home

setup.exe

Installer Prog

AVSoftware Ltd

The application setup.exe, “Installer Prog Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.packagevaulttoday.com and multiple other hosts.
Publisher:
AVSoftware Ltd  (signed and verified)

Product:
Installer Prog

Description:
Installer Prog Setup

MD5:
8fe4f07d855649e8959b3a4375cd76fb

SHA-1:
5c8de78ede28e2fecfa57b1a98c267223da1ea84

SHA-256:
2ea9bf671a0cd9f00b57124c3ad8ae01891f87b2771fb5fd7d162bd53400d8c9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 2:55:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftware.Installer (M)
16.1.14.1

File size:
947.6 KB (970,320 bytes)

Product version:
2.8

Copyright:
Soft Lite

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:55:52 PM

Valid to:
12/31/2016 12:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:hQnNBOPjmCNCYM/79hgOV2MmlbVotwDrDetexrsZZLhc7kfUA4sXqihsn:hcLOPao+DP2MmXom5CX+jAj0

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file setup.exe has been seen being distributed by the following 21 URLs.

http://www.packagevaulttoday.com/c?x=a6Ze71AQSmyxEWcO44R2XNtnpUqctOV7yPOVAzpDK7o=&c=OfBfXT0aG2f0YTwN2fgHYo3sdxnvFot3Wd38NkV7 2ufIWtBBouE8s6j5bRE 1EuoUk8crMKIGce03vg9HTdZ okG//iZUxzaUsovnks8u53hxTC9XO6Lt52lyBJmiM&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.softwareappdownloads.com/c?x=ez7sLuXsBtobD2FapKiN9Kr/NaP1HwBlHWEF8xGKj0M=&c=/QwHJdxJ/eaTwXoc8zr6VM1WSEW8pXv2oqU/tagHyBYD2MT3fcythJlOaFfVy3nKk3lVeJlq2 Q40mHxC9kc9RB1UAVx Il1niiIofESP/030qQeFGlNJr3V0apPpj/H&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.deliverygiftchuckle.com/c?x=jmTe1aY24h3ER6Y 2kSzeFsj6BjWtPQ pK8P/JKv1Y0=&c=GBtpxSADP77LlHGmndR5Aqs0ex0WVvO2WHsIMhC7c7csw09igVPdtfsLMT4wVn/2/PLltDt N4s/3fniGnHnBQR8XUqJTZ9kKiBSTlKJDA88 wHxdQmw0fJMvOKqJm83&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.softwareappdownloads.com/c?x=HlsAudXARcZvzhKqTlYO/1a6xGLr8LUG2ioxfgKre/g=&c=zvNY9wAKyrmW/b cke8qdAefJLpQkT2THjPoWxjbRcOhI3kQ7bGGaCUTvpPi/IFG5uc5WfqP/AO3Xc6MFTMubtBerEft9o 80mjNTuo5xphyT9wbc95YqDVQZTuIn2o2&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bodymetahosting.com/c?x=FIaLelRITwmT9LdN9sYHox6TlSraKogKckfKfCpepDI=&c=ruFtveXXVtmKyPcZupy3aAYw3toDOilLx0j63a6irXN1wvg/pOZh EFrmAuntWXWZ SCyTGKI5R1SZJhEJoxHExeVBioYPuywXHNr8RnFLwF1N3GG14XAVZHAyzbMb57&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bulkpresentbits.com/c?x=tuzn2QgIPWlaEXLk3xHrKFLXxjMzJOBTbGPR0PNDv8c=&c=/ALrKlWaKj6sF0XqsPpeMdVQdAnbL13olwnWk6hbqMtPSVZRwWIBZownNYR AqD3PJbt 440uLhXABxgquppqnFl8DDS8x1vIIbY1nd1YxgXzh TzpSgRMbRB28EaZ2p&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.softwareappdownloads.com/c?x=2rnM65kVvJHhQFJ91B7J3lPu2ePuUsmItTHixdNhDiQ=&c=VGk1IJJlkhii4pOyu09TXZ0soRTLpw T7gACSITRWf9QDGlcMA5RyOBR1qngOXhf3NReqzdRfUPy25Spq/oacZKcJAYC39RqKKrlyCflFy5EsfiHoAHOSogZow380Ep6&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todaycurrentsigns.com/c?x=IeT9rI1ocShcXo34TO8pB8BT4pC3K0T0b0VICXqJ7Jc=&c=XlP5S2v6d0LU5jRNNnb5TQUmgFr6s45/UIAtnQ7uq1MFhSXIhBm37FawivYu6NnVqQVQfTcO0T/0qJtThKnTJeq5mTrAhyziKTXG9DwWggsmcwHdbOb/wcU7lKcZ6L6G&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.softwareappdownloads.com/c?x=lk2ZJ1Ir1XImcULXL4yzeFjh42AweCPlYBmMULiWdGI=&c=zSN7u/GSTxeF8qc9P3ezQpXSMZsN7BJ5fcfODHGbHbuqYdZP