home

setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from download.fazenda.sp.gov.br and multiple other hosts.
MD5:
90c4864676f4b950a542b941e30f7d94

SHA-1:
7959d80cf435a81cbb1323d534c14397ca1bcdc7

SHA-256:
0b5f9dcf820c02ab5a2fb3e7927ef7e3005b10d3911de853af311d352ca68d15

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 10:23:16 PM UTC  (today)

File size:
1.8 MB (1,903,167 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
12/5/2009 7:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:r1VGC8UcRfgGpsr3p5Nrc8uLR4ycf3DwvFSnMxq:r1VGCnhGpQ3pLrc8uAf30vFZw

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file setup.exe has been seen being distributed by the following 11 URLs.

http://download.fazenda.sp.gov.br/.../setup.exe

http://www.econeteditora.com.br/links_pagina_inicial/downloads/.../setup.exe

http://www.anyprotect.com/dl.php?sct=NONC&data=null&anyprotect_id=1&r=ap_100_nc&pr=s&prm=dXJsPXt7aHR0cDovL2QzODltNGw1YjV3bGNiLmNsb3VkZnJvbnQubmV0L2FwbHBtb3YuaHRtbD9jaD1hcF8xMDAmYXV0bz0xJmRwPS1fLU9UYzRaVjgwTkY4eE5EWXlYekUwT0RGZlFsSmZNVGMzTGprNExqRTRMalF6WDJZM05GODJPVEkyWDBGRVV3LV8tTHFPUHRtYmZzd3R6endQZmc5YVduYUZlYkdmYV9GOGF2YmFrLVZGX0otYmFBZHEyZjFMblRudGlBWVlxcWRFMDJPT011cGQwQXVNYVhpSGFhT2EwMGF1Y2MxQWlnQWRxMXRPYk9iT2J3dmt2ckoyVTFRMkR3ZkUybjVrUVN0Ym0ySEhKZkxiOHhQNmo3clVvcHZBUHl5ZE1hQWNLWHF0OXVUbXF5UWNvamMzZ3dwa3FuMVVSV0hkWFBLZWhvbjBkWFFnRWpidUlna2VmS2FmUmt6aGVjZHBiRkItd1RlNGFrSDNDdXNvMEFhblgwanQ3QXFoWG5JbHA3eVZyLUU0bFlkODJhSkk0OXVrenZUQ0lyWEdVa3NNamU5eWlQaE1EbzRJbmpCWTJ3eXRjTXJRVVZGaG9TcU4tWVl2QnRlZlZqZmFsSk9yamloS2syR1JlbzNRakpGYlpQWHdTdUtSd2ZVZHRTa2l5UHpvaXlEeW9haUN6MUhNT3Bzb2lrc195X0tEWHJZSHRLcWZqOVBXZ319

http://ttb.lpmxp632.com/download/request/.../xb9onqTr?__tc=1408491732.376&lpsl=ca4f3af9d4ef1631165641cec9c18a9f&expire=1408578107&tgu_src_lp_domain=www.dwnlultimate.com&ClickID=30160481071408491705&PubID=311456&fileName=Setup

http://735322.gosecureinstall.com/o/.../Setup.exe

http://ttb.dlnldalltsoft.com/download/request/.../PCu0vkJK?__tc=1414105309.837&lpsl=5239800f9d5227af78eab422aa8d8ccc&expire=1414191692&dp=-_-ZTBhZV8xNzNfNDA3M180MTE0X0JSXzE4Ny4xNi4xNzguNjNfNDhkXzc2MDBfQURT-_-ADSYS-870c2289-5b08-11e4-a968-f57840fbd0e6&vurl=8849&fileName=Setup

http://get.0122d.info/.../1429726787/1429726787?61428523147YWRwMy06bjo2LyksJWA7Ki8zMTIiZTcwMjcsIWw6MCJdKzwtNSoxNSNiaGJdamViNS02LzExLi0wLjIeZGFsbTkrIHllbjUt

http://dgc.freemediavideoconverter.com/download/b81/ww/.../setup.exe

http://files.getsoftfree.com/get/click/.../?sid=D39B7CC5-0C01-4080-8F9E-D95E2A3F4150-1394&filename=setup

http://www.anyprotect.com/dl.php?sct=NONC&data=74bb3303973b6e1c54f020baf07a9cc2&anyprotect_id=1&r=ap_100_nc&pr=s&prm=dXJsPXt7aHR0cDovL2QzODltNGw1YjV3bGNiLmNsb3VkZnJvbnQubmV0L2FwbHBtb3YuaHRtbD9jaD1hcF8xMDAmYXV0bz0xJmRwPS1fLVpURmpNVjgwTkY4eE5EWXlYekUwT0RGZlFsSmZNakF4TGpnM0xqRXdNQzR4TUY4NFkyUmZOekkyTUY5QlJGTS1fLUxxT1B0bWJmc3d0ekV3eGJFd2F5bmFGeWJHZmFfRjhhdmJhay1WRl9KLWJhQmRkZjB1akFQSVFULU5wTE11ckFyNkg2dDVOWWdQTEUxYXRnTXExTTBpR21BYWFBYWExMHN0Z3pqYWU2cVdtMEtITVcwd3AzRjE0WkxWU3ZqSFoxcm9rWEdzRnBIUlJKWDFiMFJYMElJRHhKLURCWGNQZkdhR2FqampkcUEtcWtTYWJPcXF5ZENQcnBSdmh0b3ZFc01scDFmVXY4bmZucTRUZUdacmJlcVlBSmJvM2FjZnpNaGtZeVJmaFpLTVl6Y0N5TmRlZWpmYUt6RlJPTDE0S3pGbnByT05ZVnlXOVlISFJHTGFIYUgzLXk3WV9mczBDT0Z5bEZubWxtR05Pek1tMTBrT2VCenoza3cwMGhEaFNidTYxLTVXM0l1SFRUWU5NVkhsMWNHQmlpbEF1ZHZucTZzNHVZN2p3dkFjWFRydXRxRlNybWRrRWVjWlRUb3ptUmJPYVJmR0hmT1lPY09aS1hoSzc4Zl9qM29mY2Y0cURmNXpHfX0=

http://www.receita.fazenda.gov.br/publico/programas/sicalc/.../setup.exe

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.