home

setup.exe

Rutubo

AVSoftware Ltd

The application setup.exe, “Rutubo Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.downloadsoftwaretower.com and multiple other hosts.
Publisher:
Dom   (signed by AVSoftware Ltd)

Product:
Rutubo

Description:
Rutubo Setup

Version:
5.0.2.1

MD5:
a1be699d68770db134af5bc97d107d22

SHA-1:
cff1f8b5dcdd702d9ecb8ca1b951bbcd50c0841a

SHA-256:
ae7567c5758fa648b833a82570554f928fabdfbf269650066b35e033d74fc7ad

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/5/2024 1:55:52 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftwa.Installer (M)
16.5.18.13

File size:
968.8 KB (992,064 bytes)

Product version:
2.3.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\programs\setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 6:55:52 AM

Valid to:
12/31/2016 6:55:52 AM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:r6WsEh1GXeQO2Our4MkO6H12ro8JG8Gf5l1nRobv:2ch10ZO2OuUu6H0rowyfD0

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9332

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 36 URLs.

http://www.downloadsoftwaretower.com/c?x=E9YMZBPw4UoPcbu4zmOvUhrB9oz XeuR6LVNc5lgWc0=&c=5G55Vex6Dj4wCSrGw68FyWvpdPcWkrB7/TrK6zJraijzlSxJakA4ajkkk0n80ksspM8dskJa m3/J6f2/WtvOeoDKriDLPPl6vARurafJ7Wd3oGb10NNJXn8JdBqfjNa&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadsoftwaretower.com/c?x=UE28m IB7IATD9kx5eKismK2S3QXSjV6bIAmWtRH2J0=&c=dAUvzdTh u5pGHQDQ3wn6YJjxjr4vsYbuQZ3MLK7WEipNnnccIyaoFYK8ftbUc73KZybrGZuhVgSbu5U3fZyYohmPTvkqIZ1KSzkEu3xuIkEk5mG dSLQn2jZxuRtAlJ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorygiftapplications.com/c?x=roV HAU nAtrurKmwpwWKSd09qhF y09VCjgl 9w654=&c=kYu3dHVKtlA5Bn2JYPK/YQWSsKxl6fGQLzE4iAW7afMwwH/WfuHnQkg2uXLCzD/G QqcD32YyLHnILNY0tqJEEMfrW8O08 Y/MELzpL1AAXyQM0IDBa0Q//QMxoZ9zpo&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=wJST8pwyqSx Tbt9eO1xKuPDDOrbFwuZfymKiACf/ZY=&c=S6dFkoBs5HnSqeWNLF1dbGlDwT7WgOnq1pi/TTqz7QSfT53rdCIlfH6zIhbXO9mjrKj2b0EO1fMHhNzJYu8Xv2eHdfhiPoEDAGArGhHAAmHKX5lm7yuNqIKY4m1yPHPv&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://ttb.i49yobh3s.com/download/request/.../ABbApjzh?__tc=1421089568.08&lpsl=75d156e529891d81ba23e42ca462584e&expire=1421175961&vurl=6644&dp=-_-ZDZkMl8xNzNfMzM4NV8zNDI0X0JSXzE3Ny4yMDUuMzAuMjQzX2YxNV81NzYzX0FEUw-_-ADSYS-0b94bca0-9a8e-11e4-b74e-e5f4194093a9&slp=www.newxsofter.com&fileName=Setup

