» setup.exe
Overview
Analysis
File Details
Downloads (26)

setup.exe

Rutubo

AVSoftware Ltd

The application setup.exe, “Rutubo Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.conecptclearbundles.com and multiple other hosts.

File name:

setup.exe

Publisher:

Dom (signed by AVSoftware Ltd)

Product:

Rutubo

Description:

Rutubo Setup

Version:

5.0.2.1

MD5:

115dd91b457d0feb8043f3a3713494ad

SHA-1:

9b5e1fda049fb92fd5a95e8796357065906880e2

SHA-256:

ce36828b69723cf1494b31c7bd4d7f560ab55f25226cdba0d96d24d8d83b5ad4

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/5/2024 1:58:18 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.AVSoftwa.Installer (M)

16.5.11.23

File size:

968.8 KB (992,064 bytes)

Product version:

2.3.8

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature

Signed by:

AVSoftware Ltd

Authority:

GlobalSign nv-sa

Valid from:

12/31/2015 9:55:52 AM

Valid to:

12/31/2016 9:55:52 AM

Subject:

CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112134814B6C56AF7047C195AE1D737EC185

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:n6WsEh1GXeQO2Our4MkO6H12ro8JG8Gf5l1nRobv:6ch10ZO2OuUu6H0rowyfD0

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9332

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 26 URLs.

