» minecraft_setup.exe
Overview
Analysis
File Details
Downloads (1)

minecraft_setup.exe

Captaindownloads Downloader

Dove Source (Fried Cooke Ltd.)

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application minecraft_setup.exe, “Generic Application Web Setup ” by Dove Source (Fried Cooke) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Minecraft but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

minecraft_setup.exe

Publisher:

Captaindownloads (signed by Dove Source (Fried Cooke Ltd.))

Product:

Captaindownloads Downloader

Description:

Generic Application Web Setup

Version:

1.0.5.a0.1_34599

MD5:

9422052be96e6f65421fd9a8999d88df

SHA-1:

06b9a2098bfc0381cb0ad21d21d35c66f6e6aa4f

SHA-256:

7d670b3aa93911d035243158fdef626304a3ae17f45f0d8417f692796bc532b1

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/6/2024 1:46:03 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore (M)

16.7.30.4

File size:

765.9 KB (784,296 bytes)

Product version:

1.0.5.a0.1_34599

Captaindownloads

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\minecraft_setup.exe

Digital Signature

Signed by:

Dove Source (Fried Cooke Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

1/5/2015 10:17:34 AM

Valid to:

1/6/2016 10:17:34 AM

Subject:

CN=Dove Source (Fried Cooke Ltd.), O=Dove Source (Fried Cooke Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121565CD3A6FF74126C58E5CFEFA7955821

File PE Metadata

Compilation timestamp:

6/19/1992 5:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:yEvpPFLqoo5vyri8okUUjvInoRy2X5q8oh9t06MZryvFGxQyHLnTG13MmVXcuStS:yEvdFk6rijwInoR3Foh9tUZ3xbraWmnj

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8474

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file minecraft_setup.exe has been seen being distributed by the following URL.

http://cdn.captaindownloadfiles.com/?data=WBqmoVxX8L 0XH9/AcxBzdveCyWuseAYDZ5N7ZcBvUSbn1dYnr3SJdsOovSN/Nt9UXal9dyJXdO sPH/hoHOC/Omrc hOf/yneuQZF3qR1Jc2zctWaQZBSwYjj/q3GvXbjlRrfuxwUW/SN6eVM0NH4/yk6hlA RhMAJ61AD9Wx4aZyIt4Ha VJDWJRHRoFqBMNGRj hflmXiBdqjpHC04hPZHA6bSEfez ymMAOhLkT6d2oCLWp7fZVDBfY6Ipf/T4Bxn7iha1EAXM2ZL4qkdFU0g/3BPbozuWOHuWZbLzH9kYLRvrw28fcny55 ynLAefEdLQKPGZcPR4iu59Dcu0ZpeR7FWyZvmZNauE8luSnThnvIwMF8XDxPXSBEs6pYBZOka4poJhR 5VYEgJ/W9Q26pEqf9bwz DjqdfHuXlLG3oEJdoQ0DEwXmY8p6VO3eDiTpEd89A3x6/rd6xuWxOERzNRjvdc2QHqZq3UXBf4q/m0bXD8Dtr22U7PfPQ49Y2lLU3oyz qOValGNJ34/FDjXjVuJtZ4dSAG V36K74M4198NrhqmBqLRvG4sos8d0sqvIk4bc5xKtEuZVpnFSVOOSDGxS9z7YBF4B9eCr ekRVESg2uHt9Eq8/BScqspplP/23VFtHOjGWK6hmXoR5tMG0z6Sy/cF9fTyAMaiFbmNe5Jc64nPlFCOqsWe4wfSh RbjgApPI4uyHhPzMcDMcF08KQSA4eeHiSabBlQF/ZjW xSbekYokQ4CD6uJbc563GXXUDkIXwlu9t9bBs9mSROoWWvK/8pOqm2QSeFoedoTc85r0qzQf9AsuFmUjK6ZsInCdPVAxyIZcMCRACfD3woeRR/vyciz//su28J2 4KsuCcL5MDjsvo0IivJ86OY2C87sw5KDig59LU84YHRteT9Xkt985H8LbNSAxNsJDJjxQWiVC1n9NBM07c

Remove minecraft_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.