» officesetup.exe
Overview
Analysis
File Details
Programs (2)
Downloads (11)

officesetup.exe

Microsoft Office 15

Microsoft Corporation

This is installed with multiple programs including Microsoft Office 365 - en-us and Microsoft Office Professional 2013 - en-us. The file has been seen being downloaded from c2rsetup.officeapps.live.com and multiple other hosts.

File name:

officesetup.exe

Publisher:

Microsoft Corporation (signed and verified)

Product:

Microsoft Office 15

Description:

Microsoft Office Click-to-Run

Version:

15.0.4454.1002

MD5:

b86d4ccdafff3a5071d30d9994c58023

SHA-1:

cb798d3c3030695fc8616a312feecfbded09cd73

SHA-256:

66977ae4a24a81af2ef498a240a5a764f3c1e34cec52db1ccf3a4fe5a8d8f50d

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

12/28/2024 12:20:12 AM UTC (today)

File size:

762.6 KB (780,888 bytes)

Product version:

15.0.4454.1002

Original file name:

Bootstrapper.exe

File type:

Executable application (Win64 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\temp\officesetup.exe

Digital Signature

Signed by:

Microsoft Corporation

Authority:

Microsoft Corporation

Valid from:

9/4/2012 2:42:09 PM

Valid to:

3/4/2013 1:42:09 PM

Subject:

CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:

CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:

330000009D1E8D27AEB8F3D83800010000009D

File PE Metadata

Compilation timestamp:

11/20/2012 4:05:45 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

10.10

CTPH (ssdeep):

6144:kdmxtArjlCZq7P8Rgc3awJolnIOuFRTda+Fb8U/XmneDR2ryuzZgqnJfk1vik/mY:Z2FCZ4bcQnIjacTm+hqSUk+vZOt

Entry address:

0x42578

Entry point:

48, 83, EC, 28, E8, 9B, 54, 00, 00, 48, 83, C4, 28, E9, 52, FE, FF, FF, 90, 90, E9, 8F, 1A, 00, 00, 90, 90, 90, 53, 48, 83, EC, 20, BA, 08, 00, 00, 00, 8D, 4A, 18, E8, AA, 55, 00, 00, 48, 8B, C8, 48, 8B, D8, FF, 15, A6, 2D, 02, 00, 48, 89, 05, D7, E8, 05, 00, 48, 89, 05, C8, E8, 05, 00, 48, 85, DB, 75, 05, 8D, 43, 18, EB, 06, 48, 83, 23, 00, 33, C0, 48, 83, C4, 20, 5B, C3, 90, 90, 48, 89, 5C, 24, 08, 48, 89, 74, 24, 10, 48, 89, 7C, 24, 18, 41, 54, 41, 55, 41, 56, 48, 83, EC, 20, 4C, 8B, F1, E8, 8B, 3E, 00... 
[+]

Entropy:

5.6252

Code size:

397 KB (406,528 bytes)

The file officesetup.exe has been discovered within the following programs.

Microsoft Office 365 - en-us by Microsoft Corporation

Office 365 is a subscription-based online office and software plus services suite which offers access to various services and software.

www.microsoft.com

9% remove it

Microsoft Office Professional 2013 - en-us by Microsoft Corporation

6% remove it

The file officesetup.exe has been seen being distributed by the following 11 URLs.

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&token=M4GDV-XQNTV-PDFP3-MPKM6-YG7T3&platform=x64&Source=O15HUP&version=O15GA&ProductreleaseID=ProPlusRetail&language=en-US&TaxRegion=PR

https://doc-0c-3c-docs.googleusercontent.com/docs/securesc/pg93segls5vs3nkcqoplev1afkef4us7/3526mfqd1qre5h9919ucq2qjsa424st9/1421236800000/01513477732717676821/.../0B0-PKXpMWT6ZbHNadV9YdGVHOW8?e=download&h=09278814142114773232&nonce=1149o8efdhph8&user=09598575967007837608&hash=2u58l5jmh5trl1vpa0evpjas3c29a7ue

