home

setup.exe

Software Web Lite

Silver Setup (New Media Holdings Ltd.)

The application setup.exe, “Software Web Lite Setup ” by Silver Setup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.farmtourtag.com and multiple other hosts.
Publisher:
Software Program   (signed by Silver Setup (New Media Holdings Ltd.))

Product:
Software Web Lite

Description:
Software Web Lite Setup

Version:
2.3.3.2

MD5:
db802317cba990501eb9cf847cfa3371

SHA-1:
94afa75641c4856785b53e2082b9e165ea0a9a32

SHA-256:
a4d9ab72b5c7013bd622543d9964956c5d66004fae7f746151c1532c251ff149

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 6:39:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.19.1

File size:
956 KB (978,904 bytes)

Product version:
2.0.8

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
Silver Setup (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 8:34:48 AM

Valid to:
9/10/2016 12:57:01 PM

Subject:
CN=Silver Setup (New Media Holdings Ltd.), O=Silver Setup (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DDF3CFBD99D884DDB3ED223CAEDE3723

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0ToWCnfQJxfXhmS8aHMM9y5tLe3jICxAXn8Sud:0MpCi8jICm3z4

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 15 URLs.

http://www.farmtourtag.com/c?x=F2nCtW8AcDdacHB4i ZvfbsiJ87QJ6ATasDy0l y4xo=&c=UMMIbTjBGI8jBZbGphUZar2ZjUjkkTHnC9wza3Ric/iqd0taAgJh9AFuX268aQXnspWzbvKy46cVh5tbCnRintnp8FBYblJzz5yaS44RlveSQe4guswH/IGIXqm2ZVBD&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=nN8sgvkLbQXe9OCoYQfKv8BWbfY5ViCGz8nOGojbfVI=&c=ISa1pLZ88Bzyqy81kE2JOrhWIWjAt1eBu2h8t3B6R7C6wQ09WoCGFF9SFK4XGFPYL58Pfpe61/JX166td5GsFkDLYhGOXWbdI0cL2B4dCfmBLtZ0KhN5gNmaL0e29LOg&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=E6QF2 DXnYv2PK9dvFXOzj/ZkavAGQ3KyAYUBYk12mk=&c=tLY3qZs0b3BczlBTiaGQTew7khKOCt2fV7swZTLkRVSzvV rmd9luuSj6iGxyXfm9rN6Q8WeCtJBJu3/MgosUS4UxJ5DuttMcG7taTF9t o/SMiqtUUcJzMsRJV2RUV/&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=IecSjOUkSNy2cwNL5v lASRMN9hgDuamZLyR0w6hFbc=&c=w1ADXS2wR6Jobc16HC WUyR4aaH0vly0tGeUO4R4aYc4ARRW7B6yy3pTINpc7kb6L0RWRSu/xW/ayDFTLfGfsCC6vsB3ZPi0qMBfD176Hlef5ocMwMyEXxyRHz0d/kNt&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.cleanpresentapp.com/c?x=2iwo3IAI Jq5H3u8LcNr0lJX519iUOjngaEzgEBxA/0=&c=Hoxgffy3XUCzPxop/940YtpMzmQLGpoW2e3IH9wB0TxG67c51Lpn6FlkLWEOKLyP4EIo/VLam7mW 8BmVMHFWMV31AyhA34lrbe40ATL0k/8L