» setup.exe
Overview
Analysis
File Details
Downloads (1)

setup.exe

1.9.2.0

AVSoftware EOOD

The software installer uses the StartInstall.com download manager which bundles additional adware offers (toolbars and utilities such as the SafeSearch toolbar) during setup. The application setup.exe, “MapsEasy Setup ” by AVSoftware EOOD has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software.

File name:

setup.exe

Publisher:

AVSoftware Ltd (signed by AVSoftware EOOD)

Product:

1.9.2.0

Description:

MapsEasy Setup

Version:

1.9.2.0

MD5:

69564d208f91c3cdb3e1174a0f912b1a

SHA-1:

59d6e8014a9ce827af14513fb9e25da05634e4b1

SHA-256:

29a3f045d13408164d2e52c7a57d5bd20b81b3151268c347cf9a377b3709ed62

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

12/23/2024 10:18:57 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.AVSoftware EOOD.AVSoftwareEOOD.Installer (M)

15.12.31.19

File size:

2.8 MB (2,906,808 bytes)

Product version:

1.9.2.0

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\setup.exe

Digital Signature

Signed by:

AVSoftware EOOD

Authority:

Symantec Corporation

Valid from:

12/30/2015 7:00:00 PM

Valid to:

6/3/2016 7:59:59 PM

Subject:

CN=AVSoftware EOOD, O=AVSoftware EOOD, L=Sofia, S=Sofia, C=BG

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

57ABCD2BCF9FD1CFD5A1BABF2579820E

File PE Metadata

Compilation timestamp:

7/16/2015 9:24:20 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:iJoRhZ3xQIfhj0SnOErTBnUYHNFRzqhwLrihe9TtUzazQ21TFumCNs/bBbEOVT30:JH5j0SnOEJvHZzqhS9TSmzQ21TFujNsm

Entry address:

0x113BC

Entry point:

55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 34, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 1E, D8, FF, FF, E8, 6D, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 33, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 54, 86... 
[+]

Entropy:

7.9832

Developed / compiled with:

Microsoft Visual C++

Code size:

63.5 KB (65,024 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://www.mapseasy.net/.../setup.exe

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.