home

setup.exe

The application setup.exe has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from aback-structurec37c4d.com.
MD5:
06bbeef21ab78c06be133aed7102be5b

SHA-1:
7f2a5b753a3a059fd3298bfa666d87b8202f3b34

SHA-256:
cf4e9021fccda4ab576e5b1b03eb9c53e04d2144c323b640c72ed94a115138d0

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
11/28/2024 5:34:34 PM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Gen:Variant.Application.Bundler.AdGazelle
11.5.0.6191

ESET NOD32
Win32/AdGazelle.E potentially unwanted application
7.0.302.0

Norman
Gen:Variant.Application.Bundler.AdGazelle.2
28.05.2016 15:32:18

File size:
621.4 KB (636,299 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
2/24/2012 2:20:04 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:K0guAS2+qkuF35fGIo+x3x0IZlcAs1qWgSKTBM6E0JcBXDeW:FDAS2vkq13x0IZ2NXKOIeXDeW

Entry address:
0x38AF

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 68, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 90, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 90, 40, 00, 55, FF, 15, C0, 92, 40, 00, 6A, 08, A3, 98, EB, 47, 00, E8, 36, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, EA, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 64, A2, 40, 00, FF, 15, 84, 91, 40, 00, 68, 4C, A2, 40, 00, 68, A0, 6A, 47, 00, E8, 18, 27, 00, 00, FF, 15, B0, 90, 40, 00, 50, BF, A0, F0, 4C, 00, 57, E8, 06, 27, 00, 00...
 
[+]

Entropy:
7.9383

Packer / compiler:
Nullsoft install system v2.x

Code size:
29 KB (29,696 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://aback-structurec37c4d.com/track/install?gluid=gyaEYiQh4MIGp2G7RjjTs4RxsKsYgBkVQNHuKI5mVKI0uQjm8cOlE9nj6fYv2d U86G1AyFw9QrISg xuZPRQGs12qrOQxpn2TE7TAcqVOg70Vg1BA0c 7ehGasqTRam3 0GSe5k4gbkbt66XMHFGxwmTsjZucTuzavDAadqDbjoGUmHI9zewEn Yn/bZ3slhhrDMkqMtC3h8goPPOE0SyfyBFHVZzpp/NcMvfJ5nAYfchuRMnQgVdpvA2Mz14kf6r1evSfNvrIM0lxACGKvazO9fPR9vaiwBNjqCgAiK0uaWwnvg0cwdw7T0Sg8adD6qmDZy 0em1ziR8s95kgJ44EmJEWnSSdC5tnK70vslzgvwQX0b0fOomdd9QGguDDKFlSozEFqrbA1ra1iRh4BADFDXCHpqoRO2QUCAp7QFWMU//HFJXJF5HD2Su5SDch4W T64zLXkzYJzQl0yoQCreef6FDewMex4youtvOE3OwJIfQgK/LXZ6U3kgNURgBvCElTZKPg2zWeZqpwx W1zA==&_sd=1&alc=1&dl=1&dlink=http://installationproxy354.com/o/.../Setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.