home

setup.exe

application internet

web

The application setup.exe, “application internet Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.contentbundlesafe.com and multiple other hosts.
Publisher:
web

Product:
application internet

Description:
application internet Setup

Version:
5.0.2.8

MD5:
49ac0404cf4ee837fbadee15acaf67e2

SHA-1:
864c292ce5aec1544e6034f5efe57b5844dfbfc6

SHA-256:
d75ea6d483e4c28bec4c7cfa245ffcc8f48da7589c4a907f19c1ce5cf545a1eb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/25/2024 11:48:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Installer.Bundler.Installer.Meta (M)
16.1.22.17

File size:
927.6 KB (949,856 bytes)

Product version:
2.6

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:R7ObYBgNetSj2AxvKvVSkePtoounCcrrJeLw2JFgMW/nPtI:Rab3AtSjrxvKvEkuCLnjGrInP2

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file setup.exe has been seen being distributed by the following 8 URLs.

http://www.contentbundlesafe.com/c?x=UGyahXGBWVEZNDyUBA8pNkVJBBYFSz 4yFzeqorB7C4=&c=Ewd6DPQl3SLS9m/v9X3Ihu2kY/FZTSWbL/E5GwyPtsjlOlJqlDZnKuonF8zl4qXKBH0VHQVDEaNROx2O58CPJjrgfeEgxtJhKlrcMePTrAqIoex5Vk2ZR9mkXQ7NYnRYt6vX4osmAsCzxQNiii4L2w==&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.appsgrabrepository.com/c?x=pkGTbPe/uEARWUlNNXocBlOv49X6 Ba114vcjMeGoRc=&c=zp jQKP2EiRj prO4MiJkv8y/2LlaymDD9uBoZExBifIrWUTIUC0x uXL1KkqFVTIkG22pomxb0V90xJanjCA2EzKEZwe EaImUE6hyiaUld2mY0kPnfRPD7AuZOfBb5vS8PdKwUHnh44TMyiPaixF T5Tmp1VKb4P8Ue/NcpY=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.cleardownloadscycle.com/c?x=OeEB4SwmYicLcktyU O2eaaqLZb1OkbcL5lz1o84XR0=&c=LhQGyURmqphnUqsfbKKmWGsy0ttEH9aKmA93jARyqWLfaiqViLQ5fG0y6KJ6zHfYYrHUjoedmgoWZyh0gwkGGm3tooYP0I3D/1Gl7G4 R5JU5BElF/6ow1hQlFXQbRzxssRWOMuBuiKnc2 3KAdf foIWB9n Vk6t0UYjWEJZtA=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.toursvaultdl.com/c?x=Sjzg7WVQyvu9qTTXTaAgO5T/sK3BuCfn9w7j VAiH3s=&c=2DVSD23C/X3fiSdc ARmlYsx9utho9olzGEeEvlb7pMOoPLdZVcDqk1TyWxRzuOoPqQ3No8dpAJX8qAhIlNXwYmcrbDs1oUkbgHRtOEvK8xrsXP6TyvOwcyl2LdqszrfOF/7mygoqeQy1x4jN83IS6MTI6rqqjSXqpc9ysSC0CM=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.appsgrabrepository.com/c?x=9aKqBam kjBL8yc4iSmXjuSw2b9t8lbw4oy32tTkI1w=&c=86I0Zg5e21IwADQSsgOhj9C92vofqhEOoumzAqNkIbBLw5XZJwwdvAm3tomWP0oO8TMh8R 4euBNJvpfWn77ithg7OFo0vgwUwcbbZ8Keyc8AKOxBursiZ5qfwU3pKrTY65NvpjcrWxsju9bJ tDmPySUz4QK5pSKpRrSYTV36k=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.sendbinarieshosting.com/c?x=XxSy1Gxjcr xPVBi9Tp SZIG3dyE3BdO/esrJbka7aA=&c=ysQt7K2SSUbeMuESjmH6w0KKqhIvq1Ys4Z8dMCU3/x3Sy cHnKQlSQvvutL /kxhAAWy8kD1XapViILA23GWep5amJka76oxb3JtVZ/dmhoGMx 90ZJfj8tU5eETTR8o5wWP7ECacJHhIPf73LOqIg==&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.contentbundlesafe.com/c?x= lWj1GfiwIiGMDMzy3/r7ddzvuGKiSZXsXGdvx4p93I=&c=rewF9EB1GQnagm2xNIsspMuiq3oLPWy6d0mVjeexU4mqJytluTVmK7lVX5r a/M71lwU1bRLRlC1KxkaR8sVtBVSAsxl1G V5kMPlVN/aTKLSMHVcDmn5w Vs4txo6 SkduPzhsJjDPPsP9x3sesvTDYrtlV7cq4XvNG9Nrdb68=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

http://www.appbundlebulk.com/c?x=tr5ZpV9WGuHPz32qWRP0/ngjCv4 K3wb/6UX0npHkIw=&c=0He/W hpNiQUEG0ZOn0hHoTVZGqgcc3p4 fH48lusRnhZgwnmFGcDjmQkQiLw9OwaSXRVex8h8tP huv3kJ4ZCsxGSH4qRlw6xecA7DKbhqetqYjjzJhyUfSx3n/zceemBA7P6G8acKAz 1/rVWtdlNzHY sOiWYDt1HG2Be2oI=&downloadAs=Java_Update.exe&fallback_url=http://javadl.sun.com/webapps/.../AutoDL?BundleId=94214

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.