home

mediadownloadersetup.exe

Internet

LLC

The application mediadownloadersetup.exe, “Internet Setup ” by LLC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.quickbytemeta.com.
Publisher:
LLC   (signed and verified)

Product:
Internet

Description:
Internet Setup

Version:
5.4.4.7

MD5:
789cff4814603320bbbe1ca514e4b6b1

SHA-1:
697e46cc25adc868e8e59b728c3eb284f819d425

SHA-256:
35944347835d563da3b7aed1e0e89837e6f0c3316f436b56e073fe395353f152

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/8/2025 5:07:48 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RES (M)
16.6.3.14

File size:
921.3 KB (943,376 bytes)

Product version:
3.1

Copyright:
program

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\mediadownloadersetup.exe

Digital Signature
Signed by:
LLC

Authority:
COMODO CA Limited

Valid from:
12/18/2015 1:00:00 AM

Valid to:
12/18/2016 12:59:59 AM

Subject:
CN="LLC ""AYTІ GOLD""", OU=IT, O="LLC ""AYTІ GOLD""", STREET="vul. Heorhiya Honhadze, 21 A", L=Kyyiv, S=Kyyiv, PostalCode=03067, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
29EC4A9CF0F6268AF9A8047D305F5388

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:AC6tbDXG/2h3BePqlkhurDLbwM81EeB6lQG61buo1WHI:Azk2hNmonEVB0mr1j

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file mediadownloadersetup.exe has been seen being distributed by the following URL.

http://www.quickbytemeta.com/c?x=Y 3lG5828XkWPunbZRr3M5jUqbd3AsPMaEnwyRk1vIE=&c=ZtjbnHn51YM/RT8M4mVvh9woOq6CbqrKMBrKEsQ5yEACUyKjfzuV6ugoH wOTEym9duHvpy5dCWzNRYDFl3B27d6dwABVWFO5zbo dc/qrz 6M6pH4Y347tvVz261ZR7&downloadAs=MediaDownloaderSetup.exe&fallback_url=http://.../MediaDownloaderIron.exe

Remove mediadownloadersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.