home

setup.exe

Application software

AVSoftware Ltd

The application setup.exe, “Application software Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.todayappshosting.com and multiple other hosts.
Publisher:
Lite   (signed by AVSoftware Ltd)

Product:
Application software

Description:
Application software Setup

Version:
1.6.3.8

MD5:
849d301910823a55ca6550c308dabe86

SHA-1:
e6f6327082571d9d9f1d0bc4c5327e89917f65c5

SHA-256:
bdb28e50211612a15035a3175a272e456287e1d2a5ea4a9819221f9d5b2bc402

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/24/2024 6:22:59 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftware.Installer (M)
16.2.2.18

File size:
943.8 KB (966,440 bytes)

Product version:
2.3.4

Copyright:
Installer Internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:55:52 PM

Valid to:
12/31/2016 12:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ePhTG2mTAzbBuATMjquwO1SVdA7F5KFasAbpup+7xZuCDVj:eRX1zluAT/u2S77upvCDVj

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file setup.exe has been seen being distributed by the following 50 URLs.

http://www.todayappshosting.com/c?x=/FXytIVxGZzZRmDbSgZ67TqZvXQIw2E 5iIsOSOBmwc=&c=oYBNxTdt8lnhOKQdNyrIGJF8hb/A eYleszU 4KROHuyCNA/tuzraPrcjqGquk6t1TZMAXc6mX/cet1tpGnwJRkRNZDPtsP5Vh7mStpFn6Mu2TUK JBXBKiIk8H Q/y3&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=hQKLx3nOarzIBkD91xa0hSTaXLtWGIm2 AAN/g79sic=&c=qh2n5mapqiKn0cbiUEl1UWOHIBTTKkK8jqVrhz0iDXlrAoHSVcfiGQT6qNt5yOsLCr2JpoTA25SZlkFgkMtg7 v4Y3pSrpidNXLagxQ6ch9eXjiVPFjVNwKfG5ewPMBK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=YAY/psAsV1y1fhDfv3p5e9C6ysmrxQ4VBnQ 6dD 2dU=&c=b68gt9TEX2XA21ZVhjYWKG/TAjKFiY2crIyy7Zn3xsd8za2qyTzF84hO7lXg vWVmHYHHLWbeNUxFAX7L0k2n8IpGGQRvinCxyLrUel4UQfSehzCCkz4kro0kACJq4Q8&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=zBRuxQE0nqhoO7cQ hw5Ei1MIhUcZcLPk1Gl9lrNzWI=&c=6s84OpvDXNV/ur5lLs rkCNh7kFenp6utkC0nODIvjVB ebCDrBRMiyH965QlcDX3dbf9QsRvuaQYTxbqGMtCfgp4J923h/ZCHwICpx/MFPmf3Gl5QC2kD3luEbWNizz&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=jOXa4W9Xpv2FmSWZ8S IyQ2NZYCYuGVkyrdXjTFDaxY=&c=xCrsPoLsDrR8VZ9NdEfCYPXXp3 xOPDCbdLVNh5tcGN4eG4kbTnNJ5JTFeroRx0cAKg9W5Xud1Sntvoyo1hsCZ6kViffDI/zzkcAyygnxKHygSqQvTVlG IXDr70oYRE&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=tB9jEeCC jzW14J2a/lYAPqyM8QUmflW8Og7Xmq99Wk=&c=hlx/pG8JsITiMuLeDhl7WuFF0MhRjMyqKginwFzwq3TQmIQT4kVCts6D42syN9 46QjFoA3csCPZbzc9NHj3xxlxjNKuQPUioxLnpW25TKb0 DCgdj0VOVnBwvKzm4V1&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bundleclearbulk.com/c?x=7djEqG9V4ZJq8xvr/MrfzGjyuZBIMKOGSTDHNd7 WkY=&c=gqGHMkY/brG ThQO4CEQIlQ2jrVb50zUp4e9ui7NaN0r32bFac/a3jZdNnR8ytHboaizxUk5Nv4SwlNvbWDRhC6hlluQ2aWUaBOCP0BEqwHgZ22LEbhGxslhEQzHHwgt&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=Z4sbD5FFR9j7q2HdnP07GL2CovdFJTyxDQ 