaacsetup.exe has been discovered within the following programs.

µTorrent  by BitTorrent Inc.
µTorrent is a is a free, ad-supported, lighter-weight BitTorrent client designed to consume less resources then the full BitTorrent version.
www.utorrent.com
12% remove it
360Amigo System Speedup Free  by 360Amigo
360Amigo is registry optimizer. 360Amigo System Speedup bundles a branded version of the Conduit Toolbar, designed to deliver search based advertising and results. During installation the user is presented in some cases with the option to install the toolbar (on by default).
www.360amigo.com
53% remove it
GOM Player  by Gretech Corporation
GOM Player (Gretech Online Movie Player) is a 32/64-bit media player for Microsoft Windows, distributed by the Gretech Corporation of South Korea. It is the primary client player for South Korean GOM-TV, and is more popular in South Korea than any other media player.
player.gomlab.com/eng/support/supportcenter
24% remove it
Toolwiz TimeFreeze  by ToolWiz
www.toolwiz.com/products/toolwiz-time-freeze
About 8% of users remove it
 
Powered by Should I Remove It?

The file coreaacsetup.exe has been seen being distributed by the following 22 URLs.

http://download1980.mediafire.com/3vv6fvzghmgg/.../CoreaacSetup - Media.exe

https://cdn.gomlab.com/gretech/.../coreaacSetup.exe

http://download753.mediafire.com/27y1mrxtgcwg/.../coreaacSetup.exe

temp:coreaacSetup.exe

http://player.gomlab.com/th/.../down.gom?seq=219

http://www.datafilehost.com/get.php?file=5a60c7a9

http://download639.mediafire.com/r0rghlrykqxg/.../CoreaacSetup - Media.exe

http://player.gomlab.com/.../down.gom?seq=292

http://player.gomlab.com/.../down.gom?seq=370

temp:coreaacSetup-1.exe

http://player.gomlab.com/.../down.gom?seq=161

http://dl.tusfiles.net/d/.../coreaacSetup.exe

http://download1869.mediafire.com/knri8ba96g1g/.../CoreaacSetup - Media.exe

http://download776.mediafire.com/zbvvlb1rqxrg/.../CoreaacSetup - Media.exe

http://player.gomlab.com/.../down.gom?seq=451

http://sg3.attach.mail.ymail.com/us.f1903.mail.yahoo.com/ya/securedownload?clean=0&fid=installer&mid=2_0_0_21_176_AE QCmoAAQtlT kkmwOH3HEKWPs&pid=2&tnef=&prefFilename=coreaacSetup.exe&redirectURL=http://us.mc1903.mail.yahoo.com/.../showMessage?cmd=download.failure&fid=installer&mid=2_0_0_21_176_AE QCmoAAQtlT kkmwOH3HEKWPs&pid=2&tnef=&prefFilename=coreaacSetup.exe&view=none&cb=parent.attachmentFail&cred=0.109z75tWEf9IFf.KcftVtbdSI4MqJoS9WuKN_17ixem9zRlonf86KppLkdGYVC803WGOQ6Nog5MDgHcub_sr6JFBfkcDdBfm7uGQt2_9k-&ts=1342177999&partner=ymail&sig=F_XbTRYKGq6sd13St1EPtA--

http://player.gomlab.com/.../down.gom?seq=219

http://player.gomlab.com/th/.../down.gom?seq=451

http://player.gomlab.com/ru/.../down.gom?seq=292

http://www.gomlab.com/eng/.../down.html?seq=219

http://www.gomplayer.jp/.../down.html?seq=46

http://player.gomlab.com/eng/.../down.gom?seq=219

Scan coreaacsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.