home

setup.exe

Square Network Tech Co.,LTD.

The application setup.exe by Square Network Tech Co.,LTD has been detected as adware by 20 anti-malware scanners. The file has been seen being downloaded from www.downrapid.com and multiple other hosts.
Publisher:
Square Network Tech Co.,LTD.  (signed and verified)

MD5:
95530bb5feb339f22d0e3c744a4db800

SHA-1:
83642c121afb0f429ecc0527d4eb2a60f1f2c05f

SHA-256:
d901f5e1da6aae67ad6468a973a5eb8e5afcc799dc4a61dfbc338bd6a2b3c939

Scanner detections:
20 / 68

Status:
Adware

Analysis date:
12/27/2024 3:59:06 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

Avira AntiVirus
APPL/Downloader.Gen
7.11.201.144

avast!
Win32:Malware-gen
150102-1

AVG
Generic
2016.0.3228

Clam AntiVirus
Win.Trojan.Squarenet-3
0.98/19932

Comodo Security
Application.Win32.VOPackage.AGEE
20727

Dr.Web
Trojan.DownLoader11.24441
9.0.1.05190

ESET NOD32
Win32/SquareNet.C potentially unwanted application
7.0.302.0

F-Prot
W32/A-f5b31e60
v6.4.7.1.166

G Data
Win32.Application.Squarenet
15.1.24

IKARUS anti.virus
PUA.SquareNet
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.191.14658

Malwarebytes
PUP.Optional.SquareNet
v2015.01.15.11

Microsoft Security Essentials
Threat.Undefined
1.191.2440.0

NANO AntiVirus
Trojan.Win32.DownLoader11.degkfi
0.30.0.64448

Panda Antivirus
Trj/Genetic.gen
15.01.15.11

Reason Heuristics
PUP.Installer.SquareNetworkTechCoLTD.F
15.1.15.23

Sophos
PUA 'Square Network Installer' (of type Adware)
5.09

VIPRE Antivirus
Threat.4895341
36666

Zillya! Antivirus
Backdoor.PePatch.Win32.50599
2.0.0.2036

File size:
293.9 KB (300,912 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Square Network Tech Co.,LTD.

Authority:
VeriSign, Inc.

Valid from:
12/30/2013 4:00:00 PM

Valid to:
12/31/2014 3:59:59 PM

Subject:
CN="Square Network Tech Co.,LTD.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Square Network Tech Co.,LTD.", L=Zhongshan, S=Guangdong, C=CN

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
08F1CEE1EA15CE4F4CA29FDEBE3DACA3

File PE Metadata
Compilation timestamp:
8/7/2014 4:14:57 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:ueHuEn8B5kkwqbSkVuMVcX2L2gxjxwmnlVbiNQge:xuE1kwq1uMVcGCgxFwmVWage

Entry address:
0x208DB

Entry point:
E8, 29, A1, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, FF, 75, 08, FF, 15, 30, 51, 43, 00, 85, C0, 75, 08, FF, 15, AC, 50, 43, 00, EB, 02, 33, C0, 85, C0, 74, 0C, 50, E8, 96, 19, 00, 00, 59, 83, C8, FF, 5D, C3, 33, C0, 5D, C3, 8B, FF, 55, 8B, EC, 83, EC, 0C, 53, 57, 8B, 7D, 08, 33, DB, 3B, FB, 75, 20, E8, 4E, 19, 00, 00, 53, 53, 53, 53, 53, C7, 00, 16, 00, 00, 00, E8, 2F, F1, FF, FF, 83, C4, 14, 83, C8, FF, E9, 66, 01, 00, 00, 57, E8, E7, 90, 00, 00, 39, 5F, 04, 59, 89, 45, FC, 7D, 03, 89, 5F, 04, 6A...
 
[+]

Entropy:
6.5013

Code size:
208 KB (212,992 bytes)

The file setup.exe has been seen being distributed by the following 3 URLs.

http://www.downrapid.com/node/file/pkg/.../loader.exe

http://www.downswift.com/entry/.../index.html?offer_id=16526&aff_id=11156&transaction_id=4ec79aec-3fcf-47be-ad63-13c077cbad38

http://www.tracksite.us/trace?offer_id=16526&aff_id=11156

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.