home

Setup.exe

Web Application

Geryon Ads S.L.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The file Setup.exe, “Web Application Setup ” by Geryon Ads S.L has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. This downloadble file is typically blocked through Google's Safe Browsing technology in Chrome web browser.
Publisher:
Generic   (signed by Geryon Ads S.L.)

Product:
Web Application

Description:
Web Application Setup

Version:
4.2.5.8

MD5:
546e3503a1d18ff4556ec399701edfbb

SHA-1:
e02600c53113bf5496b5bc3be497fff4fe51e21b

SHA-256:
ca80ab4dc1066ebd9a52ea1c5b183ca7694c447ec669bfb6687137cb24a8561d

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/1/2024 5:32:28 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2016.0.3085

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.1568

Bkav FE
W32.HfsAdware
1.3.0.6379

ESET NOD32
Win32/InstallCore.ZM potentially unwanted (variant)
9.11739

Fortinet FortiGate
Riskware/InstallCore
6/8/2015

K7 AntiVirus
Unwanted-Program
13.204.16151

Malwarebytes
PUP.Optional.InstallCore
v2015.06.08.06

McAfee
Artemis!546E3503A1D1
5600.6741

Reason Heuristics
PUP.Installer.GeryonAds
15.6.8.2

Trend Micro House Call
Suspicious_GEN.F47V0531
7.2.159

VIPRE Antivirus
InstallCore
40850

File size:
687.6 KB (704,064 bytes)

Product version:
5.6.8

Copyright:
Program

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
Geryon Ads S.L.

Authority:
Thawte, Inc.

Valid from:
6/15/2014 5:00:00 PM

Valid to:
6/16/2015 4:59:59 PM

Subject:
CN=Geryon Ads S.L., OU=IT, O=Geryon Ads S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
71F910550D2DD2713679787B12FF2EA0

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:1HeGF+JxTmQV22wo+SAjhpTR4Vrm4a180DqrRU8Owoj9l7:1HeS+/TxJejhpTR4k17uU8O97

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8910

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file Setup.exe has been seen being distributed by the following 7 URLs.

http://cdn.download4windowsfiles.com/c?x=jPt1l0eMrnNPIV7DYHL42ua bRnhSPMLRkw1 CsFzA=&c=x6ahK3SO85l4SD/CTfmUTDf joUpBEcbDqP4ewsivVs8QYingAOIXR1y2nTRK8RzUsiB14L6X3ecW2UG4gb1sA==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

http://cdn.download4windowsfiles.com/c?x=gpmfki1owTu4cDyGcqpmHWRsKrNOTHhFOCky6o2tr1Y=&c=pkj9iuGgWMkG1ZcYea4YEFC3AC2nfpVOftWrKfpDcoUqBvOHunoU H0AE66WXUWZgASgC9K/lI QMIGMJb/3TQ==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

http://cdn.download4windowsfiles.com/c?x=mxCvc99v 44Fs4oDQLHqIP5srJW0nNU8KMpAcus3zjc=&c= 2mu 63twnet/95Y5uOn1MIvmUncx 9SWizHaQcl2WS5W6QYMGOJtJiHMmro9jpQVJqzlu97sJet1W0sjkRyRg==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

http://cdn.download4windowsfiles.com/c?x=Ok88q0WHnZDKpQBlnuMhYFgh4kLCDSe1HCcF0EvcNSc=&c=78UuwsARaECmkC1bZSzixVwkQeGuH69HJ5cpJcxbZsrmllIeHNFsXlTUmvI4lnMBb07aofNEHW6EJZMoxjvAbw==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

http://cdn.download4windowsfiles.com/c?x=jhdBay/21OpfbtaF64Diw7p8S4TBIohtwWke6 Xt2eA=&c=0tkmsnWuQFPP9MSJvBh45ygE0UrcJLIgoeyo gOsoQXe4X5sxLu8vPEov9xgmpf4y/CbrBzzEJUGI fKToyTkw==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

http://cdn.download4windowsfiles.com/c?x=gS27 1yNujZqtOYLJVvA86OQQkkjPa53wr1EqNWVNbk=&c=TsVxO8JGqxYiGIKol1XqsIf0NjZZkSwPIe2bwDcIE58eiZy7o8nulYQtelS2TI9SBFfeFpvntVUtvi1Cr9Nqyg==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

http://cdn.download4windowsfiles.com/c?x=c9WzPM0KlHrEqttU04E03ZUplFH8TpPsY 9aQySs 04=&c=T9zcBLJ7eAup/gW9MZpH8MHbDnVycFsHtIjR MG11fr8uAlB Xw7LGLaIAlrVgure7DT3lG/ysvg6oJO123Vnw==&downloadAs=Java_Update.exe&fallback_url=http://cdn.download4windowsfiles.com

Remove Setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.