5a iDGkI=&c=O92 kFcSNvFhDhqzLjftYHTOvAtU3GVSX5r7T1InJcZXZrM0E7TGTD4WXqG0JcQ89tmTigb eTll3A15 2RwYdTGcIoevZBIg4MeV8krEPO8/ JcwoS1XxL7Erkx0ej8&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x= o4/sZzUMNUeEKn6pXJidWEEdlHW5NNzD9kjE1klXMg=&c=S1gd9bSDYkjwxoPe9yG/4RrnqB/j5qiz3YYa7NFVDad68WuUBjekrZ7NXdA1JhgHJvWrG48EwlVHCptepchRmWUx54B SqLcSGKVx3AXCe9H2l/ 3PkxseD0yLFLvOvN&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=s3DwLtEpYYGvsHStxQ5 39IDd5PkNTOA91eUrw1GKmY=&c=KpgXTwgeP1va4Jx/pWpk4dUAvApA4I OWFw aZ2vBbAbOo22mIJrOposn5BDPnt fQi4iUt4BZ17v5Gz9LVIy/L/a0xaqa9mFZkcCYU3j bad hxyAVEfujurgh8uUex&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=JzWIZAdEloB79BnyeW6SaTCM4FxiB0FtCt8fltLCy7s=&c=HL8 Q7yNRtBX/nkGtlwQ 3fUj2rjxiisRcFg30mWoUlfaSyyb2ENhUs3cB/WLyvvnZYK9tFHc4jBZpK5wP2HmpEkPbfQC PaY 5wnJ 2tDA0CFWg/IgqvMgozNiopYu3&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=k7XxX3gv QiHWhaY5PZUsrzxFOK4uzdchSGqJgfnE2g=&c= ET5wwRAY8BaTBlKrMLBrDHFAgyhQadR9Yp9SUmODGqDV6X6R9KAWCi9fKQuLM7CaC/14FWx3hrH6pYA9mDfRvzlLjugCQd8pdLH7w9VRJmBAycCLuVXBJZFEOWDbMaa&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=WMuZSCOJePe 0bRbTLZEYBSNaK9QF24syaLvIKhrmcg=&c=oEKcW0t VR6Wp46ZCxc9H IxDuE7JwrIcsvW5yua55Z h Fx2BsdBVfbZXaKquh1pD2y5VOdsHUzTP/VQ7LfmLwTOOWAp4BYSu2QhNLWtVMdXf70mIBDIikXDTnhkIAB&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=r2 83z0KJcCgspeVCN24KQGMqoAExQGNWBQtiAbmFio=&c=2kqyZ9FNc5mD1D1b2jXpi2o5x16CUSJ0lvZlGj0z4LMJAel4p/0rqK6wOMm5TtF 6g44veGGK4Ta4OyOUeMdIjhbDeZe4NuAuoObcWScbs7/D99AARj9NcNK5Wnzv lx&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=hmOx9JajG5P1RgKcNs8BioSua1Cd8h/BdRhNt Wmk/M=&c=lIiFMays7mWB1cmmeD1Vgx5c/voBOeP 3l/l0pYKyrJV55Qhw1kF5pLqGMAGbZAOp7hInLIHa1ANgMBbUNsNr LURZvWKwXXgvTEIKC9WcSjlHa Rw mjDtYGZLuDq6e&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=x4tqknMEg0qDuE 4TS0NlO5sTAhmphCEvJH3xustVb0=&c=uxZendMFvJZDKEX6rhiFZGlRwJzCtrGr7KUmFAzJYXurRUzbZ8z308FoSmaur9wL1tQf zjdW0/XHjsNUnNjYGrkcFHYDrrzqBbw9sVRDivcfYgQNQyZG6Oujt3PFa2h&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=w8JGUGe xrC8eeyrkXWrFceaU92pDZz6kPW4dQwIOSE=&c=wMsfm7sHOz/GM/6uczJWKFVJAnJhXvvNl9J6essOVpav4ymHfkO5x1f Vi aOObHVg/58kbyMPJcG/bYCakTo58tKoWKaqd4TXrPTweMGX5ho6e4FwyCtYU9fvnMpkHz&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=TKy 1jksu226x7jpM dfqJE93/753BKXfX6SDwrznD4=&c=CbkPCGwpp2Aq8erVA9wxdkwcgv 5VXRhTXUkKGMV/h4HpQ0nbc6VKzDWP8DNg/Vskiwvg7V6ro9Ih4HKOrlGLj05Tit TE2mx99YEqfQNiDo25 SGBRylJ4cqglBuu4A&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=Cxegx05KpeR Wcx8lsklXf4wVbFZb 8niXVw JobQIE=&c=zofUxuWPKFacsRVi4Uugw4xgmZW/AcUHhLijCM53IX0P0fUYgBmxXTPM1ad8RvObcba6ArdmqF9itmJQSks2vHFsTVWzo03rWmQtO