home

creativecloudset-up.exe

Nefugam

AgileMax (New Media Holdings Ltd.)

The application creativecloudset-up.exe, “Nefugam Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.tourscontentcity.com and multiple other hosts.
Publisher:
Gofobem   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Nefugam

Description:
Nefugam Setup

Version:
3.0.5.5

MD5:
c9ee3df1a31e41dddb1c7ba3f2c6612a

SHA-1:
55de5159f1ae9bfa68f517f5db1add15a8b8962e

SHA-256:
4978e47ed4dbb2089869d074105920d674b680ae940368a464b4fb466886d900

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 4:28:16 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.6.24.4

File size:
898.5 KB (920,040 bytes)

Product version:
2.7

Copyright:
Web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\creativecloudset-up.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:04:31 PM

Valid to:
10/30/2016 10:53:45 PM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nvzYIJPMBO9/yV4sxAwSNOi7RsBwa0Fo+Ek6WE:vlJPMBOlyV4sUzRsmxE7WE

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9322

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file creativecloudset-up.exe has been seen being distributed by the following 13 URLs.

http://www.tourscontentcity.com/WVl6OTRQVU5rVGpZMVRHbEhVRTlNTjFwRFF6bHBTVFF6V1V0dVVIUndTbkZaVjBocU4zcEZPRnBFYmpaVGNWa2xNMFFtWXoxdVExbFlRbEpWUkhBbE1rSnhWRTVOUVc1QmRsTk1lbTAzVFRCVWEzbDViemhYUzBKbE5WSlpkMGhLWWtsd09YazRValZKV0RoUk5rRWxNa1l3UzJaRVJFZEZURTVPUjJoVGJuazBWRm9sTWtKRlZTVXlRblpJTW1oVFRrSnphVkJYYjNWbVJFaENNbVpIYzJSTFJFdHJSVzVQU0V4VFVVVlhjMU4yVjJ0cVZXWXlOemRQYUdWQkptUnZkMjVzYjJGa1FYTTlRM0psWVhScGRtVkRiRzkxWkZObGRDMVZjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2N6TXRaWFV0ZDJWemRDMHhMbUZ0WVhwdmJtRjNjeTVqYjIwbE1rWm1hV3hsY3kxd2FIQnlhVzkwSlRKR1EzSmxZWFJwZG1WRGJHOTFaRk5sZEMxVmNDNWxlR1U9

http://www.safevaultstours.com/WVl6OTRQVWhuY1ZKQ2QyODVSRzVQYkV3eWJGbFVhV0ZpZGpGcWJYQWxNa1pTYkhnMWJHODNRWGR4VDBwdFQxaFhaeVV6UkNaalBXSmFhbWR6UTJaTVpHbDVkbEZ4UTFFbE1rWjVTR041VkdGWk5ITXdTRVZXUkdOTmVsUjViR1ZvYnlVeVFuVkZkRXBPZFhKMFRHRmhNV1ZxVVc0NFdqVktTV2RUVDJoWlMyWlBKVEpHYnprMmNsZGpjV2hXWmtrMk5qWndNVEEwY1RCNVNVazVOMDAxUjFsWE5VVlJVekJaZFRacmJub3lWMk5VT1ZWd2VYbHBTRE52YzNSdUptUnZkMjVzYjJGa1FYTTlRM0psWVhScGRtVkRiRzkxWkZObGRDMVZjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2N6TXRaWFV0ZDJWemRDMHhMbUZ0WVhwdmJtRjNjeTVqYjIwbE1rWm1hV3hsY3kxd2FIQnlhVzkwSlRKR1EzSmxZWFJwZG1WRGJHOTFaRk5sZEMxVmNDNWxlR1U9

http://www.quickworldapp.com/WVl6OTRQVXA1U0hWcFVsaEtXRkpEWjFGcVVVcHFkakJoVUZwQmNWWjBUMVpMVWxac1MzVmxhRU5oU0dOb1kyOGxNMFFtWXoxb0pUSkdWR3RMYTFkNlIxbGpla3BaYUdGMlJtaHZaSHB1WmtaYU1tOWlRMGRsYUhKelYzcFhhSGxyZWxGWWJreHdORVJuUW1aS1lWWmtZWFUxUjI5WlVtbFVWamh4WkcxdWJsQXlVbU5tVFhwMVZEQktRVzV4UzJWb1ZVaEphRVU0ZFZZd2VUQkxKVEpDWTJoRldEZzJUM1YxYVdaUVYwMDJTREpCVG1oR09DVXlRbmsyWmlaa2IzZHViRzloWkVGelBVTnlaV0YwYVhabFEyeHZkV1JUWlhRdFZYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3Y3lVelFTVXlSaVV5Um5NekxXVjFMWGRsYzNRdE1TNWhiV0Y2YjI1aGQzTXVZMjl0SlRKR1ptbHNaWE10Y0dod2NtbHZkQ1V5UmtOeVpXRjBhWFpsUTJ4dmRXUlRaWFF0VlhBdVpYaGw=

