home

Setup.exe

Software

OOO Profit Adverts

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The file Setup.exe, “Software Setup ” by OOO Profit Adverts has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. This downloadble file is typically blocked through Google's Safe Browsing technology in Chrome web browser.
Publisher:
Software Web App   (signed by OOO Profit Adverts)

Product:
Software

Description:
Software Setup

Version:
5.2.5.0

MD5:
402aaa2b176b57384f8253ad0643f754

SHA-1:
bb93bd8978599bf8707a4c917dfbfc109dabb7ad

SHA-256:
9468ffef4a72e044e869249c85e54eb45b1e7df6ced60cbb253fa34032d5a8ac

Scanner detections:
9 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 10:07:54 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
PUA/InstallCore.IH
8.3.1.6

avast!
Malware-gen
150531-1

AVG
Generic
2016.0.3092

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.InstallCore.508
9.0.1.05190

ESET NOD32
Win32/InstallCore.ZC potentially unwanted application
7.0.302.0

K7 AntiVirus
Adware
13.204.16089

Reason Heuristics
PUP.installCore.Installer
15.6.1.3

VIPRE Antivirus
Threat.4150696
40552

File size:
811.3 KB (830,768 bytes)

Product version:
5.1.9

Copyright:
Application

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
OOO Profit Adverts

Authority:
COMODO CA Limited

Valid from:
1/24/2015 11:00:00 AM

Valid to:
1/25/2016 10:59:59 AM

Subject:
CN=OOO Profit Adverts, O=OOO Profit Adverts, STREET=Ulitsa Yurowski 92, L=Moscow, S=Moscow, PostalCode=125466, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
03BC4EC26FF816435D336E5F56EC711A

File PE Metadata
Compilation timestamp:
6/20/1992 8:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yvEIAVk1gnVUmNbiARCtQsJd2sVOx/3jHXSriCl:ycvUw0pJdQx/zSriCl

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8187

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.