http://www.conecptclearbundles.com/c?x=2We8YnP3wMzgUGsfazixbxACoav0tQG05EqaljpG2Js=&c=aFXp2YhQEblXGGVaLwGRFuEKdOW6WxUNekA8Uxo7RFzgXUJh Ova48mv5gnU9vcj8f1iNwK7mCKEJHFFDGbLVJ0dwjN87VY6jdaRjL vp9VHTPiAqbzFGJvonaC4/DHO&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.metadlconecpt.com/c?x=/ftAmf93OQQ5/kOqgomfRbRBFl1HdRT/SEvWayb3jmY=&c=nOihf2Uof4N13JYU7WygmNi7Zer7g3GRyQHmqcyS0ozhKoSlGausf4i5FB77hEpFb1n3rNDTRFx2WOlkz8xj9MSJR3GRM5dLNdAkOa67vXSAvdx8nsoYKkpPCxmQJUKH&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.conceptsappsranch.com/c?x=AP5WUqdNn5l7HAa7LQ1UkeNv6F40DL0ogblvE8TKywk=&c=T3aD8ny3g2/PTMasnk0PQ1mVeEyPDP2VItdLL8T aByO4 HPldxgR9rzCfEvHp643K7R3q2KyvVrLlpBfD4zOXhfvvGc29hMRHG mLDEXb8dWHhBuphzxtaQkv5QCzjC&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.todaytowerbest.com/c?x=GlvfGjSqh2c9dp/huU16G8G0juV2s0BMQUgCjgImJAk=&c=SoyWO89IxMmSBVRPYMwYuSKTVs6EHQji5XFqEs2jHGVS7puGyVhPVI NYDOQX3V/ZfRjAW80pCCkT6wW3TH5JleCmVRtENKbdGOsic7ixTjCtVZ4zmjT zSRClQ1iu r&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.repositoryhostingconcepts.com/c?x=dcC79rbOpIsrcZUZUHqQzSWhcv8pR4m/UbHw4y8Q5mc=&c=EgP KPNeKAu0q3WSrigsE3boW9IeS4XmwtdSEuNJpjQ6lBGPjgDD6JmVwUyemseKIzpAtNy5ATfo86StqofYTFpuVEniDI3VUgBYUnXbqeOspyG9BTr6cbGPgZTwdlBq&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.farmconecpttower.com/c?x=MsF1z35QU8Xqli 2P8LQg/JmnOJHGDnZJbXma 5el7s=&c=yhEO7XrnnXg464LY5BNuRYWyolApe5BR /1ZcnUEcrZGb UpuuNim czFhfxPnjJlZBic9o7NWtl7eGyZAtCQwherplvIpKzLzgUASE8oe05qzvdMB0Tuizf4 /vybPB&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.headsoftwareshare.com/c?x=F45r8yC6zWcOxtiDJjoVUZkKVKfwas6/bWucTjKxT70=&c=YnnQ3gWq/f1hF6aD/Ig 9dhjoGYVdhnM9iyxeC2Cumr/LwPUN6No2EDs wbKNCXvDHz8grVa7gGX etd3mCqmsIRXOj/strJxDFdRCCUAPaa3h4wBotnkC8XLSECypdu&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.tourstagbundle.com/c?x=OptaXje99S kkFL8dBR9XumUCDo3QcrZuGg/mpvbKeo=&c=LMTA461t66eRIPqbN6LsdpNjthWyL58MV mzBmSr5eMok4TBpuhlgPe4kpXslLLJfvyc M/engxC/n9AefToEIhY9W3bufChl2wQhriGsGB4jQ6zuo KrnyKBV7ixEhA&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.conceptssignsfactory.com/c?x= 9 1hzBZhAlL6PqzP7lnj 4IuBsDiQg cD8g/NGT46Y=&c=JeiQkZ7hDeeAwEyOk6qloydUl2w6Ym8sD/39ypbT03voPVstQjygtXtD317GF7oz97CuK3mVrruTG0qi6ExufLst3Mavl2/gUAoUwOIKlif4TBNxyQFSnT qPDRW7B2K&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=94B3RS8YIbvDpb7IOYVkVuSuEKT08vNFVNQMFnEtlug=&c=9baUeQ/J1GhMA4lqzsRL4r9b6IEuUMwrlRABvdMgt9s7pSZ2G x0Bg86Xg6nV2DeiHLyi7cAMHEBxEr0mtssgc848Xpk9kNlDBlYKYQAn/oAbAogSwDXJmbiYAllHnWT&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.sendcapitalflash.com/c?x=wl 5zIyZsN10WucTO9BFdoLqomAy5l77pBzPrhlf4do=&c=2h f7p4DkP2SL8V5IrfsItAn07hb 7WwKs93MaYvhjOEQRUY42HwAXMFaRNaQuUFWV47h8OS3N0/E/e4ydAk4pcVRm/eaWKRYHDaURTAvUtGz4nc7BNFq8Ex8PJtG3EQ&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.tagfunfiles.com/c?x=/UnY8XG3q1VKj3lSg4MDxiu6mAnnE35Drz82hDfujXg=&c=yTx cz1axWRQPtQyrqijeRam/u3OTnxXG1PvKnegQ8bAFPJ5kzrMhY5EXH9cY4i/bxWL2Sz1uA01muLjEGSeDFkjNI3G7jBiFBEnG5rz2enoEcJGHB9iHVX5I0WL9OnG&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.todaytowerbest.com/c?x=XJdNXtH5wwTpp8Mxv9ntErWBHdiuOyjCw6mCkdU6EWE=&c=6h6wYwf0389Rb3NvjxhOWauKIVrq2n0JH6UPSILD3Bz5YushmBBB2IOn/vTRq/ 9wjILNY B5ywjrEZYxllvEf/8a2qF85113 d9bFS2yetLv9kXsOxq/kOa8VeJ11mH&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.tourstagbundle.com/c?x=c8qLIky/l0fqTRU