http://www.repositorysignsend.com/c?x=hI0o7QSropR4Tkm7TDelE1I6qK3NyjumJZfIXl0eOmY=&c=tV9lD3aY1svpcVC1yeewiLIpJ/2TMfXqeWS//aVeNScxcULqg44AS4lU9HASXua0rDBwlLIWCt lUXMcccjEPlbzRt zSklnOUk/Z0u5yvJlQ07QSAijAXZNavjX9Bti&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=blAXpuNFUaVOUcg5NRBHN4mPVcSGzWS 2tn9dn4TQt8=&c= 3a131u7cP94Dmb2CMW2EGzJNMaqXYFJiM7FvEchoz1yMWftiI2cG54QkMhofS82WIs8EVdVI moxHozCes5FsKMktP UbxKHhTlriRxULW x//aPfV1EL9Xw9tlxUlw&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadsoftwaretower.com/c?x=GXRlwyNrNneYC4mB5ocAwcamIuNE5ppMFljuzN0irVc=&c=h4Ih1/TLQwi8hUmx5pgQjUR7IaJ7oaFgc8p7J vy8zkfsOEX0yW6cyPnpDfbOYuv/cR/FgD3fiHO3hBUchg4zjta5YORDSj1CvUh3Ci3MHrTow0dZL04 VE WQfqYVDU&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositorysignsend.com/c?x=LInHNfgLJvLmjHX6gj5ktEdmsPFaL1dXM0TMAEiFZjI=&c=u5pRev9R86MXwuIKx6z5JfvziV GBOPD8dsKTRnFB3B8UMfy1bHSJSAqfv29yA7Hyx/YmwtSd KXapLChEM4JO7J32DoWI4d41w6d3w55n8O835yyV66dxAfagTJU4uS&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositorysignsend.com/c?x=kpGFkwJDcOh6K LHTmeSzRf2DxtNRgNjJSNRSOjJ 7M=&c=XCNgNyAZ3zLdMcgphQaRsHvlS57ksArn7MmN4 ZTS1C1PAStBMqu3YdorLXy7fF/xx5tS6OgiCGMSxpUyQXbEEatFNY024T1c7hWqsQE/epotItjHQvn/Gzj4tCYk0GK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationstowerssafe.com/c?x=zRUWz4IxE2enELDGz0L zYSK57VzBK7naJf7W68It0A=&c=AEtpkaGF9au3emQPvxmiWxord1uBdrtpM usCqntvfSCS6OPP8cDVZRvuc4c/ZOVdMEYj5UG4JUh70AIlrtJEx7eZLBvWSZp9nDYw1L03pwIJaUIiKZUmCkDLKPF/oCQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.packagelaboratorypresent.com/c?x=6uvhk/iGfTO/A0aDp1rF2iu2y80C/Mcor4OKb5FT07I=&c=KnL/xTgjXpzAg3nzNpw5f327SzJTqZXUei22nuK5/UFNBHk X8LIq cViOO7r94v3XBgmyU71kx uNngANRaZiBsfOUBxm6JlyZmsdAjHFir7BtCOnxEQm60EO4ES43B&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositorysignsend.com/c?x=qqNEshcpuERmZ33RbiNL4wubrrhk Ut8NCz26evRKi4=&c=umuRT/sEsk5Zgp6jxbQBXJznlCsY/VkX w126joYpiCuWnQtxx3H9lVevbrCRrpiHd245k3JsEKE9QA2dYyQ1kRujdT5Jw6M drrTV4K3WLQ2HtnYQKcmo6sjt/RGanO&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://files.downloadnow.com/s/software/13/93/78/.../setup.exe

http://www.vaultsapplicationstown.com/c?x=/b4NZk61XaB6pidPb41SEGs0tNHHVgCfgwsd8I3CmDk=&c=FNZW/qPojvkXO1wedjip3ZpYCn5WVMK77rgbMrSKvy5nOAQGnD178WNo3SNHew1Bv7IihppPi1Eony6nGkGNhrMJ7gJ40DL2OCTGlRFN8L8JriZfdG8f2xI8FvpgjdUG&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=xHygeHbpQVSoeMpT2VcBNR/rhBg3otOq4a9HX36DKw0=&c=0e84hS3zyt0ujU66HuvtwdryIqdeZ3ilfeE8lGweN8dwMvgi26iGBtVWTszAzn meWM0x3QDqzGIfa vxIZWNigdqV8WFlWqVC2aMoXuOoer xaDKTlVjEfsz7i5sAn5&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.packagelaboratorypresent.com/c?x=tTZA3P9eLxQeZLDyq65l9Nwq0BXeJ4oSaNZbVgZJljo=&c=a7T vy1XqjT5yPv n//xtNuPULHaSEFsN007IuA9TDEfe2/aiVMQRSofGhHKJj YSPIaXmytbIzVwrK4nGw051vCsttb4TdkhyOCpoMOY3EySi8B5HeX4Ds92rX6KPDA&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.packagelaboratorypresent.com/c?x=3d7T5CpbU8FvTXM4qHgrPRfS w5jM2hTxmfZJZ41hio=&c=zabo3qlzNjRbeky2SbutCz70eFZN0R6jOwrpPIq5EnVEuyYwhB7k58Y1u1g7Va/5fAEgQfdeNwVOx4aoeF2Nv3tXvx2kf/PxJaufRW2cxSMb8OGf3bOW4Nj3i8eKubiK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationstowerssafe.com/c?x=5V wL3pvAckWY8mJTini0CtdkpJNfvcvJPqYbU2b/Xc=&c=TLuT/1m/xdIYjwrt5aWNFdGExZLhppswfBOAHHeIRyLk8FZm05RzeBgQ8Ds35iOFUh9Tjc3VnCnkHFrdDuHr7/cBLHfxZ9276yR99yTxoXYjhtP72nu/ctVSvf32ISzQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositorysignsend.com/c?x=/dtQE xyGseeUqUQyillh6DrtI5bD9j5kcBVTwZPSOM=&c=b7qzu93ODNjy/Ce13ZZN3OVxAg7o9YcOyJpOgZSGE39AhkZyt5HoLy0RW9RZxYu npALD5ql8n u4wMV1RNtrlCL2oPZ3w4OSybZN AWvuvPXwjhzEFytQqfvkaAwxlw&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.laboratorygiftapplications.com/c?x=Bp8IglkbLlOJwoGA7HKvelgiD29LxKKEMwh0nyW0ij0=&c=9dqIAyqgCQ93K6jFmYzffT0XNeMKDcYqXpZhFRwtPu7hRgBOq53XR1D5rQGv1nwh0Stfg9Pbr5hgxY4m4k0x 8rI8fw6k6jZSd4uAGi8rErJwROtR67xo8UGVI06qB5Z&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.repositorysignsend.com/c?x=Z gkdpMM254HU SAs/0c/aRBlhnD9iBH5KQB8sBbTPQ=&c=8zvFZZwt9U/VTD/azyk9gHkBLspIuL4f9 mw0SVJBLLyomsofS3EVJ3IHMi85WA58DjcLJXif3HSKYUv4XnbrmVtlz40OZ0 4dumapi7In9enVB1sqlptOgxOusYD68k&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadsoftwaretower.com/c?x=cVLn1y8sDAEorQWkThikvrqCUzhiOfD10hEBOyZwul4=&c=h9R1VlzPyjnjD80ChEzJ5aunA8Bw8OXlCOt5n 5j2yvz8oGOmMyAmpNVMIh11StpPilGjvFDiWlM2donDkSL49GG9ZamlNleyGTUmsNESn3OXgRdli7PXAxzXVhUSk0g&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.packagelaboratorypresent.com/c?x=OR1 sKqJt hFn4sDozdqbtij HJUPTr0QCliAPe0xqg=&c=RxerlqnqNGMBIWA1eAL6i9k6JeK7 w1EZEOUQMqrIuRa63nlWgyl0xdJ2g4 B63v9Lbxw XATjOzc2U5VIlr2Wo35W2xVS3eAOMXq fSgDLxJEKmNJRchoSeeWnd85UG&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://flv.hs1dmr.com/aff_c?offer_id=44&aff_id=1020&url_id=126&aff_sub=AAAAAIoMRgBy0EsBAAAAAMvCVgAAAAAAAgAMAAAAAAAAAP8AAAAGAQQPbQAAAAAAI2duAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADIiBgAAAAAAAIBAgAAgD8AY63TrD8BAAAAAAAAADE4ZDc4OTNjLWU1MjEtMTFlMi1hZWJmLTczOTFmOWQ5ZTQ5YgAAAAAAAAA=

