home

Setup.exe

Internet Generic

OOO KOD 7

The file Setup.exe, “Internet Generic Setup ” by OOO KOD 7 has been detected as a potentially unwanted program by 7 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. This downloadble file is typically blocked through Google's Safe Browsing technology in Chrome web browser.
Publisher:
Generic Application Software   (signed by OOO KOD 7)

Product:
Internet Generic

Description:
Internet Generic Setup

MD5:
23125ced7250b39bbaef1397a17a4a4d

SHA-1:
48baa8f5ec1a021897d18e12a297399e2abee89d

SHA-256:
4afddbbbf33f817b0a8a70b0f2073062d0f884fd21475fe2b57ef6d7d605b4be

Scanner detections:
7 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 8:20:17 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Malware-gen
150602-1

AVG
Generic
2016.0.3085

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.InstallCore.703
9.0.1.05190

ESET NOD32
Win32/InstallCore.ZC potentially unwanted application
7.0.302.0

K7 AntiVirus
Adware
13.204.16151

VIPRE Antivirus
Threat.4150696
40830

File size:
778.5 KB (797,160 bytes)

Product version:
3.6.5

Copyright:
Software

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
OOO KOD 7

Authority:
COMODO CA Limited

Valid from:
5/5/2015 1:00:00 AM

Valid to:
5/5/2016 12:59:59 AM

Subject:
CN=OOO KOD 7, O=OOO KOD 7, STREET="per. Kotelnicheski 1-i, d. 3 korp. 1", L=Moscow, S=Moscow, PostalCode=109240, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BB90A9DE0F064653F7820A54F3EF737F

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:eLXpd1jlmdbIKqf+BvLpUCdTK0o5rFGC1xXRM55s7PcY5+Qj0UXKjPq8MGAaJNfn:eLXt3f+xLpUefo5rsISKzTIUXTwhN

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8091

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.