http://www.vaultssendmeta.com/WVl6OTRQVWRYWWpJMVpsZ3lXRk14Y1V0ME9XMXFKVEpDYlRsdU5GcHlUakp3VVdOS1kzRkVkSGc1TjBWS2FGQmFZeVV6UkNaalBUTnFUa0ZEVjBsc1IybHdSRlpCWVdObmVHcEpaRms1Y205UVIyNTFURlZVSlRKQ1psZG1Obk15Y1VKalppVXlRa2RuTldNd09YWkRUekp3TjFsUmFucEhjVEJKWlV4bFQzQkZSRzRsTWtKMVoyaHRVM0pwVjFwYVVVMWlVV1ZLY1VwemFXRWxNa1pEV1RaQ1UxcE5WRXBZYjNOTGVVa3dPV1k1ZDBVbE1rWnBSRkZSU3pnd1IzSnNaQ1prYjNkdWJHOWhaRUZ6UFVOeVpXRjBhWFpsUTJ4dmRXUlRaWFF0VlhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbk16TFdWMUxYZGxjM1F0TVM1aGJXRjZiMjVoZDNNdVkyOXRKVEpHWm1sc1pYTXRjR2h3Y21sdmRDVXlSa055WldGMGFYWmxRMnh2ZFdSVFpYUXRWWEF1WlhobA==

http://www.flashnewclean.com/WVl6OTRQVmwzVEU5bVRGaGxXWFpQWTBkTVNUQldXRkppU2toNmNYVjZkbEF4U0VKdU5Ia3pSMVZoZERkSFRsVWxNMFFtWXowMVdYWjZjblZ1ZW1wdVVWcFhhVTlOUm1kSlVuZFdZVFZLU0dKeFFVeElObEZCYWpVbE1rWldSMHRaZHpoSU1VSnJjM1pwY0VGQ1QzaHdNMlJqUmt4cVlqSmlkMGxPVDFKdGRWbDNPREZSZVZocmJXaFFUQ1V5UWpsbGVEaGFWVXBZZURkdGJEZHBZV0pFVW5wRU4wTlJSMjFLVGtwT1pYSTFVbWRQU0dGR1RFcEVWVWttWkc5M2JteHZZV1JCY3oxRGNtVmhkR2wyWlVOc2IzVmtVMlYwTFZWd0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6TXkxbGRTMTNaWE4wTFRFdVlXMWhlbTl1WVhkekxtTnZiU1V5Um1acGJHVnpMWEJvY0hKcGIzUWxNa1pEY21WaGRHbDJaVU5zYjNWa1UyVjBMVlZ3TG1WNFpRPT0=

http://www.flashnewclean.com/WVl6OTRQVkZQUWxWdVRsZ3hSVmhNTXpWR09YaHZOMmhQTVZOTVZIWkZNM2xPTTNKeVREUkNjMmMyV0dzek56UWxNMFFtWXoxS2FtOWhKVEpHUzI5elQxZzVibGR2V2t4TVluQjVSVTlvZFhodFlrcG9NSGRTUzJKR2RWSndURmRrV1U5S1FuazRVelpWTWxSNWJFNW1kU1V5Um5oeVNVaHFNWGcxUm1GamJtcERURklsTWtKdVEzTTFZV3czZUdwT1QxQXhKVEpDYms5aVZGRlJla3BTVHpVMldXOTVNVWRySlRKQ00yZFhKVEpHTm1oYWFHUlNWekYwWkdFeVlVOTZZaVprYjNkdWJHOWhaRUZ6UFVOeVpXRjBhWFpsUTJ4dmRXUlRaWFF0VlhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbk16TFdWMUxYZGxjM1F0TVM1aGJXRjZiMjVoZDNNdVkyOXRKVEpHWm1sc1pYTXRjR2h3Y21sdmRDVXlSa055WldGMGFYWmxRMnh2ZFdSVFpYUXRWWEF1WlhobA==