kRFXDHqLwmkwJmtPEA4RDzOCtiE=&c=hqsU2/yt1bViVlw5kDkbjp8mK7srBbwzd6wflIJvqVXbHWyiZmycOecPy1p3NLTiWqN acXSOcpeWFpTXLZytf2HRHSy3/xYgjWnoGdPbnRjGi I9mnUKpf0k7tCbFDv&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadstodaydownloads.com/c?x=XdqCA nLh3m C LIu8aXDSe2BQfPUPjmgiKG3TeWAc=&c=nmI1A1q0xQtQeZ2gOVRDBhX/p3RP96oE7gcb2Et2hel9FrpGEbwn3hBiZz0jtuGHx8eexa5jQij02iqQo2XniXfuTNQ5V07JwMvDCOCV7wLXazCNibji65cPq6gumF1V&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.conecpttagnow.com/c?x=8F2OuDlgs5/qmyMnJqGxNJQksTEx2kW2DACmG aUWUo=&c=jDB9UWmf199DlLKUIqrPtaeMSAsllXX5uep9B5AWBLVDptGv31ILoPxyxzOFX6wCxflTs0tGbozj2rXRSptKeygHWTvU6JEjEeFjt Ltp0wA2z6C0Tpbvg0va39L2OyS&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=4neuOXBjCLa5mYh7XJb5s4SSXfpAuCIGkwEENPZ0HT8=&c=Y4Jj/co4U63RjIclocHLy8rQaTXnQssuIy2ba4BEE0kFonWk14CXgf/3LD122tjDo2OI5CnLBbH2SkS522PUC9fudkcfeNtvX1rVQMGdnVJh11U/qsCbW50KkHbwPo21&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadstodaydownloads.com/c?x=CBHak80auMa yjj 0UAGmx2H5G2AILtQzuVwpXLjSxc=&c=mmzs71ym9R3e1EXfPYnS1qxiyAXcqvM6yfMn9R0B Y pvnbH0l74lM87eUZWuk5OleAwRZUv51wgWHQT0ZiwIeTeHMcceK4ISMWxz6 d2Kfhj/RJmCssDa1NFmj6jaID&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadsoftwaretower.com/c?x=MOJFAtfByPuw7hX41qNw9HwDZCKD8slxSyudPDzwIz4=&c=OI3rhSVc/3IZaiLnZ3U8flseu1m7BVrDwIqnLhMv/ZaSAvJ8J1g2abu1CIlxJ5oTt8ljU8MnTWUriIigWf5I0VcuV103EXSmE c scX3Orvytser oqmpD51PK4MN8p8&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.packagelaboratorypresent.com/c?x=g4Ny3YV4j5VvnbeHtWZJGX7IuI7lz/7Qx4koeYEoklI=&c=s5ILDvl7Y1j6M3PYMUawmCzQWbaL941RHrVAbRP4q wzpnSlNdJ6jGFNfYa0HqSOA5VpYRASXWXPHQ08MM5JOjjjszkejTa2rB0xC7oYl3XJtvLA3fmjb6PrjW 9JiQ&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationstowerssafe.com/c?x=mTx1suAV93Vq6sfPbDhxqpZmOisfOy0aunwAozGCmPQ=&c=hWTSFaHyzuH8UbYyfXyt4bkbP/XE527qbkb/kn79Iw0 tBQaK2XpuSRJVCyleLQVk79TbAgLgJl0vYOu3OaDlk4CacgU5fNH9KKrQxVbhi48H/vc5qpJ64CCo9qKnh4d&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.contenttowersconcepts.com/c?x=ymPDVwitLTTpCv7mPRMqILnEug3xIgQB9KjfNXpSdmY=&c=I0iPMgi4Scv2BbRFUp1sJdd3HJTtBBI2RloD65xiH6JRYQ1TMGDlPvTzRL9i2NpXZZswyzKdhFuywrMVEmHESVbe3kRfTYmtP1Ls/IeRQe/NXJDhc/mj7WR600x3iGaX&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadsoftwaretower.com/c?x=0jngXoT HlnPiE2dXYbafeaVNYoUjEtWqXrNAzYBsOk=&c=ZKs2yelnVuwLQFbeVqQTFZFk66ATXVW/oom2xYS9bOVQ46aYBvAyrGD6Q AOs3X5v5yGFjj1nFbTr3NF1emjeGLp7WV4/7L lcG yGMfhyUdbUV8y36cTC2unvLYyBex&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.nowdownloadsbits.com/c?x=d9PPVKpKW/X5U6V7 5FGj1XLgLGABB6wnsUN9P3Komw=&c=M31XmTxuAcICLDDLtV6Aj/rjJF0xh9QEsdjYTa8w8ZFEq/xmgauo8iGqXSAuxhvdyDYBMhsaekYgcCzbYXhea7DLha99VReyX44VCg22pIk6OvAJRg/ac LpqcC0EyrE&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationstowerssafe.com/c?x=WGLdIY0VsLxTsIoGQTGgeSVAh7wxJ6HrMQpHdD4v1uE=&c= Prdeqwvn wjpZ/nOaHIdoPhQAwOOVqeu7pwxYmulKJuDo8/M1oxUtvWI2I1HnD/S8BeNLClJYVtuhBMGK9qJvFBUr7uHovbpJaTBDB/uVtVMyktxE5xcpNnIb1l8Mjb&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.nowdownloadsbits.com/c?x=uWy46n9oBjqW HtHGclb3uo2gOng 2G7xpRTcBwDuIo=&c=MBCnpeKxXjKMhXwqXNZNhyT1lpKFB7o9zSu8EGAZSOyAZQ 13qb3jY/aU 0f6JQh7H87POEA7L5FsfxKq7I5Vr0kgG0a eRkgPP8vydcy7rIlhkvwNIitfgo0dwqgy5f&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.