home

runescape setup.exe

Soft Installer Program

Media Theory (New Media Holdings Ltd)

The application runescape setup.exe, “Soft Installer Program Setup ” by Media Theory (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.toursheartflash.com and multiple other hosts.
Publisher:
Software Installer Web   (signed by Media Theory (New Media Holdings Ltd))

Product:
Soft Installer Program

Description:
Soft Installer Program Setup

Version:
2.6.5.3

MD5:
8ab62303f0291821604cd003c762fa5e

SHA-1:
4197386fecd324e613f618b66f92b255ec99b7e4

SHA-256:
3622ad17f178d9948700cb99cb583806dd7f5a3270a95454ec2c63ad003fc3b9

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 6:25:54 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
15.12.24.7

File size:
959.7 KB (982,776 bytes)

Product version:
2.6.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\runescape setup.exe

Digital Signature
Signed by:
Media Theory (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
5/25/2015 7:37:49 AM

Valid to:
5/25/2016 7:37:49 AM

Subject:
CN=Media Theory (New Media Holdings Ltd), O=Media Theory (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA944A31E4793A274CC4ADECFF1E7349

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:TzUYA+88/qxmNIqyIHgVRP0zKfyxHQr98X:TzZANMgmuvIu8w

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9334

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file runescape setup.exe has been seen being distributed by the following 15 URLs.

