home

mediadownloadersetup.exe

program

LLC

The application mediadownloadersetup.exe, “program Setup ” by LLC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.toursgiftupdate.com.
Publisher:
Internet Installer   (signed by LLC )

Product:
program

Description:
program Setup

Version:
4.4.4.6

MD5:
572dd47f202a9cbd65eaeac95da9bdba

SHA-1:
fbe942df041cc5d16cc6d41d51788bbaf514e8f6

SHA-256:
d4e07448887c8078aaa2ba04336829fa5b6433ad338f742234db1e42e5d747cf

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/9/2025 5:15:53 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.IM (L)
17.3.14.10

File size:
912.7 KB (934,600 bytes)

Product version:
5.0.3

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\mediadownloadersetup.exe

Digital Signature
Signed by:
LLC

Authority:
COMODO CA Limited

Valid from:
1/13/2016 12:00:00 AM

Valid to:
1/12/2017 11:59:59 PM

Subject:
CN="LLC ""MEREZHA AYTI-KONSALTYNH""", OU=IT, O="LLC ""MEREZHA AYTI-KONSALTYNH""", STREET="vul. Revutskoho, 7", L=Kyyiv, S=Kyyiv, PostalCode=02091, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009FE014B74C1A355EB56E95C7839825B1

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9355

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file mediadownloadersetup.exe has been seen being distributed by the following URL.

http://www.toursgiftupdate.com/c?x=3IyLfVGqxkTRZRcbJC3WwUQFWxT2P 4y1jrMUsMn2u8=&c=3pOvJSDW2oMvZWmojTYeJ7XsmwZ X665O1pQ9HORDFNl40GBwwhIYj/o2vxzHyv8w2Q3okj bSjUZWKqHkBVb5fknv/V59WFOinjFjZ7oMMBpU gvkS7TdcneV3gIzhr&downloadAs=MediaDownloaderSetup.exe&fallback_url=http://.../MediaDownloaderIron.exe

Remove mediadownloadersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.