home

setup.exe

Radufa

Sambamedia llc

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe, “Radufa Setup ” by Sambamedia llc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.filesn42.com.
Publisher:
Sambamedia llc  (signed and verified)

Product:
Radufa

Description:
Radufa Setup

Version:
1.3.4.2

MD5:
8759e7e24f05c97c400bf114c6df886b

SHA-1:
11a436c55283d1d866c2db9563cf51cb1cf32121

SHA-256:
15fbb870d68ee31ba914d93eec7d2f4c2d069db195aee9aa99f0f21579fb8e07

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 12:58:19 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.8.22

File size:
942.6 KB (965,256 bytes)

Product version:
5.1

Copyright:
Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
Sambamedia llc

Authority:
thawte, Inc.

Valid from:
12/20/2015 10:00:00 PM

Valid to:
1/19/2017 9:59:59 PM

Subject:
CN=Sambamedia llc, O=Sambamedia llc, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
08AF0B7DB5193EDC6FFE31467E46AA55

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cijs6YE7Ykjt0B1R9GO9CkKetgJXtaci/jByl7uR:BnYYlhs3ILJXUci9yO

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://www.filesn42.com/k5bgEAUVKMCdcOtWBXeuKmhyQDqYMO Cz9b8TVZ_nE4NJYK1qqdlS2JAucDYD0wAKYQtwpheQr_l_Go9guKCLgDt7vbQF_8lEYXqE2tlJ3nJX9QZjAPlvN_bZq Q4KCPewizPzv65vAQuyAAZkI4AmOQvBx6YJpX5uDP5qZ8nVl6Yx8v9G7fxIhpaFUL40pbrUMVXuyO7tZYAIUXCHwC0pj65RD8wUubZk60qIiqu_u _2dFuuBKwTri7Ugib07FogqJwmlwMTDx9UIgkm4bkecIsbhzF7uKI1_6tfD9YqdLoPGMECRTvmopNnhUrXOxBB6OX7hfS9G72W44e6_JwvrEe57 KZQRHii2 6AAFt7HcrghDiBc_WU8cCeOl9_XEcTBvRlNGsjrGQENABjgUWGmM7VGoebK_OPN8XCP xsR67lUL8M_I7snyKE240p_UtsfpcOiaa_rUanFJ1zDb3rP0sRoVAu9h5BKQW6gZqRhJU_ixXf6xsQS1kl_r_qFg_jTAVBmwpMEy7x7Yz6ZTI90DBpPahbHXD1w_HuswzVRWRdFwZcMnaePaCcpVmj74ZzCBkeq-iwSAMTcyLjE3LjAuMQM=

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.