home

setup.exe

Radufa

Sambamedia llc

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe, “Radufa Setup ” by Sambamedia llc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer. The file has been seen being downloaded from www.filesn42.com.
Publisher:
Sambamedia llc  (signed and verified)

Product:
Radufa

Description:
Radufa Setup

Version:
1.3.4.2

MD5:
569f671b69fb3f2ad7703926f0f05d60

SHA-1:
e890359eb5ade4eac1c9f1ba965675a211b5f6b9

SHA-256:
743d73d4d859acc26038699a50c46d77dd2cf14587ec0594c68e8f4f3959cc2b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/14/2024 9:12:52 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.6.13

File size:
942.6 KB (965,256 bytes)

Product version:
5.1

Copyright:
Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\setup.exe

Digital Signature
Signed by:
Sambamedia llc

Authority:
thawte, Inc.

Valid from:
12/20/2015 6:00:00 PM

Valid to:
1/19/2017 5:59:59 PM

Subject:
CN=Sambamedia llc, O=Sambamedia llc, L=Wilmington, S=Delaware, C=US

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
08AF0B7DB5193EDC6FFE31467E46AA55

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Vijs6YE7Ykjt0B1R9GO9CkKetgJXtaci/jByl7uR:8nYYlhs3ILJXUci9yO

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9111

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://www.filesn42.com/hNQQYZEphQmp1jFv2TpjYHXtghBZexf4HloFDdAewpRupKXjJR6IR_efsXpLKKMEjxtdQBI5f_d__wgAK7zhxOZYndbmIvHrXGGZVFGsI 9n cC9zc3csL6325OjKJsbyChvCOTgjVz3NYxyg_J1s0OGjGmzOiFBuICuIg8hhWOP8mEhUZQbqGquT7h5EYJ7bKFNm1JSJVYgsPJ9_KzmrPBaINiMvzrH0FOBUueseJwLwRkwi_HLqqzhqyoJGpatKsi2t n_LUasHbwJJhYznwKEaA7auLKNP7ZEd6hSZEMoLYk926NkOZ 4Idaf2XC3HCn2cQnb_Rw4n_wra_by2z0t8O91SyWVe9n0fcSMW _Xl63qdn9Er8b4TVHUBhsJAMuEWzcUbrTpy7zjyCZBe56oXnI XmjsGmesniL8bQtBl3E_fasPa_XaZVFzwJ zUUoDPFHt9RQN1dq5Z8Ass4E5Rq5O5jtoo2ff7329JUmVZF21sE74pE1rP2MqivQhlsW0TUB0m_Kt3MJ9_IgKY_iwQYLG7cAVQiML9epqLS5z4tXC5VLmlre bItaqM09pbHz7hyv-iwSAMTcyLjE3LjAuMQM=

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.