home

setup.exe

The executable setup.exe has been detected as malware by 33 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from www.moozybox.com and multiple other hosts.
MD5:
1f5dc9a6cdf1bcd4c22b9c353eb19989

SHA-1:
cc44abd1d333266d86ecff11681ca9d2d6c6a0bf

SHA-256:
d1bebfb83b0a057f1ead8c6b8ec587eb52c5a30d0063d4996a50b5e7dd779e42

Scanner detections:
33 / 68

Status:
Malware

Analysis date:
11/5/2024 6:33:23 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.377605
317

Agnitum Outpost
Trojan.PWS.Fareit
7.1.1

AhnLab V3 Security
Trojan/Win32.Fareit
2014.08.14

Avira AntiVirus
TR/Crypt.ZPACK.75645
7.11.166.236

avast!
Win32:Inject-BID [Trj]
2014.9-160323

AVG
Inject2
2017.0.2795

Baidu Antivirus
Trojan.Win32.InfoStealer
4.0.3.16323

Bitdefender
Gen:Variant.Kazy.377605
1.0.20.415

Bkav FE
W32.VobfusXiearvZ.Trojan
1.3.0.4959

Comodo Security
TrojWare.Win32.Injector.OWLP
19174

Dr.Web
Trojan.PWS.Stealer.1932
9.0.1.083

Emsisoft Anti-Malware
Gen:Variant.Kazy.377605
8.16.03.23.01

ESET NOD32
Win32/Injector.BDGC (variant)
10.10248

Fortinet FortiGate
W32/Injector.BDEI!tr
3/23/2016

F-Prot
W32/Trojan2.OEAE
v6.4.7.1.166

F-Secure
Gen:Variant.Kazy.377605
11.2016-23-03_4

G Data
Gen:Variant.Kazy.377605
16.3.24

IKARUS anti.virus
Trojan.Injector
t3scan.1.6.1.0

K7 AntiVirus
Riskware
13.183.13043

Kaspersky
Trojan-PSW.Win32.Fareit
14.0.0.472

Malwarebytes
Trojan.Downloader.Upatre
v2016.03.23.01

McAfee
RDN/Generic PWS.y!zk
5600.6451

Microsoft Security Essentials
PWS:Win32/Fareit
1.10802

MicroWorld eScan
Gen:Variant.Kazy.377605
17.0.0.249

NANO AntiVirus
Trojan.Win32.Inject.cxjjsw
0.28.2.61519

Panda Antivirus
Trj/Genetic.gen
16.03.23.01

Qihoo 360 Security
HEUR/Malware.QVM19.Gen
1.0.0.1015

Quick Heal
TrojanDownloader.Upatre.A4
3.16.14.00

Sophos
Troj/Zbot-IGQ
4.98

Trend Micro House Call
TROJ_GEN.F0CBOC0FI14
7.2.83

Trend Micro
TROJ_GEN.F0CBOC0FI14
10.465.23

Vba32 AntiVirus
Backdoor.Napolar
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
32176

File size:
104 KB (106,496 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
5/1/2014 3:34:28 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:zeLlZzHT4uaFK4G5zNP9VfSYqXx2X/xlkr6QLLRQlpm69j//XIVjzvDqBd:zW4uaA9zV9dSYGAJqeQHRQu698VjzOBd

Entry address:
0x3671

Entry point:
55, 8B, EC, 89, 1D, F0, 60, 40, 00, BB, F2, 60, 40, 00, EB, 45, 90, 8D, 05, 00, 61, 40, 00, D1, E8, F6, DB, 89, 0D, 10, 61, 40, 00, 1B, DB, 83, E3, F2, 81, C3, 10, 01, 00, 00, 66, 89, 1D, 20, 61, 40, 00, 90, D3, 1D, 30, 61, 40, 00, 41, 00, F7, 90, 41, 00, 0D, 40, 61, 40, 00, 90, 41, 00, 3D, 50, 61, 40, 00, 90, B9, 60, 61, 40, 00, 00, FF, B8, 23, 60, 40, 00, 41, 00, D3, 90, 41, 00, D3, B9, FE, FF, FF, FF, B9, 60, 61, 40, 00, 56, 8B, D8, 57, 36, 8B, 78, 08, 90, 90, 40, 40, 6B, C0, 28, 3D, C8, 00, 00, 00, 7E...
 
[+]

Entropy:
7.2495

Developed / compiled with:
Microsoft Visual C++

Code size:
12 KB (12,288 bytes)

The file setup.exe has been seen being distributed by the following 2 URLs.

http://www.moozybox.com/download.php?a=49&tid=4001

http://www.google.co.id/setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.