home

primopdf setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application primopdf setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.vaulttowerssigns.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
bd3f7ab906137a3c71c6e98608249846

SHA-1:
4fa265128d511484aeefaa7e7b90a736afe68fb1

SHA-256:
07029b8ee9e12378ee5e6bf39024f56c6cdaaf03169481fec4e56de5e11adb12

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 2:23:18 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.31.6

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\primopdf setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:25:15 AM

Valid to:
9/2/2016 6:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:S5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:SdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file primopdf setup.exe has been seen being distributed by the following 9 URLs.

http://www.vaulttowerssigns.com/c?x=d4KHu yFc02rouAFeNPsFnz/o73xcub tnOg162U51A=&c=MMqGF Uu75BBxI5O1kU2/yNNgPZ7Fb4R8kjLI4CH4UQbVvJp4o0zdmKtFcX66TtFL0UGFClpbhxT8RqaUXW6ObCPYElDjcWbrbOcND0HfSsojjthWO9ZuJ8IZYGzcl0zfGhUu5kb2PDGpvgfAJJJLA==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=gl/OXxLHsiw0coW QqFQgnxTEdZIw5YU3qz5S3RyBVg=&c=aG7noruY/GMSJ0ft N o6M9rC6oJHTwlbtmjHCr4ujjdZNC7sq4129lHw5eIGmbZ53445vChPl0O/xN/8FHwwTQ8djUNLLg96d8AOJOfj6UT9Ji7aQOv6qySXXVFdo4HoI9frQJZyORdDqWtFMGJtg==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=DDyldF2QQdpscF/m7yuGoZ/emLPIU7sWh zqQxTxbSU=&c=6k5e7dk/Pziexs2OvSotoWDeoipnESg9WSc3q5gOOTDir43E3V4whN8Sjxtb8cWNXYNW7uRdjzrnZ9lKboG1Zdb GcU2kxho6PCIPuY3axY1YRwuqWvASB6Oll8d5BgNY87N4jBTCvPfvBnLbV7 5w==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=2hcHquhKmB cSyfqQA49SmQxKQ2 AKj1MGdj0g/QufQ=&c=v7VytRFMxNWRa2mDTEcNm6yuPFZGHUQ0aFbmmYR8dE9LWmSlbykPO5oAO5KyHAlkuO2nr182j9903xCnsKB3dAek14KOj9I8Afs0AJqyjxg08FXf777Fif5DdfWD4zxUgDf9jNOehQ/54nZlVrdSPg==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=myxJukQKe3eqYRkOzT6eYKCQOaEJSa3gF/1yB49I/pc=&c=e YMY858LY64 XccqOyM3fjuLxztOG1NmAHleJM2zrKszHT0TnlZmhfJlY5 qGDnVQ2folQ4iMXAInLK1ljNPTjiiMn1Je/2Ywn24ipBDdfLSi8HPtPlCW3CHc70YoQHJCGwPhhxtf01ZzyLTiIjUQ==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=ccVnR0BxbMcwM3tNih/TUQqu12KsyU79xcxiRhgvBj4=&c=gMDQfYtcPJ BmMeNFHoF7pFEG Y145/QBVoXZuNVZg5EMrXi0S0KR 7TT7uMs2OpQyq3C80G27KNr1ddlkZAcW8Q3x8Vo3SVUjL/oAuOGejkVyhZc0a5A1/ PO2DQDOwn1xDWbdDS2z5SM5ZCHkBgw==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=WVKxylsPk ootYYenozg29zd2P DMy6k9bM/IY4gzo0=&c=Vf8tfMj83ln4/GnZPXq0hk8FbIWlSGd6T npR8JMvQvr/b/J3p8avANzn7viiccQlEAH7LVQQFmRor8vCMBm/842ghh6tSzR/ WUC2IpazWfUmI lBlhD2PfjcV /pfTroaa vKlV5RcG3/bzn9rBQ==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=FkPHXjDgDrxWVHfUYcdIrvmazV0zqSblXdJjJ3aCZf8=&c=X0A/SU7068oz36k5vdctM6J7q8xzX7zniHy2u1W40N ZE7iRO/TyYEF/UiTdFXM7HlQ4gZWG//WnPwrFDmTj9vbP4s097mAesvixQ3cPiTKxcDPTRcGihNFl2N5zAeWLob1vzrOQDE1Wm9CW11JrPQ==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=r/yD60nD7hFJTOGkSn/iPhP47By7xIwh8sa8sjXZE/Q=&c=6S6JkBQpmvq3TVpKQZEBCXQh1TyUhOuppsa049x7VjZA5LDqFX0JSLtq4OeM TaxTRI6zQaKWnoCdlsSBhR1KJnWKACKMIIxPIYDbZYpkRR84LNLU70 csjrZi9BaNjhJ/XjOy03/eir1/wiu1mzmQ==&downloadAs=PrimoPDF Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove primopdf setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.