home

setup.exe

Logic Procedure

This is published and distributed via an Adknowledge's advertising supported (adware) software installer. The application setup.exe, “Fusion Install ” by Logic Procedure has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from aback-structurec37c4d.com.
Publisher:
Fusion Install   (signed by Logic Procedure)

Product:
Fusion Install

Description:
Fusion Install

Version:
2.4.8.1

MD5:
b9a6151f97385cc2bf0b78b68eb82780

SHA-1:
61030f6f079d87304d9522f016d87c2c0b915af1

SHA-256:
0cbae253503c0ccfc328a067f7209ae1d31c09fb1d1b0a964f1ee8c50c3a6de2

Scanner detections:
31 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/14/2024 8:43:55 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Application.Bundler.Graftor.171872
363

Agnitum Outpost
Trojan.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.IBryte
2015.01.21

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.202.118

avast!
Win32:IBryte-KT [PUP]
2014.9-160207

AVG
Adware AdPlugin
2017.0.2841

Bitdefender
Gen:Variant.Graftor.171872
1.0.20.190

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Adware.Ibryte-7644
0.98/19967

Comodo Security
Application.Win32.Ibryte.KS
20760

Dr.Web
Trojan.iBryte.498
9.0.1.038

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.Graftor.171872
8.16.02.07.05

ESET NOD32
Win32/Adware.iBryte.BX application
10.7.0.302.0

F-Prot
W32/S-71f4b1de
v6.4.7.1.166

F-Secure
Riskware.Gen:Variant.Application.Bundler
11.2016-07-02_1

G Data
Gen:Variant.Graftor.171872
16.2.24

IKARUS anti.virus
AdWare.AdPlugin
t3scan.1.8.6.0

K7 AntiVirus
Unwanted-Program
13.191.14674

Kaspersky
not-a-virus:AdWare.Win32.iBryte
14.0.0.699

Malwarebytes
PUP.Optional.Fusion.A
v2016.02.07.05

MicroWorld eScan
Gen:Variant.Application.Bundler.Graftor.171872
17.0.0.114

NANO AntiVirus
Riskware.Win32.IBryte.dmjpto
0.30.0.64448

Norman
IBryte.URL
11.20160207

Panda Antivirus
Generic Suspicious
16.02.07.05

Quick Heal
Adware.iBryte.S4
2.16.14.00

Reason Heuristics
PUP.Adknowledge.LogicProcedure.Installer (M)
16.2.7.5

Rising Antivirus
PE:Malware.iBryte!6.1A10
23.00.65.16205

Sophos
PUA 'iBryte Optimum Installer'
5.10

Vba32 AntiVirus
suspected of Trojan.Downloader.gen.h
3.12.26.3

VIPRE Antivirus
Threat.4778314
38552

Zillya! Antivirus
Adware.iBryte.Win32.6441
2.0.0.2041

File size:
560.9 KB (574,336 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) 2013 Fusion Install

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Logic Procedure

Authority:
COMODO CA Limited

Valid from:
3/23/2014 8:00:00 PM

Valid to:
3/24/2015 7:59:59 PM

Subject:
CN=Logic Procedure, O=Logic Procedure, STREET="4600 Madison Ave, 10th FL", L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
39A92273D8E58C01737CDD1083C77435

File PE Metadata
Compilation timestamp:
1/24/2015 9:00:28 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:ymKxFEAidD2Bfi0KIhNRbBEI5d2SUjED7aOCoCnkARHQ:ymKnEZt2BfDnRbBEI5d2RjQaOC1HHQ

Entry address:
0x25211

Entry point:
E8, 9E, AD, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 64, 94, 44, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 78, 90, 44, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63...
 
[+]

Entropy:
5.7583

Code size:
286 KB (292,864 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://aback-structurec37c4d.com/track/install?gluid=gyaEYiQh4MIGp2G7RjjTs4RxsKsYgBkVQNHuKI5mVKI0uQjm8cOlE9nj6fYv2d U86G1AyFw9QrISg xuZPRQGs12qrOQxpn2TE7TAcqVOg70Vg1BA0c 7ehGasqTRam3 0GSe5k4ga12HzdmrDEB0Krdz6bxTbzz0yO34zA/0uDWtdw14PO WwCLWVekHlQNF7y2teSeCydfHuKe7/u2ZEcrEsChM46Mv6yWoW5fmgSwPUv3ekkEdPprZgGbZbQiV8c1s CaJQZP8ZisD5cibqlJ6D5nRDI5O/aT iU56HFzhzU giUAHL3CmLOeqHUYne5pqhB5Kw 2SJsB/hNbKTWodxsq8zJoWRCeZy46WKJGLXjHUImavInKDb5JryUvX1CwnXnyluGQUROlSv89LZ4oMSgrFVmPS fX9P1DT9sGVbnThDqEGGQEUC4fiZQSXXO9uD95MWKslHqTtrPZk9VfxSPuw4CqyxpSTxBvbRchv8zgMxA9e6R42ZcRuyFrXXIxWMzy28MqCBboao90PGbNDNfLuQL5KgxGJP drRLM0S9H5HHqJYviJSQdGxHh9RiuZGpxnrARpxUXY4FxeKm7IXzQDfj/QQlSasyMsz45pBb51B8D5u0dG0gR0 MLOTjk5 f19NWLxtcGVMzC9hEjOlfZdA8XEkPisaWuIsUY4l0SR44gcbwW8reC3JK&_sd=1&alc=1&dl=1&dlink=http://download-download32.com/o/.../Setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.