http://www.applicationstowerssafe.com/c?x=sLRoQvSGI/Vpp4GGABzNeAuAnmn3EuV23MsQ7 T1uxM=&c=jVOTafMP7W4iIrFKBBN5BOiCneKIAbD5I osiQvv0t5q/ZsqbRsFZmG/gYLd2Zzyu71djtGKHlXRu/VXQeaSfA5uA6Nrx8eQ7QLKt3PJRU0 7gmR1KHR95uG8op0v2Yt&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=RY0hOPnHhyYrG/FSAh7SyM5Uv1oRpS32wEB8drV wGk=&c=53BDb/7PhmwGgcpbRZyPO8rj4gIkbob2ctMjJZnrKJJfUSEy0mAys806z6FX1cbK8FSg4Se9c06ef3BtmkIIHk FgBGzndWIdjB22WQP1SdPV/uPGi2RSYcqrIDqflhj&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.vaultsapplicationstown.com/c?x=9wyixpc9FclPUPgIPbGroea 2oCwMFvD6QJLLNzKifc=&c=0QpvBLX9/BvogmdjbId1XnpHkyqXGmz3n668nvmxh1tA6ZvfdapN3Y5p68qb91JBHlTNizRObDTj2V2rKV mIrqvqlxKL0OkdSMT38iDb6HLBb3ZTVGw9XR0RqkGrP0 &downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.packagelaboratorypresent.com/c?x=aPZGy62M50pbkqwVWuUXvcURBsRrA6UEkTTIavU06t4=&c=5YWQxQH8PDZepiC8r5GNl5oTjodh6m3neWO62lmoowkQ6Xf0I6GDvH9WQEowKtvGFOZHO0LWkIOKfu3rjKZ5IR6PXcUusNVrt9nRvPYrdjMm/S98gT2Z7l MV0XfCaaa&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadsoftwaretower.com/c?x=49ZMd06k40Cy1Jy7Qhm O6cQeaDZvf41d8dfFFn8Ei8=&c=3k73XTh/1jadPkHcZgm8FWOH3lKaDBxYg75mL1ylLqJr0cZUZrVCn1O3r5Eaehe9l3CAb/insN0HjcecnqffsJW6FdUQAgDNx qpHvRqaVN 0 yX7anfJDUK2SpASljP&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Latest 30 of 36 download URLs

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.