http://www.apppresentnew.com/WVl6OTRQWEJhWTNwb1RqRXhlbEZOUkdGdlJuZHlWamhIY0dwT1ZqVklUMG9sTWtKTlpXWjFORkZpYkhkdk5GcDNOQ1V6UkNaalBYRm5TVXhTSlRKQ1QydEpURFpUVVZGUE5XTkxUMmh4ZURsblEzQkJRbTVyUTBOcWRGUklSek4zTjFWeFkwdHJSMDAwYm5wb2NEQkphRmhNVlNVeVFuQlJibXBHWWtOVFR6RkNjelZJVlc1V2MxaFNkbXAxZDBob01Ya2xNa1pVVVdSeGJVZEdUVmhEV2xVbE1rWjBkVTlqY2tWNE9YUnJNRGtsTWtKWWIyeHpUMVJJTURCRWRGcGFjQ1prYjNkdWJHOWhaRUZ6UFVOeVpXRjBhWFpsUTJ4dmRXUlRaWFF0VlhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbk16TFdWMUxYZGxjM1F0TVM1aGJXRjZiMjVoZDNNdVkyOXRKVEpHWm1sc1pYTXRjR2h3Y21sdmRDVXlSa055WldGMGFYWmxRMnh2ZFdSVFpYUXRWWEF1WlhobA==

http://www.tourdownloadapps.com/WVl6OTRQVXc1VEhsVWEwRkxRVFpIZUZKRFoxZDRXbE5wVkVkMmQwVnFObE0yZEhCWVVYSmFkbEJHVlNVeVJtaENaeVV6UkNaalBYRjRlSFpCZW1nellWZHdhemxVU0haRldtRkpiV3QzTVc5YVkzWlBTVkZaVTFjMFRERXpibWRaY0ROVFRUaDVVM1JQVTFWeFpsVkpNM040VUZaVlVsRm5XbXRCYTAxNVFWUlBUamxXWXpKVVJWTkNRMDFUZFRWR1owY3dhbEZKV1dwRFVsbDBOV05HVEhGbmVXdHRXVzQ0WlRSbE5UaEhlVUY0ZFZWdVprRjFKbVJ2ZDI1c2IyRmtRWE05UTNKbFlYUnBkbVZEYkc5MVpGTmxkQzFWY0M1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQnpKVE5CSlRKR0pUSkdjek10WlhVdGQyVnpkQzB4TG1GdFlYcHZibUYzY3k1amIyMGxNa1ptYVd4bGN5MXdhSEJ5YVc5MEpUSkdRM0psWVhScGRtVkRiRzkxWkZObGRDMVZjQzVsZUdVPQ==

http://www.hostcyclepresent.com/WVl6OTRQVnAyU1RCTmFDVXlSbGhoYkhneE9UTjJiazlCZEdoWVZrdExNMFZWWjFCRlVtZFlXRkpLTW0xVE5GQkJWU1V6UkNaalBXTXdkbVo1VGxWdVJHZDVUbFZIZWtneVExRk1iQ1V5UW1kWVdWSnpSMmhxVUhKUlFXRnJUM2szVWxsMVJWSmFORk16TjBGTUpUSkNXVGw2U21GbmNrRm5UM0pRYnpkeFVqQXlkSEpXVDJsbGJFVmFOelJzYTJWSFpVd3paR1FsTWtaWGMyVjVia1pLYkRoalF6VkdPRk0zVEdsUk5tdERXR1pKU0dNMGJUQnhTV1pDTUUxSkptUnZkMjVzYjJGa1FYTTlRM0psWVhScGRtVkRiRzkxWkZObGRDMVZjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhCekpUTkJKVEpHSlRKR2N6TXRaWFV0ZDJWemRDMHhMbUZ0WVhwdmJtRjNjeTVqYjIwbE1rWm1hV3hsY3kxd2FIQnlhVzkwSlRKR1EzSmxZWFJwZG1WRGJHOTFaRk5sZEMxVmNDNWxlR1U9

http://www.hostcyclepresent.com/WVl6OTRQVzlQZGpWYVJUWXlhREo1VFdWU1NHc2xNa0pFUzNoYWRVTklWbEZJT1d4NE9VWjFhRGx0ZEhaS1lXaE5heVV6UkNaalBWQjNSWEZwYzBkRmQzRTVSMmd3SlRKR04yaDROMHBuUTJkdldGWTNSV1JxZFVKNllTVXlRbk5VVnlVeVFqSm1Va2hEUVRkdGNsUm5XalZSVERScFpIRmxUbWRSVEU1TE0ycENTM1p0WjJNd2NrVkdhRkJ2VkZkVWFscDZlVzVKUzJGb01UQTJUVTEwYTFsTlpYZEtjSGhTYzFabFkyazJiMUJYU0dWVE16WlVkMk5ySlRKQ1l6Z21aRzkzYm14dllXUkJjejFEY21WaGRHbDJaVU5zYjNWa1UyVjBMVlZ3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNITWxNMEVsTWtZbE1rWnpNeTFsZFMxM1pYTjBMVEV1WVcxaGVtOXVZWGR6TG1OdmJTVXlSbVpwYkdWekxYQm9jSEpwYjNRbE1rWkRjbVZoZEdsMlpVTnNiM1ZrVTJWMExWVndMbVY0WlE9PQ==

