home

setup.exe

Prostoy.Ru Installer

Prostoy.Ru

This is a setup and installation application. The file has been seen being downloaded from all4os.ru.
Publisher:
Prostoy.Ru  (signed and verified)

Product:
Prostoy.Ru Installer

Description:
Программа установки Prostoy.Ru Агент

Version:
2.0.2.6

MD5:
14308d1de97d7d4890858bad41d30057

SHA-1:
ae8950f33583d7bcdbf68c9916213c7defa11747

SHA-256:
4683fd4daafa562db64d828d785c9081ca3a03fc180b0862dc275f31f9afa9e2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 9:37:48 PM UTC  (today)

File size:
113 MB (118,449,792 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Prostoy.Ru

Authority:
thawte, Inc.

Valid from:
7/27/2016 7:00:00 AM

Valid to:
8/6/2018 6:59:59 AM

Subject:
CN=Prostoy.Ru, O=Prostoy.Ru, L=Moscow, S=Moscow, C=RU

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
4898152F0A8CEB7D94BB8E25B3C028FB

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
1572864:WjFswc1AMo4fiWC/Zd0n9AzpR3yyeLczr4AhCTeAFB+KgVSn794+5C//9ifPtvk5:QswduSFTeLfeVVk7yMq1wvk/mzgTQw

Entry address:
0x1D9590

Entry point:
55, 8B, EC, B9, 06, 00, 00, 00, 6A, 00, 6A, 00, 49, 75, F9, 51, 53, B8, 60, 8D, 5D, 00, E8, 65, D9, E2, FF, 33, C0, 55, 68, 14, 98, 5D, 00, 64, FF, 30, 64, 89, 20, E8, AE, 20, E3, FF, 83, C4, F8, DD, 1C, 24, 9B, 8D, 55, E8, B8, 2C, 98, 5D, 00, E8, 16, 2D, E3, FF, 8B, 4D, E8, 8D, 45, EC, BA, 48, 98, 5D, 00, E8, 06, B8, E2, FF, 8B, 45, EC, E8, AE, 96, FF, FF, A1, 64, 44, 5E, 00, 8B, 00, E8, 42, AE, EA, FF, A1, 64, 44, 5E, 00, 8B, 00, BA, 64, 98, 5D, 00, E8, 29, AA, EA, FF, 8B, 0D, 84, 42, 5E, 00, A1, 64, 44...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
1.8 MB (1,936,384 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://all4os.ru/.../go.php?url=aHR0cDovL3d3dy5wcm9zdG95LnJ1L3NldHVwLmV4ZQ==

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.