» setup.exe
Overview
Analysis
File Details
Downloads (12)

setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from getfplayer.com and multiple other hosts.

File name:

setup.exe

MD5:

b1052b20eb8ce5cd79eceb49b6cf17d7

SHA-1:

4fa31be1a030e2649dc9087dc93ffe71542ff6ae

SHA-256:

4fbc0e91d3bf465aee12d9e54851fc9b37089131ad99ee07b0d2bad9012ab33f

Scanner detections:

4 / 68

Status:

Inconclusive (not enough data for an accurate detection)

Analysis date:

12/29/2024 12:22:54 AM UTC (today)

Scan engine

Detection

Engine version

Qihoo 360 Security

HEUR/Malware.QVM06.Gen

1.0.0.1015

SUPERAntiSpyware

Trojan.Agent/Gen-Clicker

10444

Trend Micro House Call

Suspicious_GEN.F47V0708

7.2.215

VIPRE Antivirus

Trojan.Win32.Generic

31718

File size:

53.1 KB (54,337 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\setup.exe

File PE Metadata

Compilation timestamp:

12/5/2009 2:50:52 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

1536:apgpHzb9dZVX9fHMvG0D3XJ8M6aek0XR/NauWrAiIl:YgXdZt9P6D3XJ8Mp0XdcuWI

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.1885

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file setup.exe has been seen being distributed by the following 12 URLs.

http://getfplayer.com/get.php?c=&id=2&exv=tstl02

http://getfplayer.com/get.php?c=ZnJvbT1nYXlodW1tZXIuY29tO2xmcm9tPWdheWh1bW1lci5jb207aWRjaGVjaz0xNDEwMTU5NTY1O3ZzPWdheWh1bW1lci5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgwPTE0MTAxNTk1ODE2MTU7SHN0Q2xhMjAzODg4MD0xNDEwMTU5NTgxNjE1O0hzdENtdTIwMzg4ODA9MTQxMDE1OTU4MTYxNTtIc3RQbjIwMzg4ODA9MTtIc3RQdDIwMzg4ODA9MTtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO2NfcmVmXzIwMzg4ODA9aHR0cDovL3d3dy5nYXlodW1tZXIuY29tLztIc3RDZmEyNTk4OTM4PTE0MTAxNTk2MDQ1NDA7SHN0Q211MjU5ODkzOD0xNDEwMTU5NjA0NTQwO3RvPXx1cmx8dXJsO2xhc3RfdXJsPWNvbnRlbnQ7SHN0Q2xhMjU5ODkzOD0xNDEwMTU5NjMzNzM5O0hzdFBuMjU5ODkzOD0yO0hzdFB0MjU5ODkzOD0yO0hzdENudjI1OTg5Mzg9MTtIc3RDbnMyNTk4OTM4PTE7cm90X2luPTE7&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1rOWJlYXN0LmNvbTtsZnJvbT1rOWJlYXN0LmNvbTtpZGNoZWNrPTE0MDgxMTYxNzM7dnM9azliZWFzdC5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgzPTE0MDgxMTYxODAwMDU7SHN0Q211MjAzODg4Mz0xNDA4MTE2MTgwMDA1O2NfcmVmXzIwMzg4ODM9aHR0cDovL3d3dy5rOWJlYXN0LmNvbS87bGFzdF91cmw9Y29udGVudDtIc3RDbGEyMDM4ODgzPTE0MDgxMTYyMTg0MTU7SHN0UG4yMDM4ODgzPTM7SHN0UHQyMDM4ODgzPTM7SHN0Q252MjAzODg4Mz0xO0hzdENuczIwMzg4ODM9MTtyb3RfaW49MTs=&id=2&exv=

