home

setup.exe

This is a setup and installation application. The file has been seen being downloaded from pcpurifier.com and multiple other hosts.
MD5:
69c8604d12c6f9c88ab0c81d50f0c3d1

SHA-1:
d0d85b49d037b43e072a42c9e93910bdd94c1d0b

SHA-256:
f29d000fa7e870e4002ded5814d43e03bd593cfcc652451ca9d9fbfe0372f5ed

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/17/2024 5:46:58 AM UTC  (today)

File size:
467.5 KB (478,720 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
7/29/2014 12:36:25 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:LYV+M4Z/f4GKLhxoVX2Pig6vcc9XTj8Tu6eezwJN:LYV+M+QGK9iVX2PlAhXcTus

Entry address:
0xC010

Entry point:
E8, DD, 18, 01, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 4D, 08, 53, 33, DB, 56, 57, 3B, CB, 74, 07, 8B, 7D, 0C, 3B, FB, 77, 1B, E8, D4, 35, 00, 00, 6A, 16, 5E, 89, 30, 53, 53, 53, 53, 53, E8, 5E, 29, 00, 00, 83, C4, 14, 8B, C6, EB, 30, 8B, 75, 10, 3B, F3, 75, 04, 88, 19, EB, DA, 8B, D1, 8A, 06, 88, 02, 42, 46, 3A, C3, 74, 03, 4F, 75, F3, 3B, FB, 75, 10, 88, 19, E8, 99, 35, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C1, 33, C0, 5F, 5E, 5B, 5D, C3, 6A, 0C, 68, 08, 54, 43, 00, E8, 56, 54, 00, 00, 83, 65...
 
[+]

Code size:
181 KB (185,344 bytes)

The file setup.exe has been discovered within the following programs.

Cobian Backup 11 Gravity  by Luis Cobian
Publisher's description - “Cobian Backup is a multi-threaded program that can be used to schedule and backup your files and directories from their original location to other directories/drives in the same computer or other computer in your network.”
www.cobiansoft.com/cobianbackup.htm
About 1% of users remove it
IBAN Finder  by Abelssoft GmbH
Publisher's description - “The free "IBAN Finder" calculated you from your normal account number and your routing number the zugehöriegn IBAN and BIC numbers.”
www.abelssoft.de
20% remove it
Java 7 Update 67  by Oracle Corporation
java.com
4% remove it
QuickTime 7  by Apple Inc.
Publisher's description - “QuickTime Player 7 supports older media formats, such as QTVR, interactive QuickTime movies, and MIDI files on Snow Leopard and OS X Lion. It also accepts QuickTime 7 Pro registration codes, which turn on QuickTime Pro functions.”
www.apple.com
10% remove it
SketchUp 2015  by Trimble Navigation Limited
www.sketchup.com
About 8% of users remove it
Windows Desinfector  by IngES - Dipl.-Ing. Andreas Maslo
www.Ing-ES.de
About 1% of users remove it
WinRAR 5.21 (64-bit)  by win.rar GmbH
www.rarlab.com
5% remove it
 
Powered by Should I Remove It?

The file setup.exe has been seen being distributed by the following 9 URLs.

http://pcpurifier.com/getip_build_lp.asp?utm_source=1072&utm_campaign=1072p&utm_pubid=6227&clickid=AKC9bdbb0wgAFV2yBHPaXQftfFCLRYBnFnF63FholIiBCAAAAAAGAAE&campid=1706067

http://zalacznik.wp.pl/0/.../setup.exe

http://appads.info//of/.../

http://www.driversguru.com/.../setup.exe

temp:setup.exe

http://s.m2pub.com/event/click/0/Qa81VoaLjBtjYpoq65jzb3152Fw7e2XIfomA6v_Ko4KAJSw9m5Jrs8DLTs7JQWh-pNDQWobrLL4JnoQunEEPl3pQxIsdGOqVGyAb-5sGi8hbtVSvWwUiERoGrBmr9yjOKty-PTSlCMQQKpOWMyYg81cSTecjget5wU1WGFKI_fRueN2x-tyA0_kRCVD_CskHu6jGs8Ae1NJCKhczxf5f8FfAOiih-QwaNLaeSEiOvwuWNz9E_xxuZZ0urGKN6C5lKrJB5y_bJsg9xjiesfUv8c6z-6_CbYI6Dy35jOyjCwd8VS2tf_TdEsSnvshPwqLXT0vBk8CgpyO68R5ZI8z_uGireEMX9zuTrphJwoZDKP3cWOpZvqRK/.../

https://webmail.laposte.net/service/home/.../?auth=co&loc=fr&id=10185&part=3&disp=a

http://capsa.storage.googleapis.com/69c8604d12c6f9c88ab0c81d50f0c3d1.416111dd329f34138cc2cf7aa2414ec8?GoogleAccessId=GOOG57ULWBZRNEX5RYCG&Expires=1424708684&Signature=y7sv4IWIbJr3nD//.../HJKTZjc=&response-content-disposition=attachment; filename="setup.exe"

http://ttb.1gqzbmi.com/download/request/.../dAXAa0iQ?__tc=1424395695.432&lpsl=04e594f12933a93eaa5ff2fe07bdd939&expire=1424482096&PubID=532ca6fb6d47cd58f8000004&slp=www.nwsofti.com&n=&zt=532ca6fb6d47cd58f8000004&ClickID=&fileName=Setup

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.