home

setup.exe

The executable setup.exe has been detected as malware by 4 anti-virus scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from network.adsmarket.com and multiple other hosts.
MD5:
bf0fd90799b6f10bc182510821eb8649

SHA-1:
023c904a680c7c266f98941f52823e12d1094e95

SHA-256:
b54b44d8a9d03c3fe8f899977266e60c2b0f206129c57ef93f39d6908f095e3a

Scanner detections:
4 / 68

Status:
Malware

Analysis date:
12/26/2024 5:25:52 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.Encoder.2670
9.0.1.0305

Malwarebytes
Ransom.CryptoWall
v2015.11.01.01

McAfee
PWS-FCEJ!BF0FD90799B6
5600.6595

Reason Heuristics
Threat.Win.Reputation.IMP
15.12.8.23

File size:
219 KB (224,258 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
10/25/2015 5:50:39 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:gKaNeM9JoKFgEU4EZZ1uzJwjYQ81hcdp/G5MGC:gKrEU4EZzuzJwjYlXcdpea

Entry address:
0x3740

Entry point:
55, 8B, EC, 6A, FF, 68, 40, 4A, 40, 00, 68, 42, 39, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, 6C, 42, 40, 00, 59, 83, 0D, 84, 83, 40, 00, FF, 83, 0D, 88, 83, 40, 00, FF, FF, 15, 68, 42, 40, 00, 8B, 0D, 78, 83, 40, 00, 89, 08, FF, 15, 64, 42, 40, 00, 8B, 0D, 74, 83, 40, 00, 89, 08, A1, 60, 42, 40, 00, 8B, 00, A3, 80, 83, 40, 00, E8, 92, 01, 00, 00, 39, 1D, C0, 7C, 40, 00, 75, 0C, 68, 3E, 39, 40, 00, FF, 15, 5C, 42...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
12 KB (12,288 bytes)

The file setup.exe has been seen being distributed by the following 4 URLs.

http://network.adsmarket.com/.../iWhvm2acqZWLaW-bX8p6w4iQa5heoXqXiWKYmmCkgpSJkGqXYZ57lbdqbp5joXs?dp=H6vAH7R0XBc9EBI0eABHLKYZgHAHMLJr9hvFg4ekUqdjdDqrvGZT0scEGDFR7P60ShyCHbV4cwBBLVQCu2h3p_qrtMOnnvJ9e_mKoGxaaPC4_VjnZ9nj_-clXR3M4Js60lfCBEGtb6oRq7IOgL6dwr6p6Gn6X3W5kmrDECr5Z23GrPOsrTS-ZMlvdJJxJeYRikZ6tSDt4XF4UtWwl6Eo0Kx7HistXdjOKYeRZiiMohDUFBqfq6LRlkZP6fxCNivoaygohaAfN5dTWO2VYoT3297NBXzBtnvsFaP7XtZk0EWNwcXAfpC_SFzEwVMKPMw_W_lbCmjoJRMcPLnIKEmuokJcKTPbK8qBshbSuVymQrdJb-iYGCY6DPYS6C-44oOUMA_myCFT1SqygwChn14ljRN8BWQ1s89-f4xBg4kRsMDwI1OoUXlmXVIL

http://cldrload.com/?a=13409&c=61981&s1=JINGES

http://dl.softohqimjjedf0jq.com/n/.../Setup.exe

https://www.dropbox.com/s/.../setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.