» setup.exe
Overview
Analysis
File Details
Downloads (9)

setup.exe

Rutubo

AVSoftware Ltd

The application setup.exe, “Rutubo Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.contentuniverseflash.com and multiple other hosts.

File name:

setup.exe

Publisher:

Dom (signed by AVSoftware Ltd)

Product:

Rutubo

Description:

Rutubo Setup

Version:

5.0.2.1

MD5:

84e9dc1681d74b756aba70b97819a6ed

SHA-1:

ca2d0e31a013a5419a8ab30bff8e0659fe3aec02

SHA-256:

120707b74e5acccbf7711bdaacdb5a488d7c30f88d833ae728e4b6944aa9199d

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

11/5/2024 1:41:31 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.AVSoftwa.Installer (M)

16.6.12.20

File size:

968.8 KB (992,064 bytes)

Product version:

2.3.8

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Digital Signature

Signed by:

AVSoftware Ltd

Authority:

GlobalSign nv-sa

Valid from:

12/31/2015 9:55:52 AM

Valid to:

12/31/2016 9:55:52 AM

Subject:

CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112134814B6C56AF7047C195AE1D737EC185

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:06WsEh1GXeQO2Our4MkO6H12ro8JG8Gf5l1nRobv:Vch10ZO2OuUu6H0rowyfD0

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9332

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 9 URLs.

http://www.contentuniverseflash.com/c?x=xwPYuXxLEHD3gFooq9AUOBDtd9Dua lQuTPh0I0Wyco=&c=iROU/kaCWbsvVQmMAEhdU4U/p3nuB/QbVFphqShlwjixE1qJRz6Z3qFKKKRM/1Y/gUmj/Qazu28HMC Oz40EuCDuRp3osL2h8d7jzhj4pmCNWbrkmSXcYGpSDE8h yIA&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funcentralbody.com/c?x=0aG6jcmihQPeHPjES9/JkvpS2OhNcH8RP1wyXln7DS4=&c=xL8nAbMxde4he4bZoOi00pJ5B 422EN6LGmSLHuVwpM1WrnvWatxIKX968jZdOd0BQfdIfbTBHmw0oi/S43SYuvDg2PkBKRkG0TKofW2YGjsKh VYwuGld2cBtwzY3/L&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.currenttourstoday.com/c?x=E9NTSZsdqnWoyxWSD8AnCAXaqSTGMCWdlZpdGxNNh7M=&c=CAeMD6/14x/VtF0fSlBONK1HmdSdaSVQaUNERwyFe69dcYaq0aLA15GhWJDQe/STrEtoj3QSUBjT jXlNf3xwBCp1OgCVAutDD03pGTO0noHOd/Jkokdi6UpjYq cSeM&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.currenttourstoday.com/c?x=w6JnXM8E87cfL0Ydhpa/NoSuEC2g4Vo6mJuWGzG4HEw=&c=GQ1i75BTQYZSfPSss8OZHbNi0hqEUziBslXDDy8d159sLn9rJ3VzHM7jDChVFeCPHovyP5WIsnv/NLu4 Cyb lvD/GxhnvhUI p05PSDV1 T4He8GGgVDdFWM2Cg0d3c&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.tourstagbundle.com/c?x=9LQWNd1ElQ80Jpv/iHBaTNY/C95VyKSaX/NJTkg57Mk=&c=eTTz3epzWDCEaBdW5ZGG1znB4F5GUgRFPOhd Md50fkPADWcZ0bchd6n2QDz2OurdyxntmqcDZann0PS962 KhY4hFIchkR/nlTYraKEXhIC VZJepNGjteVlDtIz36p&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.stockappcontent.com/c?x=t6OU pfjdNCl265jc5ZFXKlKzDQpNTOYT5/XpZiu d4=&c=txlQ38EkdlsLVBLVoSiRAq320tx1gDzIENR7tMLj3Vpz090IHtrEhOTGbcTsTx8SggNef/lVbU/qOvnk7Ujhflfe443cWBqufttTRy8kKk6jkwdI9gup pCHBy4GN6es&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.metaappgift.com/c?x=pWCS8yGadclGmCgLNNI7bFYh4spr2EOwluxAewO5VM0=&c=n6oKgpOp9KSsvZ06IGP2Wt3pRUiITmUImM0ZBtarTvWjb/L5MK sQQdrlhbcbjA9QuTlmcb6/IAQvk3JQMg 2ltPIJpoXOrbepchyvNTl0gy PY y5ETVdiJOr2SohT &downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorytourslaboratory.com/c?x=rUCBt LpQLEMEm0bErQ8jPUupA4pzYMS89w4RPwOHbs=&c=F24PeA5QPnfbHLS3ruu//s8v4v4k1c8mRG1MUMlgeJwGSVfFZaZpM7N5TraD925k7Iiz1KAas43SCnz6WQv baeocvqMlvB4UkyL3JpENJr95TFR2AI2hEVIp c2nDIa&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.signbitsfun.com/c?x=e64TaRKrqyth8qRdI6KauaDdZfJ0IU015ncYxLcZaqE=&c=oDAF7tD4gbS to2vHvdNkbXy65wsRVQdAOpj/1Y0An4kg/zWJAcOnZLQckRDDzcwIyt219gBAP34639t47NkMvvZQke/5N5RBbe3Gff36AJgeArBOSxjAXsDscuuHgAt&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.