home

safari_setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application safari_setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.vaultsfilespackage.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
57e83193507f759bc01a902d8846fb40

SHA-1:
59ee2ca539b95c55ffd991d12012693a9a4277f8

SHA-256:
9168edbec941e8ba3a1fcc02fb9e4e21031b37fc53be33babe94d01ff2d2d9a4

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 2:35:44 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.30.9

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\safari_setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:25:15 AM

Valid to:
9/2/2016 6:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:65PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:6dlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file safari_setup.exe has been seen being distributed by the following 16 URLs.

http://www.vaultsfilespackage.com/c?x=dszdcK720l2yzPVk2V/Xz5UcBxG4/3O9/pUiIw14Rmc=&c=IZjgbNE6a8vl7ba3BVbdlDcJvmrROWPIHAAeXGFcRKFDL/s/VkZmrbSD0B7a60srnRrRC2NlqW/VubRJtTfbYItV11ZLwtadGdLaIV3ApcwO82zaPRQytWO9sy44nsD7S8nfXOoNDFOfDfg8fCcwkA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.universecontentvault.com/c?x=6HuslKhOVNe14 O88u1bhB9I28godCNQyAxvXOi20fE=&c=NA3BEXCvjZ9eVi 0 6iObg/gmVQ2xjDjVpA3ataoPSczKtT3/HWbnw03KkOKe0HR/bjNuIB C0dNJXQjILj83eO4TPW Us339UMDGnulR8dUFCdc2Jobjo1ThTQxOB4a1WIP5d 4hzXBwDaj1dgxVw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=rcGzDJJonM FyE03CyzCqDRFM4uFuVKzTGmc9ggCCd4=&c=FRVWVbsaXqYhO4ub0ClplyUIay1EDIRT2zGpQPl9Sk9wbptuIaLNiTU8Ky2J72YXpBI 46GhQpaH96Chg9m0/melZnMX9AyLhZ0NEDsJpsp1bMkEmg733VIDEBGwEkLWQmm7M40Ttg1VGxFPiDtSKw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=zkrQ4gleB9kHfSuqPh72N9T4c7MIP7TMPc01GQdR tc=&c=mgLuDXWZxrpB0EDtCByRTpWgiG0qyO/4KF6/B Amrmh6GbE4G82m52lFooofRrCtExW8CDMO8JaAaAkxeHwHHhUb2vDgAAV7KienaeHOvqCi51SieRoFnNnf0PMEV523AolIErCL807AFG0wCvELoQ==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.centertowernow.com/c?x=WoBHAsiBqrpmLrwxBJGU1uwOxsxdaPPu6LhPC8Xv0EE=&c= zTUEJlhwX2t9MkJIvCAUqqYg9FKoqPA8 P8iiiV0uUL axi HAhgJGREfDZ2pwoNdsMkglc2Kk3LzoDhfksfFx51SOZIAT1yC1hwrXm71v4lPBs/n6Lg/kKT0OfQe pryPpaIawZ7Y9VJQQXpI2fw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.currentbundlescontent.com/c?x=7DY9rVIz/fEiHOqDEwYScAnxQ2Zg1JPmmufozllI3OI=&c=mF1GGczLSFLYOkw6Rll4m6GVr0i/XKwyQk42F6chtWuzsBXIhqkgTgGehjM82qPYCun6d6wE82TH1X6ws KuTChnPtkGRRb10C2fnUFBXd3ySkr9TAD7jc9UYFpcTdk2nW0A9 pdt YKh1REoOaTaw==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.filescleartag.com/c?x=Q8nVG46n18BmPSywWwVCyHw uCWOBd1PEDsbwr5Ah3Y=&c=SKFubLUN2EhZ/g7cS2jVAj