http://www.toursheartflash.com/c?x=kzaibgcG5q6t4IAdWpJ3Cq /J84I0/2IhJx7iPe9ymo=&c=x663DBwToqCXOJh2 hL5K/5 RtiviN2fYACAE0L/3XQg23S1Qp3VyViwxgjZfsYDoCFjozBi1A7v o4lZF1oMm5KpmyU044jl7kwL8JfkYvZxvR99 xhh/o1RnAJZ3O87nJ1XuyhesOCSLOxnaAjLQ==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.applicationstodayvault.com/c?x=qfT IHT0HQcMQBl1C6nyQfr2yiK9Eh6yz611QXBrmf8=&c=BskrI6D0SnHZMB4IwySvm A3gf4WqTBLqiUoltBZOm1a6Pv/X5zEPTVRPShJuNeI630tBCGaLc7mcl KC8rHxUQW6Cd3pRZ2BdEqlezglvSTMiiAd1zrZvWufSCA3I9Qrl6lCFTzObTzLhxS8mvF/w==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.bodyranchtag.com/c?x=pBUhFikyocVBujhFIPTFcjdSOlpW3cTP/1Mj7SCmAKw=&c=ZexYCXs2T118NKQ3YcY366IJlkOqf/EfLYMqYS2JZo5kGVXLZetknHxS228NknITLcfSozEz0DSwaddxp1qxMKcSyQLxJsoeqjuSDFCRD/444//fyXlkXg1bamfZ6xwxXUjj6IFQrGp5Uo9xkJmfQA==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.toursheartflash.com/c?x=zLjJsBEGlZxskobmibpeC9Ot4yxjN3XraSSUYW51ft4=&c=obKHCFND/hZf81XvykVkbmyIVQDmdhrWE8pb/4OHCXXt tDdhldwkAicxsbup1ixguzFU4p5Ok1lqC8St2xz/cxNjer3zoxHhSvm YrYHcpeHe6yoFRGi 7anlpd7MPSRCqMA8vGY1uv dW1dxZ/fg==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.megatourapplications.com/c?x=rlkXvatog /wec3vlJONKAHIu6GgCehAHHr8RIxSKY=&c=BRr89vigvsldLxXq7z7tsF5rYESiBZM2ZNcLAjFYiTvlzfkn4azHWKPqvPas4kH6hQX4G1xuXl8ENP2Li2bdLepfBFfvFM38v37 mgT2cIWpYRnBIWL/RY3wnanZ5hjS7wjJYQO/CQYiN26ZqFqtwg==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.dldeliverygrab.com/c?x=z4R0wFup2nEldgAVfRk/Ca pRMWqq8AaxYxLujNX Tw=&c=PoCxcsR27MrHMHV38B4FsnCD4MVRK/JrHYcgmD9/dLTi8tTZZ78ecUVVeEjNFZgKg4ZCW5wti6WDW2s7QlSPJDMjNvnvfuCgIcuz3x4nVLenyJpjHiroVmsQ2A3IsAzRWhFKDpylOkw5gOM6mY5AYg==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.megatourapplications.com/c?x=b3cORAoqS2S5C9NSWD5g2fyNljwaZembsxT/J6hYuDA=&c=/QG32uTao2 0qOi0RNClImcuoX0VldV5HGP3vRbvecPZbaivaF D597ANOxfdJaFZihlA6Z92pzecKnEIkOTp DCTEny174i2BHcbAYmjIVzbjHVYHRqs1H 2Ra6Xvb8amfT2aubg82BO1/7GTyrQQ==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signcleartowers.com/c?x=iAdKCKB5JaF nUwNHEJK9qU8tCS1qVWkPrOGGoQs2SA=&c=yAmZ1JY00D8QRYL5Pc1CePY/cRPvfTbmuk70igm6GWRZF2 y69m6AOO4sRN5cqkNLC61YYMKVPg34RI3 bC4dX0NAfizqhH0revFmvjsAP09BSxncc4TIWLyLO ZwP46Xw85qc5do7ss9XOfAQ mHg==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.megatourapplications.com/c?x=95OxXnXrGXWEYXEwZhcjgQJ0mjaef3u9vbyOTLh18KM=&c=NgeZs uOn6aZPfE gwtJ95R6gTV16Wlb9fdJ6 Yt2XIJfDbPbF41T 6zqbxBYOJeSdxsr983t/bRfqnpYdDF0g9Qlwpy6QrvuUAgzv86ccKyEyyORzpHvxN39iI4UPjMC2Z IsFULbg/Sukg7TYC7A==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.bodyranchtag.com/c?x=tSndeuFpFB1bKzmmBHt5BnugCL97Q7W3Lrn0/eTOw8k=&c=/TR2fZ1RYWS5oI93 L4VPnirDa ZvVZd8Frm9843vCEa33VwbVqkb80xbHLy/55oExHwmCPV/5FOqI96plC8a6o64zLtGZYyQN/Yue4Dp7gFKKKQlgOe2eHunTRiycIt3PER7T9aKWIGjhUBQ4NpEQ==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.bodyranchtag.com/c?x=NtouzOvap2ZBQyM2vVa2qDyJ6dSIMCKgBouNb3fURpU=&c=94MhsS0S j/wDbEBCPWHEIjboDaDigsLoJujGIzdAJVxLinGv7NNIsOPdRt/vuRIZr2q6EGyqDZnoz10FnrZR VNYkndf2YPtyijekDC8WxqidIrH63rEH4mrCJU6FYr7M6DvekAiy5ZTQpToS5L/g==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.bodyranchtag.com/c?x=pqRkmoGJbc8LkI5Yuo85v2j9d 3FMnvUlJaMt HYtU8=&c=SrYJ6vn2YMebDzLVQF6FVov1op956wEKg7tFIEfE0YFvltjS 5LU7CpO6r8CRXj1 9x2NYEtgQewwaGUqby6rDjjIBQPQBfYnzzcL4n7DWsjZ2T3HPlPiH/G9/ lrmGsjDI4ig7oJ/71mWNnYs TIw==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.dldeliverygrab.com/c?x=QfP9r3Z7phemHr9auXbF08ZamHGC4jGu8gw7cDUqbhc=&c=XphkkLBVxwif1ujv WRL0bfVAKoJBtaT6k/cl8Gjw0szgwd1vEB6ePxoWMSp 5cKIn6w/0eOUBGCQk0nGrpv52vjJekVWcusHBLwR9cgjZLE4LjCVKutgmsJV 5n FgVGdmcdT2YjuC EnADj6rkKQ==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.megatourapplications.com/c?x=vz83RkPtgV0lN8CmOumV4zafM83emoZXl4h1XA6ygPM=&c=QI4yZsYSpUIFQfJqGJpQUVOLZ3sw4R Y5ARlpU0np2yJ3WpRLMimgx4p6sEeJdIn74ZS2TAiQHHX438YrgaY5yHGV ZVDHiv8bW tvJwwON6HiLUQuU7oGxV6eZEX0h7kLYhlqF77u0Oebn5Is9Xmw==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.tagsignsclear.com/c?x=a2h6GRxPuQDvIYY8A0YdkbqXAtskyuiRJb3ZuYe1Kko=&c=ldtPhgE5oB67L1N4545Q 7yysU4Xay LHtWz1tCsUobwNswgnH7xJXshVsByLaCZJFrFP46V435P79vzO2sNJIDHaCTZc0Lv1AZU7LvUthtYVwQEztTg670BhXQlFwkHIHjjPfJNgmF6 r ZceieNg==&downloadAs=RuneScape Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove runescape setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.