setup.exe

My Online Media Ltd.

This is the Bundlore download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe by My Online Media has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the Bundlore Downloader installer. The file has been seen being downloaded from www.deltacad.com.
Publisher:
My Online Media Ltd.  (signed and verified)

MD5:
ef84b400e9846b1506aaf78c9ae5d0d5

SHA-1:
5ed06d9f2f024f85463f8bd88ca26ebe4f7f6df5

SHA-256:
3b724dd693e36e8f79a2db0b2cca9156b976e7a53a20542a9df6e8798b2331fb

Scanner detections:
15 / 68

Status:
Adware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/25/2024 12:40:05 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Downloader
7.1.1

Avira AntiVirus
TR/Bundlore.261112
7.11.211.46

avast!
Win32:Rootkit-gen [Rtk]
2014.9-150218

AVG
Generic
2016.0.3184

Comodo Security
Application.Win32.Bundlore.D
21229

Dr.Web
Adware.Downware.9625
9.0.1.060

ESET NOD32
Win32/Bundlore.R potentially unwanted (variant)
9.11197

IKARUS anti.virus
PUA.Bundlore
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.1915108

Kaspersky
not-a-virus:Downloader.Win32.Bundl
14.0.0.2415

Malwarebytes
PUP.Optional.Bundlore
v2015.03.01.12

Reason Heuristics
PUP.Installer.Bundlore
15.3.1.12

Vba32 AntiVirus
Downloader.Bundl
3.12.26.3

VIPRE Antivirus
Threat.4150696
37788

Zillya! Antivirus
Downloader.Bundl.Win32.14
2.0.0.2083

File size:
255 KB (261,112 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bundlore Downloader

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
10/4/2014 5:00:00 PM

Valid to:
10/5/2015 4:59:59 PM

Subject:
CN=My Online Media Ltd., O=My Online Media Ltd., STREET=21 Ahad Ha'Am St., L=Tel Aviv, S=Israel, PostalCode=6515103, C=IL

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
009EF11EA9CC37B8E963315B6B2A81E301

File PE Metadata
Compilation timestamp:
2/14/2015 8:37:33 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
6144:vk/kPicTTWjeZ4M9z0Iog9+u2rgVrPdbWyPoWiy:vksPicXWjCbrHx2rgVrAyPJ

Entry address:
0x32AA

Entry point:
E8, 9D, 47, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 48, AD, 41, 00, E8, 00, 2D, 00, 00, E8, 6E, 49, 00, 00, 0F, B7, F0, 6A, 02, E8, 30, 47, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, EF, 3E, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.9015

Code size:
77.5 KB (79,360 bytes)

The file setup.exe has been seen being distributed by the following URL.

Remove setup.exe - Powered by Reason Core Security