home

setup.exe

Black Ops 2 - GSC Studio

iMCS Productions

The executable setup.exe, “Black Ops 2 - GSC Studio Setup ” has been detected as malware by 6 anti-virus scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from ttb.lpmxp2158.com and multiple other hosts.
Publisher:
iMCS Productions

Product:
Black Ops 2 - GSC Studio

Description:
Black Ops 2 - GSC Studio Setup

Version:
14.9.29.0

MD5:
87c9442d06dc17c6c7ee5e6e74fa3fd5

SHA-1:
44045d8a508401ace38f4bedc214b3751351e5d8

SHA-256:
8df79ce8b2f53794b32dad5d6dac9489a4c1b68b6d7dad8db726cece30a66d7d

Scanner detections:
6 / 68

Status:
Malware

Analysis date:
12/25/2024 4:16:33 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.11958467
799

Avira AntiVirus
TR/Rogue.11958467
7.11.186.214

F-Secure
Trojan.Generic.11958467
11.2014-27-11_5

McAfee
Artemis!87C9442D06DC
5600.6933

MicroWorld eScan
Trojan.Generic.11958467
15.0.0.993

Trend Micro House Call
Suspicious_GEN.F47V047
7.2.331

File size:
15.5 MB (16,266,215 bytes)

Product version:
14.9.29.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:lBrPREx5JZWFVA0eH5HLN8KhCbokrJgvvT9FxH5qKWRjH:lJPix5MVAnZ2KocauzLxZrEH

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9998

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 39 URLs.

http://ttb.lpmxp2158.com/download/request/.../xb9onqTr?__tc=1410281927.246&lpsl=936f12553c357c940af76c80eeda40af&expire=1410368326&tgu_src_lp_domain=www.updatedlw.com&ClickID=31537618651410281924&PubID=151651&fileName=Setup

http://download1401.mediafire.com/8vnhs13ahxkg/.../setup.exe

http://download1372.mediafire.com/3asqmkkcu8bg/.../setup.exe

http://download1118.mediafire.com/wbn05pdatbrg/2rcw4ll24ylqtp0/Black Ops 2 - GSC Studio/.../14.9.29.0-14.9.29.0-setup.exe

http://download1131.mediafire.com/l79xxgp2xmdg/.../setup.exe

http://download1372.mediafire.com/3e53q7sis6fg/.../setup.exe

http://download1516.mediafire.com/35zm3ns2luhg/.../setup.exe

http://download1516.mediafire.com/f51n5r4u41ug/.../setup.exe

http://download1401.mediafire.com/aurna8af4udg/.../setup.exe

http://download677.mediafire.com/fpncyenvagtg/.../setup.exe

http://download796.mediafire.com/9i9finfn9gbg/.../setup.exe

http://download1143.mediafire.com/2z99x3g1zolg/.../setup.exe

http://www.mediafire.com/download/.../setup.exe

http://www.mediafire.com/?2rcw4ll24ylqtp0

http://www.mediafire.com/download/.../setup.exe

http://download881.mediafire.com/h9f2lhfk5zog/.../setup.exe

http://download796.mediafire.com/5j5r36r8pcug/.../setup.exe

http://iaarghrlo3.now-download-quicksoft.com/d/click/.../?uid=81e055d8-50c2-45c2-95bb-243943edaa7e&sid=sid&filename=Setup

http://download677.mediafire.com/knhs1p60mksg/.../setup.exe

http://download959.mediafire.com/rcn8v42zvzhg/.../setup.exe

http://download881.mediafire.com/6we58dgrrbhg/.../setup.exe

http://download959.mediafire.com/5a10x57z82dg/.../setup.exe

http://download1414.mediafire.com/n86hcw3polwg/.../setup.exe

http://download914.mediafire.com/9bqzux7eqbwg/.../setup.exe

http://download677.mediafire.com/mepw395a71hg/.../setup.exe

http://download677.mediafire.com/apu5ohzsuczg/.../setup.exe

http://download1131.mediafire.com/50vol315tpkg/.../setup.exe

http://download1772.mediafire.com/ul2pttwfpl5g/.../setup.exe

http://download1440.mediafire.com/i8xq2h3ss3jg/.../setup (1).exe

http://download1459.mediafire.com/o2wz8mmpjzig/.../setup.exe

Latest 30 of 39 download URLs

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.