» setup.exe
Overview
Analysis
File Details
Downloads (1)

setup.exe

SETUP DOT EXE

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application setup.exe, “Fusion Install ” by SETUP DOT EXE has been detected as adware by 38 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from moozymp3.com.

File name:

setup.exe

Publisher:

Fusion Install (signed by SETUP DOT EXE)

Product:

Fusion Install

Description:

Fusion Install

Version:

2.4.8.1

MD5:

097b102d14e9da1879088d93a14a9f38

SHA-1:

6c1e0b66aa83c580b756ca9dff82b780158db3ec

SHA-256:

18d236a25d3c57bbb0fc4fb9fbd7ab5e12f25432b3a84fae9e2238c5bf0d2180

Scanner detections:

38 / 68

Status:

Adware

Explanation:

This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

11/23/2024 9:54:34 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.OptimumInstaller.1

362

Agnitum Outpost

PUA.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.IBryte

16.02.07

Avira AntiVirus

Adware/iBryte.qoemni

7.11.138.238

avast!

Win32:Adware-gen [Adw]

2014.9-160207

AVG

Skodna.Generic

2017.0.2840

Bitdefender

Gen:Variant.Application.Bundler.OptimumInstaller.1

1.0.20.190

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Trojan.Agent-726035

0.98/19290

Comodo Security

TrojWare.Win32.IBryte.S

17995

Dr.Web

Adware.Downware.2249

9.0.1.038

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.OptimumInstaller

8.16.02.07.09

ESET NOD32

Win32/AdWare.iBryte (variant)

10.9598

Fortinet FortiGate

W32/Wonton.J!tr

2/7/2016

F-Prot

W32/DomaIQ.G.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Application.Bundler

11.2016-07-02_1

G Data

Win32.Application.PremiumInstaller

16.2.24

IKARUS anti.virus

not-a-virus:Downloader.Win32.Agent

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11684

Kaspersky

HEUR:Trojan.Win32.Generic

14.0.0.695

Malwarebytes

PUP.Optional.OptimumInstaller.A

v2016.02.07.09

McAfee

Artemis!123F83C088D5

5600.6496

MicroWorld eScan

Gen:Variant.Application.Bundler.OptimumInstaller.1

17.0.0.114

NANO AntiVirus

Trojan.Win32.Agent.cvofrk

0.28.0.58720

Norman

Gen:Variant.Application.Bundler.OptimumInstaller.3

11.20160207

nProtect

Trojan-Clicker/W32.iBryte.240416

14.09.17.01

Panda Antivirus

Trj/Genetic.gen

16.02.07.09

Qihoo 360 Security

Malware.QVM10.Gen

1.0.0.1015

Quick Heal

Adware.iBryte.DK4

2.16.14.00

Reason Heuristics

PUP.Adknowledge.SETUPDOTEXE.Bundler (M)

16.2.7.21

Rising Antivirus

PE:Malware.iBryte!6.14B5

23.00.65.16205

Sophos

iBryte Optimum Installer

4.98

SUPERAntiSpyware

Adware.OptimumInstaller/Variant

9337

Total Defense

Win32/Tnega.XABfAXD

37.0.10891

Trend Micro House Call

TROJ_GEN.F47V0515

7.2.38

Vba32 AntiVirus

Downloader.Agent

3.12.24.3

VIPRE Antivirus

Trojan.Win32.Generic

27758

Zillya! Antivirus

Adware.iBryte.Win32.834

2.0.0.1775

File size:

214.8 KB (219,936 bytes)

Product version:

2.4.8.1

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Adknowledge Fusion

Language:

English (United States)

Common path:

C:\users\{user}\downloads\setup.exe

Digital Signature

Signed by:

SETUP DOT EXE

Authority:

VeriSign, Inc.

Valid from:

10/4/2013 5:30:00 AM

Valid to:

9/21/2014 5:29:59 AM

Subject:

CN=SETUP DOT EXE, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SETUP DOT EXE, L=Kansas City, S=Missouri, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

348784BF9B5AF7CB50276EA8463A9048

File PE Metadata

Compilation timestamp:

3/27/2014 8:32:07 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

3072:4E0vnh6JiLznHfzTZZCsL4msJJSRdm5q/pT/5R:4EcbjHCssmj9/p75R

Entry address:

0xCCFB

Entry point:

E8, BC, 47, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, AC, 72, 42, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 5C, 70, 42, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63... 
[+]

Entropy:

6.4111

Code size:

150.5 KB (154,112 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://moozymp3.com/.../download.php?tid=211

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.