isJ RHeYupVhw5yEuS1RYunh3d&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=bimKF/2SCzSSZRlv918ba/73U1EGrMju/0p4aT3fxTI=&c=m1X2woCGlbLcUGaxzouuQmlFTuGxUpf1id1moYC54VsfyCzd5U/G/etFu5rEG/yJJ33ZtviZwm4POAXJKLuOTLUJGJeEetzRgpGMG0NMPCybcneA2 eM Zfrc2OvXBtl&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=MOXYyMkoPIQlNQRSrzud/Q676tbdQkPVpYAEWSHux/o=&c=AJ1dBH6LtjFKCVwoRibQT9vDn723 WKo2sQYEfGCRnlVFWi0LsM VPZrgw004v6lWcs B3IXeOyOM2Ls9CgdRiJd5cLr9sz 0OnSKzLxKqEU6BrGRSYOfTJv1OIH5FXQ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=NSsFQBnM8vqVT1SNkWgAB1rcUk7uN7yFd29/8gNZsa8=&c=OVbBGZV6ixo0kRNetX1Ua5djPCTAx6lxnAypjQ1 4uYEDKeaZL8m0piFObWmlFRxDdpDiKBOeTF1hfCi2v7Y3/WJSItsebALvDzKce7n2n1Jqo5VLRJEPya4USJ/fjU5&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bundleclearbulk.com/c?x=Pq32Q6w63Zgcki9l/ds7DxCIKrvvLDeLZ/WPnIfwL88=&c=Vgpsfy39Z0PGepAz66fo758CK 9oGQfIJISw4TCYcOPpWAHax5ho0cGxeN/dyypTwUf2P/aZRM0XgCLW6PdSbfto b3DFz2eIuNYoUKES3p1u4hZQHfQsjbIwMOvCeSv&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=tLOZ1dloNyTnMwrhPHKchdw/iTEypU2Dqu9N2c31MME=&c=B0AmxK7I/e8QnnqSm9f2NieTm/rlDkz6pcUeLIzR3BmeU0vsp89ClakwGCC9Y3x7BVgtR3MuXyH6wk7FNSibAilKd11X2IkZvELRjywVN1lpXfuSPJDpjzTCrljuJmTP&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=5T4NIgTKeT/yFmvMi0AA3PknskqxBFroL/Ef38Ti4OA=&c=3ntG9 13Jc6PttqwvIxwErbSFT/YWluD6h0lHR7H 9gE/7lT/07ko1/tMZKUDOLNSZ9Ljs2H3o9Uy32eDIkLjj8HfiEAclnrSfh//v3AEeLzWkMKWsepknACeRNTJsN8&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=TFo8bh2pcjvgvy6iJ6JgkRqUWur8BmdYzlX tyrzgww=&c=fYVRZ16cvMtEo9B3xrxokI75ex2ki9d/sE4BH4Lxj SYcEpxRwpbJIpxnhNn7/JsMMPiuyPoTXzn4RAJUdABiBm4r7vGsJtTx7pbNHSKoPRNxjLacP4oKM/8ybUnM6kV&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=ulqOVin99SXGfhBxxOwCDH QkuRHU4HVAVYXuXbQ6 E=&c=a6JTsgTUiMSuEvpTVQrzXOhwkV09lsU 15o7IX5El8SSXzkeodjQayThm2YxzNVIkE7PQzyCvHm1RYfrh5nX5HCnRXXfK6R7gUM3mZclO1AW 2JawdFPuWogEw097Fjl&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=CVXhCPptOipDwkg/WPNZ7psJgbd7TIMfKU3OSboxJ9k=&c=h/dnuUz17g99P AGjY8g02eHUho3qsq6967CyZu4 pl//dnruLa2fwnvgNnn0kIL NCZg9kS8RqQ98SHURTXZiRH2N YRRXhd Bb1/wl6Sd7Hm0iJE0whdyYk/FY0MNO&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=pQcdpUj66p9sE110RURtr4kw nzNbsbPgJ1pPYsMM7c=&c=riJOYITEvxRMy0k/sYK/ HO3r2SgLkMHMRfcdIUlfpHwDxrcAzwPxdSmpKRKREAf Y7kzrKx8l/C2VbG7UtqHEdNdUYnkUv0uEyZ/wT3EKcEYEmOZguojBh0cyfhIjyF&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=HAYcLp/yK/l9aN 3WHwuz7WwHhPUi9WyhpB4bxeuRNI=&c=2WPKtGJ8TzI3vnoJgle9Po8y61Ql9hQZgXqiEmjKV9pmdDvK1IX5r0mC6MmwNaaVmhGMQ BPvkRNVvwBM9f0gCloUSG10bC1SdfKCZuysN5W96e2tPWsla7CjnUphX76&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Latest 30 of 78 download URLs

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.