home

setup.exe

MediaDrug

The application setup.exe, “MediaDrug Setup Program” has been detected as a potentially unwanted program by 8 anti-malware scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from setup.testtraff.ru and multiple other hosts.
Publisher:
MediaDrug

Product:
MediaDrug

Description:
MediaDrug Setup Program

Version:
1.0

MD5:
6c2efcb33ea217a53c14099e318bb4ae

SHA-1:
645427a4b382862484291246ec072f9ce77c7f3a

SHA-256:
91a80a01a546d4da9c948f285a72503b11387b643c377238928adb75287474cf

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
11/5/2024 8:26:19 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/OpenCandy.sger
7.11.201.154

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.15116

ESET NOD32
Win32/OpenCandy (variant)
9.11024

K7 AntiVirus
Trojan
13.191.14664

McAfee
Artemis!6C2EFCB33EA2
5600.6884

Qihoo 360 Security
HEUR/QVM41.1.Malware.Gen
1.0.0.1015

Sophos
Generic PUA GE
4.98

Trend Micro House Call
Suspicious_GEN.F47V0113
7.2.16

File size:
1.1 MB (1,156,096 bytes)

Product version:
1.0

Copyright:
Copyright © MediaDrug

Original file name:
MediaDrugSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
12/16/2014 7:26:02 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:B/xB2AUVbWNLHp0kT1ThvgMK0v7HoGm8OqbLRpSB+:BAKNLJNRThvgvCcGQqV

Entry address:
0x5B174

Entry point:
E8, 75, AB, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, C4, 00, 00, 00, A1, B0, A2, 49, 00, 33, C5, 89, 45, FC, 56, 8B, 75, 08, 57, 33, FF, 89, BD, 4C, FF, FF, FF, 3B, F7, 75, 1E, E8, AE, 2B, 00, 00, 6A, 16, 5E, 57, 57, 57, 57, 57, 89, 30, E8, DC, F5, FF, FF, 83, C4, 14, 8B, C6, E9, 24, 01, 00, 00, E8, E6, 6D, 00, 00, 8D, 85, 4C, FF, FF, FF, 50, E8, DD, 6E, 00, 00, 59, 85, C0, 74, 0D, 57, 57, 57, 57, 57, E8, 8A, F4, FF, FF, 83, C4, 14, 8B, 85, 4C, FF, FF, FF, 53, 6A, 3C, 99, 59, F7, F9, 66, 89...
 
[+]

Code size:
497 KB (508,928 bytes)

The file setup.exe has been seen being distributed by the following 35 URLs.

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Enrique Iglesias Feat. Sean Paul

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Ibo - Schwarze Rose

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Donavon Frankenreiter - Hold On

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Bethel Live - This Is Amazing Grace

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=I Know Places - Taylor Swift Cover

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Awesome Hindi Worship Song - Yeshu Tera Naam With Lyrics (Jesus Your Name)

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Terlalu Lama Sendiri - Kunto Aji (Cover)

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Toto - Africa

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Very Sad Piano Music Original - By Roy Todd

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Hey Bajrangbali Hanuman [Full Song] Hari Om Sharan - Shree Hanuman Chalisa

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Muse - Butterflies And Hurricane

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Westlife - If

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Dj Tiesto And Hardwell - Zero 76

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Jay Sean - Back To Love

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=El Berna Jam - Ya Llego

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Jason Derulo Feat. Snoop Dogg - Wigl

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Lionel Richie Diana Ross

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Phil Collins - Can't Stop Loving You

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Dream Theater - Romantic Piano Music

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Gaby - Begitu Indah

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Pharrell Williams - Happy

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=I Just Wanna Feel This Moment ( Dj Sequence Remix Cut)

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Dj Hamida Ft Kayna Samet, L'artiste - Déconnectés

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Reda Taliani - Va Bene Ya Khouti

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Chandelier

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Leningrad I Yulia Kogan - Lyubov Eto Pizdec

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=Stay With Me - Sam Smith (Cover By Yuca)

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==?name=002 - Surah Al Baqarah

http://setup.testtraff.ru/.../?advert_key=ZWMwMDAzMDA5NzAwMDFlNTAwMDAwMWJmMDAwMWJmMDAwMWJmMGUwNTFjMDNiNA==&name=where would i be if not for your grace

Latest 30 of 35 download URLs

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.