JgZHYl/YnVr2c9b/NS&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.universebulkdownloads.com/c?x=OjTqCfhUHeNF9x4/T7YAaNKg9WgpBmkM07L8rTGzWJ0=&c=f3eMFC3auObF7SfBCUf2IGAiMWt690TDTXX0wsmi6hAVF5mpWnSXRVmYJKxJQ6gAUMMmFepw8x2MMjexyf950CYet8zFMOVsTEIOkfdYu5hvI/k2hl4 tYDgUkQji BG&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.cleanpresentapp.com/c?x=xTjEKCyTpdk9riIexqTUyQnHn4d7y6yqSZ2HB2HpGLI=&c=3I/845CARUhXS0jQMnYIPL5zpJOv5XpARV894HSSNH/pN0YwD2j HcCH5SnwQmBh26VzgdxjRBmhlfJDTD9LklpKw64X SDqJHpn5Cp5U dhlV8xi0V7EW0OFbInn784&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationbundlehead.com/c?x=sKcVPTPeuB0 is7AS2 Sv6V7Tl80bf2LYActiOfWtA0=&c=tEBxwoOQRxOpYLDRritS/CHQaoYpslLaCV3fq/QLfaUgdGT/H7p4wpG1HnKWYIgo1Bz1elFhC4ccrIzz1H6Qf4QAipRqEk4yvO6oqms1HThtSehmR1LBa3v1ke wRsgd&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.cleanpresentapp.com/c?x=llrOfCXz/BqTCgaBU1mU6cWlpE3ftcpNlKZGRTL/AAs=&c=dxotUrRY QTrEtCSq7wq8FegZhrPBivm /dsX4WnEZL6kdP07ny25IjhaKV4/3UnGA1bekF1G/ghHF3g4bYZBGntswqLE9PEz1FMpCwSI7QgON3vBbKbasgUgDAOchY&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=U3P4YEZaVTY1oy PjjozZ09b5UlZqH1V aZjyUPijrM=&c=DiC0hg1 fIKfQil1Uu2VwQIxfHrO4hD8NJzCx0Up/nUO90bxV0V/8BulXSAJj46DrJdcHuv9vZBVT87Sr8e0KsTFldCnMEiLFG xeTh1FEOMDIgbvZb7SChPOtTt M1C&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=ta0hGGkhyEtlE9zKd3Lqu7KZ1GajszetXUdZEP8EOV8=&c=ID83assl2/53JoR8GOoMnASzYS8lyvCkmZU8FhuZPAGQV2FYpMVdKJFY9xkW9vAgxVp6wgAABpN JBvziSR71SXko15Hk D4M4RbBmi1a3WZMfgle2Yqu5BTlDH Zxhr&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=9Or72/wzYPVAFMB4lA0QLkkJkeYo/A PBX500nyzJwg=&c=zr2CObiC2GQUu/wLlqi3fX0iN6t2QZ3YGM1S5abohhjAmqIsA4F4OCTPHQBVfmQombgeimwgRP3yzr3o8r5mLGnLzSXyzQanez0kDsAiQbXg12050Wk51ZMU02KcGF6m&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=AesTJOvgqGYMlXSYEfaxoQ4nKbkMmoElKu1TO7p7rDI=&c=vR2bpYI6X6zav7vpGPhf9hRr CIu 96M1Rb9SjKqbBLaJpZJ76eNQKqz2E5qQU4clpJIDp6qPx0 lilv4cf/zma7stS3nvjp86uH7F6j MrJ4mjXdkzlfTwiYNMybMZE&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.cleanpresentapp.com/c?x=lIeVIiuRRKTbxov3LMZJQLwaVJWt49GiROaElRmS48w=&c=NqOkFGSKIAHZqf5ordf2B4/j4jyEnepHdEYIIiYA8UkvtBVqQ4t5wi9d3zQbWFd4V2xxAP2aRV6etBEu2UrlkCbAjreANUbhXf4VYJgaMNrzHt5Atx52acYhM3Z5WQWx&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.farmtourtag.com/c?x=lSdWXrfDULnv4ZcocBnRLXzI EZdSR/qX9O9o28A/ic=&c=8uv4hLJaDP sKX8O7qRTqhV2Lt9OS4nNr3fy46 z7XbNSJ3IZMKP80OJ/XcuC45jrLI74Up6iXcSunZVyAcjbHMazIemFJ/YxbMGJZX7MPyKES3AAw/irvzkjl/oZaCV&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.