home

setup.exe

tvron.net

The application setup.exe, “TvRon.net Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from ttb.0vin60f6.com and multiple other hosts.
Publisher:
tvron.net

Product:
TvRon.net

Description:
TvRon.net Setup

MD5:
421dbdb680843da4f55c68a0042207eb

SHA-1:
a9b2e7a0b78c531d53cc37010c0c957f4ebd6802

SHA-256:
1ec03a69fd7eb192372ae186b4c7bf0889e6171ccd5e31dd62907ec88263391d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 12:18:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.TVRon.tvronnet.Installer.Meta (M)
16.4.23.0

File size:
4.1 MB (4,304,042 bytes)

Product version:
2.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:P9PgjmtohQm7gttXqRgCFzRUE88bOeUgJiNSfVOsarmC34cbV:YmSQmsfqRtRG8bhkNSfAsarmg

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 17 URLs.

http://ttb.0vin60f6.com/download/request/.../wTCNI6k5?__tc=1413663362.73&lpsl=29df93792fac627469e7580e1da5bcc0&expire=1413749761&PubID=276966&tgu_src_lp_domain=www.dwlultimatesoft.com&ClickID=14221338621413663360&fileName=Setup

http://www.fraps.com/.../setup.exe

http://ttb.getsoftwred.com/download/request/.../3QwRhcsb?__tc=1448104799.5&lpsl=8052068b4bc97e6c9a498d0e20dadf43&expire=1448191183&sid=Nzk0IzE2MjAjMTE5IzI5NjN8NzcwNzB8QVR8M3wxfHw&slp=www.newsoftin.com&PubID=525&fileName=Setup

http://www.k9pcfixer.com/downloadip_allcs_dcom.asp?utm_source=p9stnsec&utm_campaign=p9stnsec_glo7

http://dke.videoconverterdownloadfree.com/download/b115/.../setup.exe

http://ttb.myfiletor.com/download/request/.../1Zta1UVW?__tc=1448914208.433&lpsl=826364988ac3a565effe235bf993d2ff&expire=1449000596&PubID=198536&slp=www.ultifiletur.com&ClickID=14516279811448914195&fileName=Setup

http://software.installer-win.com/d/click/.../?uid=68a4c5623726f698cefb2dede07ac62d&sid=sid&filename=Setup

http://ttb.getsoftwred.com/download/request/.../9IIwciD0?__tc=1448206189.353&lpsl=03d8363b4f45633c60e5b83a7da45626&expire=1448292585&sid=ODAzIzE2MDMjMTI2IzIwMDR8NzY4NzJ8VUt8M3wxfHxiUSo&slp=www.newsoftin.com&PubID=300&fileName=Setup

http://ttb.2muqpf1ii3.com/download/request/.../CJzxGx39?__tc=1413489308.06&lpsl=45cfb39326f6b39a3ba57a9e7b6d6c23&expire=1413575691&PubID=261718&tgu_src_lp_domain=www.dwlsoftultimate.com&ClickID=u5e249ff8544021566f67874837&fileName=Setup

http://ttb.myfiletor.com/download/request/.../xb9onqTr?__tc=1449336937.667&lpsl=ef5e92b7c657e011a624edfdf64ea290&expire=1449423329&PubID=444464&slp=www.ultifiletur.com&ClickID=13807864181449336928&fileName=Setup

http://dke.videoconverterdownloadfree.com/download/b111/.../setup.exe

http://winrepairpro.com/download?pub_id=3007&sub_id=w6K2C3N3V7FFLF2QGRC8LBFO&srcid=84100fa8-2b08-4646-8924-02c4792b96c0

http://mysweetsoftware2.com/download/.../994?lpm_id=15&filename=setup.exe

http://static.tvron.net/setup.exe

http://az852137.vo.msecnd.net/MTIzNDU2Nzg5MDEyMzQ1NpxHwFKAOiKh6Fm0ZBWiiJti0w9Lxf5cHWpw694AMCoSnX-HGtrgd4hvWrVHlzGO229AvuU__XS7dS4o-EoZ5NZaHoTEMmVfmPm4ovCpVGCGSkjpgTQPtu133iU43vvV-o7SrEH7AqVe-gu9Mk9LdNrEdK122ypJmSGNiMOoxPklk8z5FmUfuuwUiEAanfCyocL7bSiMIRd2sXgtkxYwjD3dFaysxqKOryfCBT0yda0xgDhwt8d2-r6I2NihVk-vkaEV30TuaQbzf-Za6ezJ0He0uz5l6qW_Dg0Ogns9GxWJ6qxM3lclgxHCPneHm6_Qkljx56wYE7UKmk9_FziY7WRIw3aMBu5BepU-g4qkCd0AJID_ZDE93mRj2wMlbvFX673QVoGg3oKA-FU_CGqzc_S1dtueXLY4y-7W2J0d0Buem3lxfvuPDIFYhm4i3jEgeB2gJ8B2vovKjK27jvayBpk=

http://vpa.bot.nu/setup.exe

http://tvron.net/.../setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.