home

setup.exe

StormWatchSetup.exe

Local Weather LLC

Part of an adware web browser extension that delivers advertisements such as coupons, price-comparisons, display media, affiliate links, banners, popups/popunders and other links. The application setup.exe by Local Weather has been detected as adware by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from wpc.0952.edgecastcdn.net and multiple other hosts.
Publisher:
Local Weather LLC  (signed and verified)

Product:
StormWatchSetup.exe

Version:
1.0.0.12

MD5:
5aa07bc79c99a89f2740114ddcda2423

SHA-1:
a1f957d7e96c45e3207b2eb6b665791aaaa059ca

SHA-256:
e9d8f97ced3a0ea829dcdf65f35eec863fa66258db62cc3c70a75b2ca601b015

Scanner detections:
3 / 68

Status:
Adware

Analysis date:
12/30/2024 10:44:00 PM UTC  (today)

Scan engine
Detection
Engine version

Malwarebytes
PUP.Optional.StormWatch.A
v2014.10.08.11

Reason Heuristics
PUP.Installer.LocalWeather.F
14.10.8.11

VIPRE Antivirus
Rocketfuel Installer
33744

File size:
147.7 KB (151,216 bytes)

Product version:
1.0.0.12

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\setup.exe

Digital Signature
Signed by:
Local Weather LLC

Authority:
COMODO CA Limited

Valid from:
10/14/2013 2:00:00 AM

Valid to:
10/15/2014 1:59:59 AM

Subject:
CN=Local Weather LLC, O=Local Weather LLC, STREET="250 Park Ave #504", L=Minneapolis, S=MN, PostalCode=55415, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
1E363E3CA4E0B46A71B002CFAF51DED1

File PE Metadata
Compilation timestamp:
12/5/2009 11:52:06 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:ZuxkZuTXJHQWNqiVexuoD4VMCpzkuMs2DOEbw:ZSqWNvpVMCmIqK

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 6F, 44, 00, E8, 09, 2C, 00, 00, A3, A4, 6E, 44, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, 9C, 42, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 2E, 44, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, F0, 46, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file setup.exe has been seen being distributed by the following 10 URLs.

http://wpc.0952.edgecastcdn.net/800952/.../setup.exe

http://www.download-servers.com/.../dl.php?r=vu_vo2_VTG&rr=UN&sct=AGR&sid=

http://i.wecan-software.com/inst/software/1B7DC43F-EB3D-4632-9998-B29D1443A8EA/.../Setup.exe

http://i.versscom.net/inst/software/1B7DC43F-EB3D-4632-9998-B29D1443A8EA/.../Setup.exe

http://ogdelivery.com/.../Setup.exe

http://s.allfreesoft.net/inst/software/1B7DC43F-EB3D-4632-9998-B29D1443A8EA/.../Setup.exe

http://stormwatchfreeversion.com/StormWatchSetup_dist_1.0.1.10.exe

http://prod-vertidocs.net.s3.amazonaws.com/Setup_1.0.0.12_stormwatch.exe

http://dl1.downserver3.com/Installer/.../Stormwatch_1012.exe

http://dm930xmxv1gqs.cloudfront.net/bundles/.../Setup_20141008.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.