» cwsetup-ie.exe
Overview
Analysis
File Details
Programs (1)

cwsetup-ie.exe

Cartwheel Shopping

Cartwheel Inc

The application cwsetup-ie.exe, “Cartwheel Shopping Setup ” by Cartwheel Inc has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. This file is typically installed with the program Cartwheel Qwiklink Combo Installer by Cartwheel, Inc. which is a potentially unwanted software program.

File name:

cwsetup-ie.exe

Publisher:

Cartwheel, Inc. (signed by Cartwheel Inc)

Product:

Cartwheel Shopping

Description:

Cartwheel Shopping Setup

Version:

1.2.0.1667

MD5:

50e2db012d79c4ec999852e41dc4ee0f

SHA-1:

653d749a5e949e6962cebec6af4ea8541216a177

SHA-256:

7606558612535b06a26a76122e66f9726491e59fa7a311bb4b02413c153717d2

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/5/2024 1:03:57 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Cartwheel (M)

16.10.17.11

File size:

3.5 MB (3,678,880 bytes)

Product version:

1.2.0.1667

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\cartwheel qwiklinx combo installer\cwsetup-ie.exe

Digital Signature

Signed by:

Cartwheel Inc

Authority:

Thawte, Inc.

Valid from:

9/5/2012 8:00:00 PM

Valid to:

9/6/2014 7:59:59 PM

Subject:

CN=Cartwheel Inc, O=Cartwheel Inc, L=Littleton, S=Colorado, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

5BC7C44E86B0D415E9FA94880EF2899D

File PE Metadata

Compilation timestamp:

10/30/2010 4:54:54 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

98304:XOTydNdAviuzkTQvcL1jxyxv6BfQm+mUj3ChQE:kyOiuZcL1jo6um+mUjShd

Entry address:

0x16478

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, B0, 52, 41, 00, E8, AC, 03, FF, FF, 33, C0, 55, 68, 45, 6B, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 01, 6B, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, 4E, EC, FF, FF, E8, F5, E7, FF, FF, 8D, 55, EC, 33, C0, E8, 7F, 84, FF, FF, 8B, 55, EC, B8, AC, D6, 41, 00, E8, E2, E9, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, AC, D6, 41, 00, B2, 01... 
[+]

Entropy:

7.9876

Developed / compiled with:

Microsoft Visual C++

Code size:

84 KB (86,016 bytes)

The file cwsetup-ie.exe has been discovered within the following program.

Cartwheel Qwiklink Combo Installer by Cartwheel, Inc.

The Cartwheel Qwiklink Combo Installer installs both the Cartwheel Shopping and Qwiklink web browser extensions.

www.cartwheelshopping.com

86% remove it

Remove cwsetup-ie.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.