home

Setup.exe

Setup

The file Setup.exe has been detected as a potentially unwanted program by 3 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from 201.31.162.82 and multiple other hosts.
Product:
Setup

Version:
1.0.0.1

MD5:
abe768c3a477f7910e8f193fc5c873e1

SHA-1:
3fc8b2e1a1ae472e9e5dbb102d1ad5825fb3877e

SHA-256:
317dbef09295496b7e194e2b6885abad7892bdd3ad8602bcc69f55022214d8b2

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
1/12/2025 12:40:50 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/Adware.Gen7
8.3.2.4

ESET NOD32
Win32/Amonetize.ET potentially unwanted (variant)
10.12904

Malwarebytes
PUP.Optional.Amonetize
v2016.01.21.02

File size:
400 KB (409,600 bytes)

Product version:
1.0.0.1

Copyright:
Copyright (C) 2015

Original file name:
Setup.exe

Language:
Hebrew (Israel)

Common path:
C:\users\{user}\appdata\local\temp\nsmfae8.tmp

File PE Metadata
Compilation timestamp:
1/21/2016 2:14:13 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:WnXW4xfJ6NtLO6H505p5Zxg7ts2W6UEATax4Yq+KhE1k:WnG45J6POc5g76W6UE/G+Bk

Entry address:
0x18F80

Entry point:
8B, FF, 55, 8B, EC, E8, C6, 1C, 01, 00, E8, 11, 00, 00, 00, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, FF, 55, 8B, EC, 6A, FE, 68, 28, B2, 45, 00, 68, 90, CD, 41, 00, 64, A1, 00, 00, 00, 00, 50, 83, C4, 98, 53, 56, 57, A1, 78, E2, 45, 00, 31, 45, F8, 33, C5, 50, 8D, 45, F0, 64, A3, 00, 00, 00, 00, 89, 65, E8, C7, 45, 90, 00, 00, 00, 00, 8D, 45, A0, 50, FF, 15, 48, A1, 44, 00, 83, 3D, E0, 1B, 46, 00, 00, 75, 0E, 6A, 00, 6A, 00, 6A, 01, 6A, 00, FF, 15, 44, A1, 44, 00, E8, 8E, 01...
 
[+]

Entropy:
6.1384

Code size:
291.5 KB (298,496 bytes)

The file Setup.exe has been seen being distributed by the following 4 URLs.

http://201.31.162.82/cache/cdn4.downloadjelly.com/.../Bundle.exe

http://osdsoft.com/.../Bundle.exe

http://cdn4.downloadcrest.com/.../Bundle.exe

http://cdn4.downloadjelly.com/.../Bundle.exe

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.