home

setup.exe

Bigasesadu

AVSoftware Ltd

The application setup.exe, “Bigasesadu Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.contentflashtag.com and multiple other hosts.
Publisher:
AVSoftware Ltd  (signed and verified)

Product:
Bigasesadu

Description:
Bigasesadu Setup

Version:
3.8.5.1

MD5:
a4d0468e34eebd1b7d13b85ae7380de5

SHA-1:
3422b6dc5652b2894601ff7727660958e8d98616

SHA-256:
150daf300eabf8c588cf7ad012e842e9a0616cf12d5fd37532e4300f85dac20e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 1:47:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftwa.Installer (M)
16.4.20.11

File size:
964.9 KB (988,032 bytes)

Product version:
5.4.2

Copyright:
Web Software internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:55:52 PM

Valid to:
12/31/2016 12:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:fl8mbRZRz5W3NXkdnObt8B9EiWPCv1BZg+FOwSGkPMD6+bpYoq:fSo/rqXtt8fWq1BZ/KM1NY

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 13 URLs.

http://www.contentflashtag.com/c?x=OXCBtelzHjRoJA3EmW8DN/KI6P6GHAB4hKYXrP9kuts=&c=ocxQFGx4p8HGgmKl644LQAD5iG77WydRzc7uxcy EtDRHPf3LHGrEvJNYQksnfYAxI6qQT1h2NT4wwSFEvKgoFEQeh6rGRVrs7FWQItabZLx4jnTclOQuvQyKUjXx8of&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.apppresentranch.com/c?x=r56/bK4uYjAKPvMdO3yCfe4fKnNn6Elh6mjsZhb/DGM=&c=MGexznRa11XG68DABzafM4BnxpN6bVw/XpuPPOCSXOCHC3bY8Y6P/v/EnGMPmt7uR3u8Uy6IWYDaNgYIUjTg8uvGlmZmaID/MTvaA5kps6Qh93iW4O/GnDuAwaK7atey&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.apppresentranch.com/c?x=U9cfbmxEM2Cpkwhqp7OWc6VeDY1mH OB3C0jKaBg2Uk=&c=Wn0Px3qRCFD5CfCEwwHf/3JoDPxpUTA05gF59f36oSPDSrlMs12vUx1FVfQhLtTMDQ3N Tx0jRCpYXoOqlBhI2H1GEPqsKESdfRS0c6gaj3MX1f830iIoTet2hbSezLQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.contentflashtag.com/c?x=iNUAOxHKovsMwGMHlg44YTO6ahdozOeA1XwTm80Cm94=&c=sW8mQ9oRaOLugkf9x6bGx803cjizzKwMD1U 4sHmCJ8dTerN4gBuHKmetvasrifScNZBUICJt eL28dUN6A0bpih3XZ4/eILsep9d6u5qvW0oDaiFNfMT8dfpZpDh98m&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.contentflashtag.com/c?x=rhAEKVK/b9pH2pfCxxoJzYQPx/99WzKWYQBEbFzbdbI=&c=USp10u07uHGK/zbezpSKvc1yzAJoSyPOUNYsyHNLL1uG Trp/gCGsR xtRwZxRWE31THJYcRp/KU8/7d9f9MhsEuqkA0Ycd6cA335OtEVKzj6v8NuWEcM7fmJi 7VxZJ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.contentflashtag.com/c?x=3Rx0hi2DWHKu6Z1RzVcLyY7hkcScNnZgeTPzwQ JA7E=&c=X6X/6QVdhvPtvFca1aLHARj1PlESIhfu P9qHxygTNT3VxqbPlHcEXcuYdc/kyK4sg1vPbeGtffjhb0Co3kZu8cessw0 cfjcd8SxHHG453sMQpMOAV337O80mb1urWZ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.apppresentranch.com/c?x=vvcxkFJPU1SWpiZ9/bjMsXYRhDKpkd4Eip35Cu twQw=&c=B044wO1AdzdgwjXSMIpX QnJTX2FLJ8UH0L2fy 1Wt4OFiljTI0LDrRQAvswhyljMZ0JuajnFQrCQ5oqc0m78nor4kAD34nc8CAJvAv6BSFVJgHOHZYWUm1waQd/vF/3&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.apppresentranch.com/c?x=E4eHljJwysDjkp4LoMoU9AyH2aWp PO32wWMtyZlsYQ=&c=fAYmTxQTxV3DvRwAv1AxfKhmudvfmQzewHp6VXCBJ1pv4kK8RllcErWqb7euXbsaoneFZGDnyaUhibavyYAh3XhWKRhffkdoOdGUQwwdGcHsztwrMpTRC4swU9Tkx1Or&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.apppresentranch.com/c?x=Urpt5hUt5jpDXEiqkgjoN9 RYJ7uVOvrORftfmxS99Q=&c=Q3Ej5uXdTNEQ1vPVSSwTn3x4i5OAujjWntNT2q4mee9ohfMj50s25YaPjmc5EDgVG0ik/G2eFVYkHQsZxB9be1XOwW6m5lJOu/ApxYeYF1LafdRWqugQH49P6vCjCUeQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.apppresentranch.com/c?x=OP7lEWveBd wwmuVMAL/4rhBgMD4Neo 2hz aU297Fw=&c=DLF2atRGsK5NNZA y14ztZuV6jB0kcYXDc14oDtyQ 6roF5i c02JCB94cl7PlwB2ToAIIYN4/ 1AdeP/tZ v05UslYFvDFv8wBW4TnFbR5B5CMwbAApdV4Zjh3aaCJz&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.contentflashtag.com/c?x=XI5pn3Nku7lmEvzTEQDVYk8mwW6QyFi0NrSTjNlC498=&c=KyAVIrgk8jVvlNnxxZIUItQMxVwJq7uhdCQFslT28Hfz3bwR 52rCWvEWaqQRTgGHT6ov2PS5qAgBcu8DQDtFC61XAa5QZr2iF0LPC3erkyMcrhtMKv4Kc93vNclC5jC&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.contentflashtag.com/c?x=y7nBaEO3SZTUCi4g8Fk1I/KK6FKiI2OzNnOX4R2zauY=&c=19q zcOPo2Q5NnjiciWgJGElZB3Hv3OgEb FOqjKb1WfbJkMPh1RHwi1BbatNCIyxCLSMnVELhuMdk5E53al69cjhQdsKObZlJyVkg7wHkWHDGghmRzPwUxFUeS2B/ w&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.contentflashtag.com/c?x=aODEohtxt8I5 oLdxvoIhSV GCa6m2y6pXbZ3vJz2KI=&c=xYJrpdHr4Q5t6b/atig8sHUhRnQB9kdgEOZVRdec8vaDX6 2TxZtmUGZSpxOs9Hi2 YFNq1aZoCpGiW/YmL/Y3jOSSG69SYUBX7Lew/GMzVD8RRZyMV LUmeta/YtH G&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.