NDLXBUg2rdfVC0NGVn9t3lEP3DXMlk3jjS8sIaT79pkGlRULBwnMthwJRtcg9Ql8tklUb GazKwSy0nGHNYyTBnh9vrqluRbqa5Wv5UpwqibS36s ymTu3Za5ORpEDQ==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=HVmnP5JYK6qpa9kVUUrOmcHpe2S4PFdIzrKiQ//NW0g=&c=8scYz3uvSQYYTylsjjWXXui/cIU4cYDyO4tqfYn2/qv/XhSTDtEPLYjScZCf1k429jwmMlnW396SPqFcOvk8fqXCfNBMJFmNZLnb4agUjIbt/SEyvzumdiDAJKlC AodX/YyHnRGDEnxh2EilwD eg==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=sj3T ECtUP28buS1Pfgh17zw4lKi0kBPddA1dQ6Ncg4=&c=DOYZrjmwqbb9zqLZwaZkXGxcqnn1Ysd2U9vdDmcKW0Q0Wn5sDj0jcig FyzrXc0ieXE eGfkukNboQVB9huS02FFfZz Vj9QcRtrKruUJ3zPVYLdqGigI1T4R4E0MXlUSSHI67gqPUHQDNiwNzGP9g==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=LQJtKyBxJRDpaJ3aW9//kx59H1q6Q74vQIm929baTFQ=&c=Rqs7FRxyszDwB0xnBTB6SpihZUCZ5cNiAB6JvssA/W6D0pBKl0BhqJsnAPLK6DtwI73gm7J8KR7 UA5g1pOkhwE4p8H9AsbUmw9lZW/6RloaXvppvTz0uyf MgzpviidlqwdViNenN/YxOQlDUpkDg==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=LirV NxMWiPb2ja3tg6GLo ZPyC7WVDjldnCJJLzQDA=&c=Xjp4jK85c/cHPOllNRR7MLN8TlfMhyjMd J3OTg UeynKK3VkSiRx6z9Y/K3hzPb2cuXIHCdTYwuLXTfSOHGTqOn cgiDxJ0PqgH8zlhVNJVN8VjY0o0AhkxkIuMotJdt5ENUBjYBtljBJN6c9JCA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=y2XNbeK0M0ESBcT3p0vQz3q8HocMtnsLL3dBaui7TQ0=&c=KUuqF RtthzuekZncUZbxfWLdsLP165XCVichuRBKr0nv/oprQ4JtNtEo6tGI/COc2Ip4qdwL/2gvSelcgODe3j0orj6h0IiuDJDthy4NJPk2yPLROSiyJH1b8sRi87NjxUKFn7tuy7/ubwMJFUrPA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.grabupdatebundles.com/c?x=EulfMVuqhSV1fQVjslhMDFpW2jpwhUXPmzC2W6vU7I4=&c=4mhWxaGVwSnZeFNJrtePhN4WCTYOd99a4sCW5A3/s3DRHGOGPOeR2g0Zzq6TFsjY3l872qCi dA6aR3 lSmhT4 n43RjnkHdHnPGtB tnSSG1e0x05TncHZqCFSHDusMNKpI/EU y/M7Dn2UjJKijA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.vaultsfilespackage.com/c?x=ud68z68ckePtUNnPxD 0/M fwrr/TBffEI1z5pdYGHE=&c=5SKK1oPyd 894F5D EHGDChjwNHO nTcUcQOibWB4UVBObApm8HH6OD5B9NphdAKkv/wJH4AfUIuRLhClSpNm nqauZ0mwd0xSKyzsdj9ff5r86qWWCF0dfFfVPjQDeKFa 8JYx4tqu00ievmcQjsA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.signssafebulk.com/c?x=3/DnWdu4LCNYrJyRqDVLDco3rWLJXfGXClE1MxDMo4I=&c=FjyKrB44WAmZprp9l/yGae1uMGyDz3SkcpTUZZbhN1D8Nakh9mJE32geHAJP7wBN33FbCc3AEf0opvCxLyLdBWeXeNUfM3iJNEkfBBUMRjgdHwOzauWUPa6/MqhfFIdRs VRLCWe2 zkx83jU9CdpA==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=N4GYq/jJOFJPUrXCdcgT/HLzSfREgttsWA5D kiRFSg=&c=jhIzqn6DhRuj94p/ksJcDmOxsdNiVG4uI7g9nv6ZK5umqOsJc3DCJaunTgp6uL7eSsoPXEmhfKkwDnzTUlgWj0eBCrYboPSImnZdEKwPdwqstOS7uSg8ulJ222UdEuFUf6ShLJbssZuFHXcc1eBxzg==&downloadAs=Safari Setup.exe&fallback_url=http://www.downloaddu.com/landers/.../download.php

Remove safari_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.