home

setup.exe

The executable setup.exe has been detected as malware by 1 anti-virus scanner. The file has been seen being downloaded from mzhxtry9mopn.fkmz1vn3.com.
MD5:
dc525d2ed7783cf57a3408daa412055a

SHA-1:
931bce40b68af327f8880b0d7c947cf544609359

SHA-256:
246944be0f8aeb359e94e2965902d4e35cc9dfd932673855bc1206a4c306f0a7

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/7/2024 12:34:43 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.6.13.15

File size:
679.7 KB (695,987 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
11/7/2014 2:15:22 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:/MKVMOhMi3CV61OFIPnI8Pbaq0uEiTnbZyzg2h5S/6Z:08uia6wFIPTbH0B2eg2h4m

Entry address:
0x100C6

Entry point:
E8, 5D, 79, 00, 00, E9, 7F, FE, FF, FF, E9, 70, 25, 00, 00, 3B, 0D, 70, 58, 48, 00, 75, 02, F3, C3, E9, 62, 7B, 00, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00, 00, 00, 74, 24, 8A, 01, 83, C1, 01, 84, C0, 74, 4E, F7, C1, 03, 00, 00, 00, 75, EF, 05, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8D, A4, 24, 00, 00, 00, 00, 8B, 01, BA, FF, FE, FE, 7E, 03, D0, 83, F0, FF, 33, C2, 83, C1, 04, A9, 00, 01, 01, 81, 74, E8, 8B, 41, FC, 84, C0, 74, 32, 84, E4, 74, 24, A9, 00, 00...
 
[+]

Entropy:
7.0677

Code size:
158 KB (161,792 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://mzhxtry9mopn.fkmz1vn3.com/_ELR2dMla0oexf61vfRVkde2FOt3Gl_YgTczI_9oQt3DTa_6T2a32bO-donjDDjk-bVy_XK6q6WUiJwCLLrDp9JF6-bkRpSC7wK5HZMGXH41-rsCHbPdSaqkfgBD1QNO?sbb=rQzEwm1FfswuhFqhIsIYyjm0RmYlpjvV9r4JerxOarff0MhFrqxTWEYSFiIZAPTTqAqD6ng3ZYvhyvAEboneiIb4kZWMUIUCPU9NWjaT61yTHT8Rap77UxmBORX45fbpbEEQjg8xsOMQvW7VModfbacFhN9dhYHhFcbC3W12N4x2tUoHPdwPrigtH8TfWefGpv1ee3C6HjdZTKXgoFBbnht94204I5iTcXcGbHoZyuNo1w5YNGReEwjnpAI0nXptxfUpPIhTQT87CGWsPNVEKKpueFbdi6G8saHRte6mWCNctetZCCi5jrtwaAQ6xZBTkPyVINoPyvujK02rWYI3872in3ltKRanRZJj5ySjrmAilVXOTJt58G7c1XUdWQkRVZiteN0Q25tsDi0gRkaVDimAFTd8nRrxv3hsDANoZ9SmKFBnM1qT8PmhzAZEPjyA3AYit2eha906AmrMs3dfvT000Fg8CPyXI7Iw2A2XSWegEuIYYLUk7Y6zLPY56mylOEdbJOUKZgtkmU7ltzYFhIs8zLmcUCYeMJJlPGlSdOh0L6ZpUy8fuIYYC9EGJRBkGyDjhDqQQY8reA3kUiGryHOZqI96ylEebBJISjTgJM78ULeqZMeCRibrOIisEhjHt09XF01CHdZiZk49IXUuvuJx6glg6cPiZoyPJBpcFYY8YG36eYJSTJDmKCrNTZAPA1fnNHUyJyIxwKY6Q50ZQeXppyzxayRmGdmZvUo4J87htAxTAWV69n0JIAG2Lpi59zwIilJKzFqPYJV6VnLBjrOl1wrncdV7UfFoDVbsG3pvb32uWzEFAkjt8eG7WovWUz

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.