b 0fhPrxGmYRrRTykhismcP8q0b7T9abpt9OIbRmPDPwFdtq0vGjaL8W6I1DhlFln2EjdI6tsF32QB &downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todaycurrentsigns.com/c?x=3Q4yq9Xp/K6D AzK2/kQYmgQ6e6qaw hXFhgsgPJvJU=&c=5i3aXem9RpztGxv2o1z419NrJiX3Ft/JmcjGf25TqGzfs03yOFypABfgtHRZL 42m9do4f80JxYbE LOaGqh3puKFmJLS9g9TxxjfU/JgbqtMBspAdRv9eYkeBuUM1SC&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.softwareappdownloads.com/c?x=sqnGQAB2pqyxoKAbUJovXvybfSit2nAomSMGExM6UCE=&c=uoJC3iHRKKoQ7rhlk72FPONZaCASBSTG/rLLcRL nfgPtNUvL5VrARFv80i65Ol5lAXmlIwDm2hK7gTz2Ij3pe/0jAVAGffS2snM806gGD92ti6sNo9NTrUkWKrZF2SZ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bodymetahosting.com/c?x=4/AheUFRbxM5flWjAOY gq /kSQ8vo6DEywQw8bClEY=&c=5rgyzY/ZRep2S58lQb1mVDXDNh3cn2b2wILnc4VF4zI87dSFON12BDepQStSzamT/qpDaG2KbuUTWZUl/YOmOSU/GNHI6RZWofcCdlYdpMr7EAgRfJ/KffesgZtWuAYY&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todaycurrentsigns.com/c?x=rAr/Glw4fRfP3zpUp34j CqV4CVjRc U 89edfCz2I=&c=Jux8ic7qlNi1fA3 m347eWy/MAXJ7FmEzqiu0r7Ev89PnSinOrKRPr2 rDS0R0swDY Vc0x4mN367dMxfVYgk5Ms2QzA5ir F/J86 RfmjNbKZ8FqY5q/nQTjwPDosM&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bundlechucklepresent.com/c?x=gUY FYZBBRXrRfuIATRe ouwc0e7pOF7smZrwQSndqM=&c=39fsmVBli6VhFNCuRdcQ87hM9JtT84lR3tinFojEXLBzCVoKTFB59b2pRaKLYsbUz7dHnhF8SG4cu4roJYlz6dSx2MQhCGuUVPClBb2fKAMtSCkYw2NoKSFLKbICMNEb&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bulkpresentbits.com/c?x=Rb9dampuJgnN0ECxG4fzvWgzGgLLkUSzdNuU922Z35g=&c=5LroI8XySzt3dSCCORW26wLLQLu4UhCr3sWXmhT9PIJpE MfoJqXUENa13fsGJ urDi1P VvsvuD4jn Wxu/dJRdJxjrkBKwMtvJP7B1rcyYKSwzeViO5Cd9kY2xTMTs&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.stockfundownloads.com/c?x=G4Va2DilY9GnX r1aQ7leELTVOg5Pey WBuHVF4Ulec=&c=wDy /V0hnBIzd4vWcjtERKaTlUFDbzkb ltB5zY59HMAFAVQJQWMezllAqajUC5H3disVzz5pli45m8nqQDylIn4HvW5y8Nly2jZ8wPx8VdiXPubnT1 MT6XtQQgTGwx&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.worldcityworld.com/c?x=105PmA0AJcRqDRqePRyuycRRAsmUvCGe5eyE//x7x1s=&c=9op40MJha7qUlyQd5sR4ufGA2o78tKBIZ/y2IXe/66bE8hnnY7tHjjbxLV8cu4ppuHZzkpl8fbbNXhM/aNq4UidFFrGqOQ7Fwb0HIIgLtfSGCpfw88ZEyN8jHEpGyPW0&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todaycurrentsigns.com/c?x=Z6G4Eq2itBH7L0kMUKwFfKYcwymOfgUhsaR4QWhCP c=&c=PGgEGWIXu1T477zqmT5QHbVEThIXAFhe0b2WUjYXRmfkpJ/0O2vpkwAuQHxrAAUBJvOKRx5Tz9 8oZULIMphJwzqDZZv8uteVeC X62K5jd5xHA4xCGDJ6Ibprs0CkHq&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bulkpresentbits.com/c?x=3AXZ4AjeOF4SEQ9ZLm2ardgpkmgskpDa7IPc2sOJouU=&c=TUdKODQYWBiEDXYvz9jmeFYaB eg7lVWN2H/omTFrYkQ503CLig5aGvVLumR8p6qdNepayat3zhpVaJe CgB5c3XiWgYfZFohN/mpJOpMhnkbVCRehx6bsLSifmQpXcJ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.signcapitalgift.com/c?x=okxXQsDc4wsa15K4AH9f90V3Aw5wAn0GAW0NXn291F4=&c=WDa2us54Q0IwtYxFBKKUDqvwo81HhYisT0szq8aI1UmK03TnMbDuCkRL3jx 1cdxI8zkz3v2lCuaqSRpQl3z7CjBIXGSuyQF5xLt 9SwC9x42rC9CPFO Qxj4Zdsxya &downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.signcapitalgift.com/c?x=QMlQPlgRrZkW0kdj3iruS3Bgm0VJ0mz/l4KEi8XRoDA=&c=TcN xa03EXotrtk3cxDvOS7kCk1A 5VYxSFGZ6BGAdEKPSpdX4a2Vy/SpFC43aJu9PZ7l LPg8hBgc1fH2dCrwCPPggVS6vHg3zHvqC1YHsdG/e 8ZTm/5O5mmx/g2iG&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.