home

minecraft setup.exe

Prog Application

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application minecraft setup.exe, “Prog Application Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Minecraft but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Internet Program   (signed by Darwen Marketing Inc.)

Product:
Prog Application

Description:
Prog Application Setup

Version:
3.2.4.1

MD5:
04c3c00dd9206b71e2faf704f5a1c530

SHA-1:
5db8b5152a96c27713d95187f9969e770d9c053e

SHA-256:
3fb5a2843ef5997a5424610390d1d31451e57365ec759c6e35676efb7e91053e

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/15/2024 10:25:52 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.5.21.7

File size:
682.3 KB (698,688 bytes)

Product version:
4.4

Copyright:
Internet

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\minecraft setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
GlobalSign nv-sa

Valid from:
2/16/2015 9:14:30 AM

Valid to:
2/17/2016 9:14:30 AM

Subject:
CN=Darwen Marketing Inc., O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112180A13CB05776BC42C97930E7C161F590

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:o59GEFQFJbGBvTp2/a6nx9nYgTvUHbrHNwTlFXtg+b0no2UQKjc5n1q0WTROv8vn:o59hJBF6x+wTlFXtgLo9Hc5n1q/8v6

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8874

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file minecraft setup.exe has been seen being distributed by the following URL.

http://cdn.wholepackagesfloor.com/c?x=OB/FUbmzDEK56OqPJPiD DGQS0MPgEZeJ/P/YcqX41o=&c=T FcR2hOE1atSs2Jus8NE8Q35HzQYlO OQXWrTI5rLQyjKKURsKW8 izRnWGNeqqExhbRtXSJghKGVF9Jh6dalhmYPY5M7LNjBhlHQ09B2MaF 3rJEKouS7Ju3iqbuG2&fallback_url=http://www.downtoad.com/landing/bing2/.../download.php&downloadAs=Minecraft Setup.exe

Remove minecraft setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.