https://docs.google.com/a/forbit.se/nonceSigner?nonce=1149o8efdhph8&continue=https://doc-0c-3c-docs.googleusercontent.com/docs/securesc/pg93segls5vs3nkcqoplev1afkef4us7/3526mfqd1qre5h9919ucq2qjsa424st9/1421236800000/01513477732717676821/09598575967007837608/0B0-PKXpMWT6ZbHNadV9YdGVHOW8?e=download&h=09278814142114773232&hash=hutr4ngb00l7bugtln6amev9p47d1ohj&urp=https://drive.google.com/.../&pli=1&auth=DQAAAMwAAACHZF3H2u9fW5VBcPGscki0kLoTRKnGCN83mlvF-OSlyhcHLZ_aK9G5vADR_Vt3C5KYuED0kpO-WCIQVRVBCr3TbpsDlz_qumcqbK7ARCQfx20ZzwaptcK24pIwCQhl27nxuc9uiAoYrcw03sY1UPvpbIuTt3pEQJ1oW_dewZIVgjSOoWjs8V--BOOVjjWBPyqOMiLzYdaai3P0iwiPeG9Mep-uVPkoQSa_1Tz1UvD-zEXNwbfSI8HGpdvpnwgmtpYJBSILAfuV51VxfxIBhKcX&authuser=0

https://accounts.google.com/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/a/forbit.se/nonceSigner?nonce=1149o8efdhph8&continue=https://doc-0c-3c-docs.googleusercontent.com/docs/securesc/pg93segls5vs3nkcqoplev1afkef4us7/3526mfqd1qre5h9919ucq2qjsa424st9/1421236800000/01513477732717676821/09598575967007837608/...//drive.google.com/drive/&followup=https://docs.google.com/a/forbit.se/nonceSigner?nonce=1149o8efdhph8&continue=https://doc-0c-3c-docs.googleusercontent.com/docs/securesc/pg93segls5vs3nkcqoplev1afkef4us7/3526mfqd1qre5h9919ucq2qjsa424st9/1421236800000/01513477732717676821/09598575967007837608/.../%2

https://www.google.com/accounts/ServiceLogin?service=writely&passive=1209600&continue=https://docs.google.com/a/forbit.se/nonceSigner?nonce=1149o8efdhph8&continue=https://doc-0c-3c-docs.googleusercontent.com/docs/securesc/pg93segls5vs3nkcqoplev1afkef4us7/3526mfqd1qre5h9919ucq2qjsa424st9/1421236800000/01513477732717676821/09598575967007837608/0B0-PKXpMWT6ZbHNadV9YdGVHOW8?e=download&h=09278814142114773232&hash=hutr4ngb00l7bugtln6amev9p47d1ohj&urp=https://drive.google.com/.../&followup=https://docs.google.com/a/forbit.se/nonceSigner?nonce=1149o8efdhph8&continue=https://doc-0c-3c-docs.googleusercontent.com/docs/securesc/pg93segls5vs3nkcqoplev1afkef4us7/3526mfqd1qre5h9919ucq2qjsa424st9/1421236800000/01513477732717676821/09598575967007837608/0B0-PKXpMWT6ZbHNadV9YdGVHOW8?e=download&h=09278814142114773232&hash=hutr4ngb00l7bugtln6amev9p47d1ohj&urp=https://drive.google.com/.../&ltmpl=homepage&emr=1&authuser=0

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&token=DCMN8-34BTR-MF8HW-YTDTF-842DD&platform=x64&Source=O15HUP&version=O15GA&ProductreleaseID=ProPlusRetail&language=en-US&TaxRegion=PR

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&token=FNTWH-QHM3R-98RK8-JHVKD-FM29Q&platform=x64&Source=O15HUP&version=O15GA&ProductreleaseID=ProPlusRetail&language=en-US&TaxRegion=PR

https://c2rsetup.officeapps.live.com/.../download.aspx?act=1&token=WQGBR-NYWJK-64PBW-RC4RD-8K6XQ&platform=x64&Source=O15HUP&version=O15GA&ProductreleaseID=ProPlusRetail&language=en-US&TaxRegion=PR

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.