home

setup.exe

Octoshape Streaming Services

Octoshape ApS

The application setup.exe, “Octoshape installerwincode” by Octoshape ApS has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from software.softwaare.net and multiple other hosts.
Publisher:
Octoshape ApS  (signed and verified)

Product:
Octoshape Streaming Services

Description:
Octoshape installerwincode

Version:
1410310@v326

MD5:
f8bb3d9eb748002622f8c06d25c6bef3

SHA-1:
b8eb616ec2343e0f79788d8b9ff703c11f9d0f94

SHA-256:
f765c9f93d455678614466f6d3762b44c2f984cf380bec6e619598989580995c

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/25/2024 8:19:23 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallX.Bundle
16.3.1.10

File size:
839.8 KB (859,952 bytes)

Product version:
20141031T1322

Copyright:
(C) 2014 Octoshape ApS

Original file name:
installerwincode-1410310@v326.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Octoshape ApS

Authority:
VeriSign, Inc.

Valid from:
12/17/2013 5:30:00 AM

Valid to:
1/15/2017 5:29:59 AM

Subject:
CN=Octoshape ApS, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Octoshape ApS, L=Copenhagen East, S=Copenhagen East, C=DK

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4D33E7DC614F8778A8923159D5AF4E50

File PE Metadata
Compilation timestamp:
10/31/2014 6:52:27 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:/dKcMajvNGHSzP6RksH9b7/uklXTZOhUtpcJBZVuov:/dVMajVGyj6RksHF73lDZOhUtpmZVr

Entry address:
0x1EA380

Entry point:
60, BE, 00, 10, 52, 00, 8D, BE, 00, 00, EE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.8211

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
808 KB (827,392 bytes)

The file setup.exe has been seen being distributed by the following 32 URLs.

http://software.softwaare.net/d/click/.../?uid=eb46e20d29044412573a8973ce99797e&sid=sid&filename=Setup

https://d2iwzbhgddzdwl.cloudfront.net/resources/asosa/.../OctoSetup.exe

http://ads.adk2.com/event/click/0/RDOTmJTJP4oXPcLjwOj_PWZ9ofqdpvU2BY-ynHBFfd8KpPww12IFx4aZ05PksvmCZPljYERdkfu86VBFUJuJkUfN41mGDwposomYIGhotk30BPnAu_ZDIjhtAMB6Ne0u-gz5OP8HFYyDo18Q21CyBXWMTu6AQDl-jUHpQM5_eAS1b-jMmIBlpkR5m03PaBT8OAOzSkZ-eGCx0XS21lDDjMT8F0Z3jZJdpjO2Llx6ZjoOn5uFGypTt_Q9VFaqiQn5ttMCpYNeVeYcOSakt8DG-EE-YRKDAw5LqZqMCUuMZa-LsW2ZPGC9oGTUEBMga73jGFeO_vQZQc4KtevluhqemIZFQacSelBSdG2Um8vbOs4KJkSU2CO-rgEt2L32Qx5YjuYqEoSYrNpL5CWgy5xEktlm-TrXqdPFBSau/.../

http://download.epubreader.info/download.php

http://127.0.0.1:37848/continue?TiCredToken=9875&Source=WTP&URL=http://cdn.downloadcocky.com/.../setup.exe

http://www.download-servers.com/.../dl.php?r=3_vu

http://get.default-page.com/.../Get?p=3022&d=3509&l=1694&n=0&d1=1&clickid=Z2dXVpZD0zMjE2ZmU5Mi1jZTNhLTQ5M2YtOTU2OS1mMTI2ZDE5MjQ2MWE

http://www.lpcloudbox328.com/.../Setup.exe

http://downloadinator.com/Download?lpm_id=9

http://safedownloadsrus104.com/Download?lpm_id=24

http://cdn.downloadcoals.com/.../setup.exe

http://newupdateneeded.com/Download?lpm_id=13&filename=setup.exe

http://cdn.octoshape.net/resources/asosa/.../OctoSetup.exe

http://secure.11-pn-installer.com/o/.../Setup.exe

http://www.softwcdf.com/down/flash/.../down.php?sid=247&dv1=ad241-gb&kw1=ad241-gb-qyc&uuid=d8fcb633-2b55-4f97-467c-e7682da1307c&dv3=d8fcb633-2b55-4f97-467c-e7682da1307c

http://ttb.lpmxp2188.com/download/request/.../xb9onqTr?__tc=1411534173.3&lpsl=2f29182b9cadaf9b1187dafb318d92be&expire=1411620574&PubID=263963&tgu_src_lp_domain=www.prosoftlst.com&ClickID=31513736231411534173&fileName=Setup

http://go.combosoftwarelists.com/d/click/.../?sid=62&uid=50890894575933904&filename=Setup

http://ttb.v70r2pbr.com/download/request/.../YxwkQON0?__tc=1415563217.912&lpsl=7db765c9507973f407f32c0037e9bae2&expire=1415649609&PubID=sunrise&ae=sun&tgu_src_lp_domain=www.ddallsoft.com&aff_sub=30ca4c3518a4b7812fc1cb865932b7d7ef1222cc&pid=&fileName=Setup

http://files.getsoftfree.com/get/click/.../?uid=Z5dXVpZD01NDAzZGY2Ni05YjJmLTQwMGYtYWNkZS05ZDFiZTRmZjc5OWM&sid=XX&filename=setup

http://secure.11-pn-installer.com/o/.../setup.exe

http://d2iwzbhgddzdwl.cloudfront.net/resources/asosa/.../OctoSetup.exe

http://cdn.downloadcoats.com/.../setup.exe

https://d2iwzbhgddzdwl.cloudfront.net/resources/autolaunchers/.../OctoSetup.exe

http://www.fraps.com/.../setup.exe

http://d2iwzbhgddzdwl.cloudfront.net/resources/autolaunchers/.../OctoSetup.exe

http://downloads.rosettastone.com/.../Setup.exe

https://d2iwzbhgddzdwl.cloudfront.net/resources/autolaunchers/.../Setup.exe

http://www.download-servers.com/.../dl.php?r=3_vu&rr=2

http://d2iwzbhgddzdwl.cloudfront.net/resources/autolaunchers/.../Setup.exe

http://filehippo.com/download/file/.../

Latest 30 of 32 download URLs

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.