» setup.exe
Overview
Analysis
File Details
Downloads (15)

setup.exe

The application setup.exe has been detected as a potentially unwanted program by 20 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.more-files.com and multiple other hosts.

File name:

setup.exe

Version:

1.1.6.20

MD5:

c6a0829c32826420a814dbcfc84a1a00

SHA-1:

3e50ad40265c6167c8753f9248894dfcf1796d27

SHA-256:

e6825d30427066ac6413f65276bb28a6f001163eba639196d2208d2ad40e39d1

Scanner detections:

20 / 68

Status:

Potentially unwanted

Analysis date:

12/25/2024 4:42:31 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11241702

1010

AhnLab V3 Security

PUP/Win32.Amonetiz

14.04.24

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.145.44

avast!

Win32:Amonetize-AX [PUP]

2014.9-140430

Baidu Antivirus

Adware.Win32.Amonetize

4.0.3.14424

Bitdefender

Trojan.Generic.11241702

1.0.20.600

Emsisoft Anti-Malware

Trojan.Generic.11241702

8.14.04.30.09

ESET NOD32

Win32/Amonetize.AJ (variant)

8.9720

G Data

Trojan.Generic.11241702

14.4.24

K7 AntiVirus

Trojan

13.177.11922

Malwarebytes

PUP.Optional.Amonetize.A

v2014.04.30.09

McAfee

Artemis!C6A0829C3282

5600.7150

MicroWorld eScan

Trojan.Generic.11241702

15.0.0.360

nProtect

Trojan.Generic.11241702

14.04.29.01

Qihoo 360 Security

Win32/Trojan.Multi.daf

1.0.0.1015

Reason Heuristics

Threat.Win.Reputation.IMP

14.4.30.21

Rising Antivirus

PE:Malware.Adware!6.17D8

23.00.65.14422

Sophos

Amonetize

4.98

Trend Micro House Call

TROJ_GEN.F47V0424

7.2.114

VIPRE Antivirus

Amonetize

28688

File size:

343 KB (351,232 bytes)

Product version:

1.1.6.20

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\setup.exe

File PE Metadata

Compilation timestamp:

4/24/2014 5:00:57 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:Xir80hGeYnpLDaqDLIBzUm9IJNeRkseM242E3L5pB+wSeLjz2GB3z:Xir80h/YnhDaqDLQzUZ9REb5pBCc203z

Entry address:

0x29A71

Entry point:

E8, AA, 9F, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F... 
[+]

Entropy:

6.4420

Code size:

244.5 KB (250,368 bytes)

The file setup.exe has been seen being distributed by the following 15 URLs.

http://www.more-files.com/alldd.html?myref=www.newhdplugin.net&version=1.1.6.20&prefix=FlashPlayerSetup&campid=4369&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=MTEwfDIxMzB8UEx8M3wxfHw|c4020c18ac49f2e4c71e8ec2b43ff076|e9a8d4d0-7ef5-11e3-8036-0025b320a860&capp=FlashPlayer&AMt=1398550772386&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.innovativedownload.com/download.php?version=1.1.6.20&prefix=Mafia 1 Free Download PC game Full Version&campid=5064&instid[appname]=Mafia 1 Free Download PC game Full Version&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer*12.0.0.78&ti1=MTEwfDM1OTZ8UEV8M3wxfHw|c4020c18ac49f2e4c71e8ec2b43ff076|9c8ed7e0-cd7d-11e3-a21e-0025b320a860

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=MTI0M3wzMDgwfERFfDN8MXx8|65b474ca1849c607456c55c89fa520c1|3f149050-9a6a-11e3-a424-0025b320a860

http://www.more-files.com/alldd.html?myref=www.newhdplugin.net&version=1.1.6.20&prefix=FlashPlayerSetup&campid=4369&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=MTczfDIxMzB8R1J8M3wxfHw|c4020c18ac49f2e4c71e8ec2b43ff076|e85b2780-52f5-11e3-aeff-0025b320a860&capp=FlashPlayer&AMt=1398469870320&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer*12.0.0.78&ti1=NzI0fDMwNDJ8RVN8M3wxfHw|65b474ca1849c607456c55c89fa520c1|7eb27c10-ac7e-11e3-9788-0025b320a860

http://www.conductdownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=MTI0M3wzMDQxfEFFfDN8MXx8|65b474ca1849c607456c55c89fa520c1|86511660-84f2-11e3-8eaf-0025b320a860

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer*12.0.0.78&ti1=MTY3fDM1OTZ8UEx8M3wxfHw|c4020c18ac49f2e4c71e8ec2b43ff076|ace36a70-b31f-11e3-a23a-0025b320a860

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer*12.0.0.78&ti1=MTg3fDM1OTZ8Q098M3wxfHw|c4020c18ac49f2e4c71e8ec2b43ff076|72b73ce0-4c9b-11e3-adf5-0025b320a860

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer&ti1=NzI0fDMwNDN8VEh8M3wxfHw|65b474ca1849c607456c55c89fa520c1|09a38a72-b1d5-11e3-a749-002590f00f96

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=3435&instid[appname]=Magic School Bus&instid[appsetupurl]=http://www.gamefabrique.com/download/.../magic_school_bus.exe&instid[appimageurl]=http://www.gamefabrique.com/i/.../magic-school-bus.png&prefix=Magic School Bus

http://www.gofordownload.com/download.php?version=1.1.6.20&campid=4607&capp=FlashPlayer&prefix=install*flashplayer*12.0.0.78&ti1=MTEzfDM1OTZ8VUt8M3wxfHw|c4020c18ac49f2e4c71e8ec2b43ff076|5a758671-754d-11e3-b6bb-0025b320a860

http://www.concerningdownload.com/download.php?version=1.1.6.20&campid=6328&instid[appname]=PhotoFiltre Studio X Kurulum&instid[appsetupurl]=http://www.tvce.net/dosyalar/New-Version.exe&instid[cmdline]=&instid[appimageurl]=http://.../resim/files.png&prefix=PhotoFiltre Studio X&instid[thankyoupage]=http://.../git.php?k=fullprogramlarindir.com

http://www.innovativedownload.com/download.php?version=1.1.6.20&prefix=Spy Hunter 4 Full&campid=4869&instid[appname]=Spy Hunter 4 Full&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

http://www.knockoutdownload.com/download.php?version=1.1.6.20&prefix=Mega Mash (Jason Mraz vs. Green Day vs. Black Eyed Peas vs. Owl City vs. Maroon 5 vs. Akon vs. A.ha vs. Flo Rida vs. Fall Out Boy vs. Daft Punk vs. Kelly Clarkson vs. My Chemical Romance vs. B.O.B. vs. Mika vs. The Killers)&campid=4409&instid[appname]=Mega Mash (Jason Mraz vs. Green Day vs. Black Eyed Peas vs. Owl City vs. Maroon 5 vs. Akon vs. A.ha vs. Flo Rida vs. Fall Out Boy vs. Daft Punk vs. Kelly Clarkson vs. My Chemical Romance vs. B.O.B. vs. Mika vs. The Killers)&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.