home

setup.exe

Nela

Sambamedia llc

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe, “Nela Setup ” by Sambamedia llc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer. The file has been seen being downloaded from www.filesn42.com.
Publisher:
Sambamedia llc  (signed and verified)

Product:
Nela

Description:
Nela Setup

Version:
1.4.5.8

MD5:
d452ce0d9cd6a7ac1c01b1f464bb5333

SHA-1:
aa93e3ec9b326739fa8cae377cbf077f0ac27e75

SHA-256:
09d66ca21f402201b08aabc029ed16f74ec95995970b4bed0ebe212aa7c52140

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/14/2024 9:17:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.9.20

File size:
933.8 KB (956,216 bytes)

Product version:
5.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\setup.exe

Digital Signature
Signed by:
Sambamedia llc

Authority:
thawte, Inc.

Valid from:
12/20/2015 10:00:00 PM

Valid to:
1/19/2017 9:59:59 PM

Subject:
CN=Sambamedia llc, O=Sambamedia llc, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
08AF0B7DB5193EDC6FFE31467E46AA55

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:WE8lsGLqcIyhNnqwd3z8W70T3SdJokGA557BjwAc90GU:WEIfLqcIyPnbRhpJR/557BUAc9U

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://www.filesn42.com/MH FZAds0 UXOgl_uTDV9afDTs7kAAO9WDPmsNONlXlSgQlm49fXERoSIZhMik lQCHHNyRf7rkaPCKoY77dOcGyRl9XgsIZfao2M4A5xLUgSddiW8hU ZQFlYOlnXhY3y0FLdQ4Bgd9JES9TEfxomTjHtDPmIDj7HwlczflVya_iZSsw BwJqRnEVuvGCwCcU6wD VDZVB6fN0ikWi1Ik5MeYx3k1LMXnHmnMzLDnTLsNuD T3q8OHx4PHrBzm9OroQvzXw6M9nxigVbhkyvc6DVd3LvkrvJiLTibmq0gEpjJun9DvVGkLqcedv4droCXR4 yJ1A7fl7e5sshsNR_aF4ZM5pKoX4fRPueHe_XZ13DDrv8jyjFvZ4NTwI4VHidBjns_ySklQtHg_5qXEb_2JhcXLbhxSy3Tfa35w8ykYCim6RMp1mnPJeuK8AxWoCkyXSxh33alaQ hskqD3eLVkQ7ZyrlI6Slym6moHN_oIJxc6dSIf1 upl0W59h7VFgk9d4XyvxqF 61RwIZ8a1W8zYE7NxpgCYvAU84qj1cw6Udqu4qi44HQ_0h7a7Thm2HpxLui-iwSAMTcyLjE3LjAuMQM=

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.