http://www.hostcyclepresent.com/WVl6OTRQWHBWVDFwbVR6a3habXBGVG05RVpHWkhWRGxuVVc5SmEzZGllbk5GSlRKR1FVWjNURTh6SlRKR1lVTllKVEpHUkVVbE0wUW1ZejE0TmtST2NUQjRaVEpVZFZreVlYSm9aekIyZEhCeE5WVkVRMEZtWkc4MVFrTWxNa1pSYTBVMFZXaEdNWEpWUjNGelZraDJaRFEzUkhoQlZ6STRSV0ZXTVRjMU9VOXRVekZsVEZNeVJqYzRZazlxYzJaTmNtSldWbGQ1VTFsclJUaElaek53WVU1UFZrWTJkblpyZVRNeVJHeE1VRTAySlRKR1N6WjZVRWRXVldnelJDVXlSaVprYjNkdWJHOWhaRUZ6UFVOeVpXRjBhWFpsUTJ4dmRXUlRaWFF0VlhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndjeVV6UVNVeVJpVXlSbk16TFdWMUxYZGxjM1F0TVM1aGJXRjZiMjVoZDNNdVkyOXRKVEpHWm1sc1pYTXRjR2h3Y21sdmRDVXlSa055WldGMGFYWmxRMnh2ZFdSVFpYUXRWWEF1WlhobA==

http://www.hostcyclepresent.com/WVl6OTRQVk5FVFVoaVRrNDFkMlkwT1Zwc1JtaFRWVU1sTWtZbE1rSTRURzRsTWtJNWNYWllUbXBKVTJObWVTVXlSa050UXpSWE5DVXpSQ1pqUFhKS2FFRmFOa2MwUWtkMGVrbHViMWhNUVc1S2NtcGhXR3RQT1VZbE1rSklURzVVZWxOblZGVnphWGxhVm0wM00xcFVRVzlFYW1OT2REZENTWHBWSlRKQ1VVTmljbEJ1WVRsUlZWVlRUM1ZzWmxwVldsRkZOR1Z6VVZaU1dtRkZlRUkxUVhkbVNWUkdaeVV5UmxWQlZYcHNKVEpHWjJsNU1XeHJNbHBCYWxWUGRHeDRUVlp6T1dRbVpHOTNibXh2WVdSQmN6MURjbVZoZEdsMlpVTnNiM1ZrVTJWMExWVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0hNbE0wRWxNa1lsTWtaek15MWxkUzEzWlhOMExURXVZVzFoZW05dVlYZHpMbU52YlNVeVJtWnBiR1Z6TFhCb2NISnBiM1FsTWtaRGNtVmhkR2wyWlVOc2IzVmtVMlYwTFZWd0xtVjRaUT09

http://www.hostcyclepresent.com/WVl6OTRQWFZzUkdkVGNqRmpkblIxVmxwbFVIRXdTVkl5ZDI5Q056RkRVWEJ3ZURWM1JsUTJjRWhvYVZsd1luTWxNMFFtWXoxUWEwZEVkVnB3TjFoT1NIUmFaRVZUTW1aT2JrMUhPRGhuV2xoSllXZFBhbmxsYzNOS05VeGhVa0ZZUVVWdVdVSTBTV1ZXUlhsNWFFaEhkM1ZCZUhGVFJYSWxNa1psZWtOb2MwdEZhbEY1ZG01d1dqVjBNVXQwTkUxQmJXVkRUSE5qTWtkYUpUSkNVV05zVFhBeFZuaFhTVlJLV1U5cE1WUjVTRWRIUlhka1JIbENSRmdtWkc5M2JteHZZV1JCY3oxRGNtVmhkR2wyWlVOc2IzVmtVMlYwTFZWd0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjSE1sTTBFbE1rWWxNa1p6TXkxbGRTMTNaWE4wTFRFdVlXMWhlbTl1WVhkekxtTnZiU1V5Um1acGJHVnpMWEJvY0hKcGIzUWxNa1pEY21WaGRHbDJaVU5zYjNWa1UyVjBMVlZ3TG1WNFpRPT0=

Remove creativecloudset-up.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.