» setup.exe
Overview
Analysis
File Details
Downloads (12)

setup.exe

Rutubo

AVSoftware Ltd

The application setup.exe, “Rutubo Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.megaheartranch.com and multiple other hosts.

File name:

setup.exe

Publisher:

Dom (signed by AVSoftware Ltd)

Product:

Rutubo

Description:

Rutubo Setup

Version:

5.0.2.1

MD5:

b1c79041293eb71f169bab11b8264e40

SHA-1:

c2a102a1d7560139b75a950a321539009d0d8ee3

SHA-256:

e4f403a93816372264ed16121aa0228277edee61d99d71cd2a828b6fc5ce2458

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/5/2024 1:44:01 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.AVSoftwa.Installer (M)

16.5.12.8

File size:

968.8 KB (992,064 bytes)

Product version:

2.3.8

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature

Signed by:

AVSoftware Ltd

Authority:

GlobalSign nv-sa

Valid from:

12/31/2015 9:55:52 AM

Valid to:

12/31/2016 9:55:52 AM

Subject:

CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112134814B6C56AF7047C195AE1D737EC185

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:o6WsEh1GXeQO2Our4MkO6H12ro8JG8Gf5l1nRobv:hch10ZO2OuUu6H0rowyfD0

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9332

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 12 URLs.

http://www.megaheartranch.com/c?x=AzauQ6ZuibiQHGZ1OosZ8954kPHU67k92YPh /PHU2g=&c=0hv/7qKwrhRMp0lSPJjxoKdX VDP8Cbl0YlwD4cOVd7VZ73dOZmSBDBCHi9b40e0NNMbd7Has 196gAFklPeyigaeREcEX0E2OyGYiPDeMbFd1wVTeiugYCEcKwt0U8T&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.tourstagbundle.com/c?x=GDG/2/mDXZ4PPubF1M 3ncdr3lRGaTwsV4U5/ph7n04=&c=I088AYdMwdGBwcfpoOnfL 5v3IJjxqgMMNjDOBuefo9Wo5 QAgh8K/FqYfq/mtZXgXKI4VPZYD53l9KuET0v Sc4iK EqxFKKCvlFvAXEqyEjw5RKd/sYXyo0Y3J3Mj&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorytourslaboratory.com/c?x=J1fgcq/xDtwhi6v3eQATAUMK8eeAgD1wlS0TNoWhg E=&c=z1xZEtHZztFI21XCO0e8KmYWemrc3q0NJ0/j0wqHvgiDv9zhf74F1UMTcrOKjrBX9oYMgiCm3LLuaY2jbHRdISJpQrHhc dbk556d tx3hGa2dlr3k0tv xcaMUY mmJ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationstowerssafe.com/c?x=/ ZU5eTurjbQOc/w38xoM8aLjedzFxVCnNXK/aVVo90=&c=fVO7mC9F2bS75xn73a6ABqoNDYgyhjeFp2Z2cyUy5x qLM2le1EeooWS1AKtL9vepGbDhvcwA6g5u7eGUjiEStJPNrIcl fppr5uHsOknx375CklHKhBCljK29Ll0Kql&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.updatetownpackage.com/c?x=ceYAbeajLI5TCngopKeeexW dq6vgmzAMFwoHg3lF o=&c=adcaerjSSRj1VOziWyOAStS4j4Lu0iZbp1bj6ROUeD8KPdLdPZL5mt3IXACRlH26pl25BlvAfWNjcstmSUdfnhY/Smi5kzoENWVI0MAL99DipEErlF0y4ANXGc4WDfCz&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositorysignsend.com/c?x=lgTxZ7plglae8n95gQi9GEFvUnxRdrUn57qVkUUdX04=&c=1sf/XQMaFOWeMhvpX1JqeAIq/5wfMq9hoyl8umjMdROaj6PdjnY4xu3qp/pIn8mUTHCM3A846kgxHfXlJD2x2xj0gEwKbV y3vv5qPu sAaRY76pUJfQoDsudTgAFUe0&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.signbitsfun.com/c?x=WMBsIX0AAYXOR6YWtUXVttlwpxrYdOdZgcibHagScbQ=&c=jX4hgy9IT1euycQ8lAgOoT6nVwUS70VsDmlx1ujpgcaRAPsqAm/Yh2O44onjzuCps0kMWTa4XUQ1fG/68tB4JGwb2Y5zYFdlEi8PI7iu6MoG1sKY6IQKaxr1J5A SchX&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.updatetownpackage.com/c?x=0ib3e8yflwFyt4NVxWGgUJaGyQlLHhKq4utZfs zJis=&c=IEpmhHtMajI jmXTmmgniVQk3WGM3wnecJpjIonqUHlFtmO0DFn62xKpB0twSC7TmA6eX7aAIXV5T67nv4N1nQdJIfSZVjX3Z0OOMATXONXmjnyXTLN6f13Pk3tpjloA&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationfilesclear.com/c?x=uT4KGoi9bboSoAZVOHLjnUeRCumDgxXnHynPDYv2MQU=&c=e cNffOHmk7Uc/60IsoJxOqzA1r5y1sT2UFbpRNlxfMI90yDeEj5hvAKl3QZ5vTAdTZu7PBZnbGrhUyCI5J60BYhgQbWYFtllTJV1VGE/mS2ENEihCx1dC2oKsY 8tDU&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorygiftapplications.com/c?x=7voD7bEbuky9o2A/GRDM2ewPqg2iPvywbtfbXXPBpn0=&c=JusqMBARI2C1ZJ0rvkGbrmJAsqUgk0L8t j2MHaMMQvkepbxIjEKzh SzgMySxmSA8TVYfYiuy SqzlR8xZcl4mC5O9qTAtj4fVMwj1XCzq/6rphVIcR7vYpZj5hx eh&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.updatetownpackage.com/c?x=JXFInvuY27gNZTfvS25ZckPAiRTp3REvRDJQtKk80MM=&c=t60QmiWJnEJKe4TC8hYuF8 VCjwZTSjv5jbe9ZuEGWKfXj1zu3iNNG4XCIvfWUDAvDIT1Lcvz7vKrIhv0gOPbxBejh/xXSfgLDQ1spBtNj8pkJcfhu6HVhqagerZxTSh&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bitsapplicationssign.com/c?x=oHiwGSZ8qsfmPt8I0XwFMpb1Sc0S4NywzGLHpx8y PA=&c=gEQdxP5b4SrIDqSD4IqCmF7yh6AwGEYNnbBAtTFmeBuKj6/SNELrSRZktOWNmGktObCKb 9npSEyZ9Syg1BND/r6mPcfvLyONlTfk3c8h3j2Hrwrlf 8TAPkLQ5ns8um&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.