home

setup.exe

Bigasesadu

AVSoftware Ltd

The application setup.exe, “Bigasesadu Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.dlranchbest.com and multiple other hosts.
Publisher:
AVSoftware Ltd  (signed and verified)

Product:
Bigasesadu

Description:
Bigasesadu Setup

Version:
3.8.5.1

MD5:
3ccfbf0efd9556ead522a69b225fa79d

SHA-1:
ef4a14d5699e300fb42f4122c1b7e74efeed3180

SHA-256:
e69d0ad128f0b2aaadf0263e0f4bdcf34ce0e0391aebc76e2c3306f198ed112e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/30/2024 8:34:20 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftwa.Installer (M)
16.4.14.23

File size:
964.9 KB (988,032 bytes)

Product version:
5.4.2

Copyright:
Web Software internet

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 7:55:52 AM

Valid to:
12/31/2016 7:55:52 AM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 4:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:rl8mbRZRz5W3NXkdnObt8B9EiWPCv1BZg+FOwSGkPMD6+bpYoq:rSo/rqXtt8fWq1BZ/KM1NY

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9326

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 9 URLs.

http://www.dlranchbest.com/c?x=ApqdztDDkCsaltxrZNUa2MpuAbnWJT6ccjMANfrunAU=&c=5vgP9kRzG 1r1zjj6vrLHcMiz2Jx TIHYFUP1iiHlunm9WMceoxvbiO7HsPlj6MWMVCKvqsytmx upMFApGYG4kjn8MTDJySKTdD8h5sfohIFlodN0b/Vl6BatZzjR6H&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.tourgrabdelivery.com/c?x=ppt7uDIQ6PQvrfWciV4sWxWdVLu6OR19PScDUvz9I7Q=&c=u1XVkY2dGsDGQSp0B0SWmjrkqXfX0J6S7U9X/XeC3sfLB8dy2MdH0CoYCnFBFeDtYvnYXsEDF8JgMJi4RZnIfzQzwuhW8DS2wgn wE27tF8ESTXJ5YWVsGBKJh9kJ9qT&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.dlranchbest.com/c?x=yTuN72BIWmusMZLrkXYFF55ZXa YHUTvK3EXS101XGE=&c=TLom/kXzDYPDr6TW2M98sAy2 ErPHYJcXjCgm5J5McxqSrIZNOZHb bi/huPZPwgP5rhIIDu3X9axFlv0cGqpJHlHHaKCIWc2JyQRem4gfcYHWLncx CO22c7dqkv8rp&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.capitaltowervault.com/c?x=iU3b2 oMB7971vi6bVh3CZonVztdlQu6neXn82VEayA=&c=Iijw5dUjl6mV IAj/aO/yY9TqASPy/ s2doCyZ/zOGtypPQupcV3t0i3dhHlBDdfDAK W79IBSkAE4JT vgAvUXjaxzxfUkjRlwrdPc2lDoQ8Lkj4R5vMwBFvcSMnFT6&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.cleancontentshare.com/c?x=R9Rgw8xWX6uNDp7c4ANu J6ERTkVzFdNq5szyjyQj4Y=&c=4Xv9jgHsAt1Dr4nSrYIW4zNQE4sVvoFXKuBs5GDrNZzENqQsUGTkkbslW8i/INxDNS fhDnPTcPBkHRP4dDMV5KrqEa5YRMhyJOmMboFn4G WWfwF8g9Tp7Q/4KbQWnf&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.dlranchbest.com/c?x=VGqGPr9x6bwvOCPsmt12/aZxB9MKUO/6MrR3cMX09sk=&c=woXRBD6w YoqAeZkVgXJz2Z6IbrTi lrc6kZnJ5rQdMsLlA3Qv zLt YGaiis7DT5jLy7OjdTqYQl4dqxpPbbU7pF0QF69PKxSdV7h4BmgnSHe03kbxRd6cClPWXKRfO&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.grabsignsrepository.com/c?x=pmh2HYi93OX/i97CnCVLFETLpmWqJ/LYf4o5E2mY9Cc=&c=5qQVpjvLBw zqUhhYbdzZFOkZEQ5U87nNIzeK2eGS7PNPHFFiYyniAx7H4H3rBNT8WLd/j1ioKV2LxGaeVS iTz2tYuiFj0GMl8UyIB7u02pIVxZBb7G8VfXrL9/GjIr&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.cleancontentshare.com/c?x=UrGU2 KToMrlwNQZBSIHQepMHGcaIwA1J8wMJa43vY=&c=eLLaerqYxwL3Ci6E2ANExKfegksG97VETeBvklpY0nTjTFkPqeBxRhUGrmlCOMUI7D75s3GgCQvrMJXL5sRyhD3IREgYSfN788zq/CSs2k8PrXrLpDHEuK1FdQT2rIoX&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

http://www.tourgrabdelivery.com/c?x=aev 79msWQr1elc O1UABEK7LiSSGhzA6VAQm/2Hkx4=&c=FMsKFku0JXW9gPeBTbd7paxj4PKd0kuCNm5Arge2f/itJ20Qd/HJfSTbRRpqVBOSgN1 dER7qEcdvUiDitdGAgDWgXce5e6 LwfcOUJLw6r2WHVilPpsb6zGwv24uDA2&downloadAs=SetUp.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.