home

dropbox setup.exe

Danamaro

INSTALL MANAGER LIMITED

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application dropbox setup.exe, “Danamaro Setup ” by INSTALL MANAGER LIMITED has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Dropbox but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Neribeheh   (signed by INSTALL MANAGER LIMITED)

Product:
Danamaro

Description:
Danamaro Setup

Version:
2.4.2.5

MD5:
ea47f2ae3ece92b952f37f7ffccb64a6

SHA-1:
cc84d447b69e61e9d1030798e2ab81179bac4de5

SHA-256:
ba3bb5c0615bca72fa0f7666c59419941d06cfdbf1462b158953db02eee06304

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 4:33:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.INSTALLM.Installer (M)
16.7.11.11

File size:
953.5 KB (976,400 bytes)

Product version:
1.3

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads setup.exe

Digital Signature
Signed by:
INSTALL MANAGER LIMITED

Authority:
COMODO CA Limited

Valid from:
3/16/2016 5:00:00 PM

Valid to:
3/17/2017 4:59:59 PM

Subject:
CN=INSTALL MANAGER LIMITED, O=INSTALL MANAGER LIMITED, STREET="Level 27, Pwc Tower, 188 Quay Street", L=Auckland, S=Auckland, PostalCode=1010, C=NZ

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FBDBC377785EFBB2B9815C82ABDC98E1

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:exi3A0kzHK3BQLQtxunv26L9VswNoH1yv40z:eg3DkK3BQLQDWu6L1d

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9364

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file dropbox setup.exe has been seen being distributed by the following 2 URLs.

http://www.universeranchbits.com/k7LXWO3uLX_pNEVWm0S99ZVioHYYNC3yPT4TIldlc9W6fa6YB xBYY65hxICt9WbiBaXtxHqYgpMjFFi0O_kw247DrUtljiVMlIDHSSuRtxmM9UtIny7KzR8E2pfb_TzDpOH G9B3EB5b_oIYJFW2VpN7_ivF 9qKMl8t_oA8bUZv1n7YLjG1myLEs8AOI_9NK6qN 6iIbAelz7bPGabqsNqy1QaP_ 0SbeznYIyhWkLw4azOKdmz3i4GVm0pOEVr45P7GtYbRcQ4_8IcH2dQ6yQHT5pYWqUqK76U12HqYSlQ4XQqbF1qDrGV6GNzxEwL5JkjRnkdwgsvKC19Xhy6 4VsM5U nceUt0dx7Qph0lfDsV2m6IU5wkoqzX8b5njqpt_qQWWQg45YHOeiwdPsI2cBkylkmiERYYFASJJSLmq5oFlxCbBR7tsISNSWqkU aYWxjSmyj66pSju76mMBfs4eTU9OSW5xX2Xo_DQ6yDwy2NswYJQV34Df0hBxvZCKcbv51TZ7NtVPARuXuQN6PoRoEdtcV6Rxg4qM4gvCk7Woq7zx6P2LxlegYQE6v3IpthOzBaAs3lMRxT90mf_xPpIfRd3OgRbs_AATEwY0Azd2WPVXVcVC aFQusmTAUQ_fD3EDMb3q2xC4qgEk4b18TAUPL8wLCVIMx_66a L oAi4WSpQoLKWCV1C_rBlX4WzGfswp-GzAAAOQbe8 VvrxhYEBRWhBRTNElbIydK2iU380l1Gdpk2knkosyoT0T9PJHAQ==

http://www.universeranchbits.com/diT3SgdqRQD7TQFxXqFERTUzLInYCvA6cAdmAhBQ8VJU8eY3W3yhq dy_OmFpjMLwCnS6VExArKnpB27W pjEi5oEgUfedVZ7bf5BFuCHcmRHMrj3xWreZmO0xnH4kMnLNQZVEESx 2kHGXnd3buMwF45 z_91FSm9L9Z37mt_LZEoQmEzqY9lG9bnTZE8rJPlM95fkcGjQOQIltL8HEICYcAIAoEUzi0gy0QyLFUjgrp6w OBoz0_23BJdR5AGZUNDOe0MYZxWw9bCybdb3 yGTt8TPL5s7glAaUcixEh3LxufXptFabLdQ9MA9A6JFNzcKXWWoM3w8hkY40G4Lqwc5p5vQMn242eE763cabq9A7cd_DyV293oqO0gFaik8x2TN4YX9fD9tJwz8iiDpr4N4wUpumNrD3IXRoebUutSouCHhB0VXDaws0bCkTR5QzvE7wPUrZE9CQmszgSGZq7zPn1AY_Ifz6uKSnLzDfuM4VISWpls8b4Gr66Zcz CLe0k7lJ9 PH0nj1 HDYQLm4HnxdJ30xXj2aQAu8_YJUrjWuLI0nIYEv32tJI2PoDZRvgikC3ZJSt4NICtS3_ZgBgOoLW1PD2Dborh6SwTP1_l_om3NM4T3zmm b60r5fgVkss_N_qozPIcRYrat_5fy0CPwhlei29r7Ll3ly4eheA772GHhIejZ7A83Ag3ZAIr 1t2hId-GzAAAOQbe8 VvrxhYEBRWhBRTNElbIydK2iU380l1Gdpk2knkosyoT0T9PJHAQ==

Remove dropbox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.