http://cdn.download-free-videos.com/.../setup.exe

http://getfplayer.com/get.php?c=ZnJvbT1zZXh5Z3Jhbm55dHViZS5jb207bGZyb209c2V4eWdyYW5ueXR1YmUuY29tO2lkY2hlY2s9MTQwNjA0ODQ4OTt2cz1zZXh5Z3Jhbm55dHViZS5jb218O0hzdENmYTIwMzg4Nzk9MTQwNjA0ODQ5MjM0NDtIc3RDbGEyMDM4ODc5PTE0MDYwNDg0OTIzNDQ7SHN0Q211MjAzODg3OT0xNDA2MDQ4NDkyMzQ0O0hzdFBuMjAzODg3OT0xO0hzdFB0MjAzODg3OT0xO0hzdENudjIwMzg4Nzk9MTtIc3RDbnMyMDM4ODc5PTE7Y19yZWZfMjAzODg3OT1odHRwOi8vd3d3LnNleHlncmFubnl0dWJlLmNvbS87dG89fHVybDtsYXN0X3VybD1jb250ZW50O0hzdENmYTI1OTg5Mzg9MTQwNjA0ODUwMTEzNztIc3RDbGEyNTk4OTM4PTE0MDYwNDg1MDExMzc7SHN0Q211MjU5ODkzOD0xNDA2MDQ4NTAxMTM3O0hzdFBuMjU5ODkzOD0xO0hzdFB0MjU5ODkzOD0xO0hzdENudjI1OTg5Mzg9MTtIc3RDbnMyNTk4OTM4PTE7cm90X2luPTE7UEhQU0VTU0lEPTI3MTlkNWJhODI2MWQ1MDQ1YWVlN2YyOGFjNzgzN2NlO2luZGV4X3BhZ2U9MTs=&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT14bGJvb3R5LmNvbTtsZnJvbT14bGJvb3R5LmNvbTtpZGNoZWNrPTE0MDk2MTYyNDM7dnM9eGxib290eS5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgwPTE0MDk2MTYyNDQzODQ7SHN0Q211MjAzODg4MD0xNDA5NjE2MjQ0Mzg0O2NfcmVmXzIwMzg4ODA9aHR0cDovL3d3dy54bGJvb3R5LmNvbS87SHN0Q2xhMjAzODg4MD0xNDA5NjE2MzUzNzQyO0hzdFBuMjAzODg4MD0yO0hzdFB0MjAzODg4MD0yO0hzdENudjIwMzg4ODA9MTtIc3RDbnMyMDM4ODgwPTE7dG89fHVybHx1cmw7bGFzdF91cmw9Y29udGVudDtIc3RDZmEyNTk4OTM4PTE0MDk2MTY1NDIzMzY7SHN0Q2xhMjU5ODkzOD0xNDA5NjE2NTQyMzM2O0hzdENtdTI1OTg5Mzg9MTQwOTYxNjU0MjMzNjtIc3RQbjI1OTg5Mzg9MTtIc3RQdDI1OTg5Mzg9MTtIc3RDbnYyNTk4OTM4PTE7SHN0Q25zMjU5ODkzOD0xO1BIUFNFU1NJRD1lODZjODgzYjE3MzUzOTg5YmUxOWVhNTE0YjJmNmQzYztyb3RfaW49MTs=&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT11ZGFybm9wb3Juby5jb207bGZyb209dWRhcm5vcG9ybm8uY29tO2lkY2hlY2s9MTQwNTYzOTY2ODt2cz11ZGFybm9wb3Juby5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODc5PTE0MDU2Mzk3MzcwMjM7SHN0Q211MjAzODg3OT0xNDA1NjM5NzM3MDIzO2NfcmVmXzIwMzg4Nzk9aHR0cDovL3VkYXJub3Bvcm5vLmNvbS9jYXRlZ29yeS8lRDAlOTAlRDAlQkQlRDAlQjAlRDAlQkIlRDElOEMlRDAlQkQlRDElOEIlRDAlQjklMjAlRDElODElRDAlQjUlRDAlQkElRDElODEvO2xhc3RfdXJsPWNvbnRlbnQ7SHN0Q2xhMjAzODg3OT0xNDA1NjM5ODE3NDEwO0hzdFBuMjAzODg3OT0zO0hzdFB0MjAzODg3OT0zO0hzdENudjIwMzg4Nzk9MTtIc3RDbnMyMDM4ODc5PTE7cm90X2luPTE7&id=2&exv=

https://doc-0k-0c-docs.googleusercontent.com/docs/securesc/obifdib921e3k5di47tr1281989fp95p/n2vuian71o7vds7gosj6fov8rqnri5bu/1407643200000/05632626595336169849/.../0B23bGgUfC5hpZkhydE1fdjZHTEU?e=download&h=16653014193614665626&nonce=apn14alft1v7a&user=11415079858588922038&hash=klr44gto262mgcjlgrv2n4mnmrts6pmv

https://docs.google.com/nonceSigner?nonce=apn14alft1v7a&continue=https://doc-0k-0c-docs.googleusercontent.com/docs/securesc/obifdib921e3k5di47tr1281989fp95p/n2vuian71o7vds7gosj6fov8rqnri5bu/1407643200000/05632626595336169849/.../0B23bGgUfC5hpZkhydE1fdjZHTEU?e=download&h=16653014193614665626&hash=q9toh3a39mr43qvvv1m6k1vu9gkcc1l2

https://docs.google.com/uc?export=download&confirm=no_antivirus&id=0B23bGgUfC5hpZkhydE1fdjZHTEU

http://getfplayer.com/get.php?c=ZnJvbT16b29tZWdhc2l0ZS5jb207bGZyb209em9vbWVnYXNpdGUuY29tO2lkY2hlY2s9MTQwNzY0OTA1OTt2cz16b29tZWdhc2l0ZS5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgwPTE0MDc2NDkwNjExNTE7SHN0Q211MjAzODg4MD0xNDA3NjQ5MDYxMTUxO2NfcmVmXzIwMzg4ODA9aHR0cDovL3pvb21lZ2FzaXRlLmNvbS87dG89fHVybDtsYXN0X3VybD1jb250ZW50O19fdXRtYT0xODAxNzM5ODUuMTIwMzk4NjUxNy4xNDA3NjQ5MDYxLjE0MDc2NDkwNjEuMTQwNzY0OTA2MS4xO19fdXRtYj0xODAxNzM5ODUuMi4xMC4xNDA3NjQ5MDYxO19fdXRtYz0xODAxNzM5ODU7X191dG16PTE4MDE3Mzk4NS4xNDA3NjQ5MDYxLjEuMS51dG1jc3I9em9vbWVnYXNpdGUuY29tfHV0bWNjbj0ocmVmZXJyYWwpfHV0bWNtZD1yZWZlcnJhbHx1dG1jY3Q9LztIc3RDbGEyMDM4ODgwPTE0MDc2NDkwNzc2MzY7SHN0UG4yMDM4ODgwPTI7SHN0UHQyMDM4ODgwPTI7SHN0Q252MjAzODg4MD0xO0hzdENuczIwMzg4ODA9MTtyb3RfaW49MTs=&id=2&exv=

Scan setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.