home

setup.exe

Setup

boxI DjV

The application setup.exe by boxI DjV has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from www.anyprotect.com.
Publisher:
boxI DjV  (signed and verified)

Product:
Setup

Version:
1.9.3.0

MD5:
499992afeadca14b847121bcefdeca8c

SHA-1:
f5549b9b6ee4add1d0d6d290a8ee26a18268e545

SHA-256:
c00d81d16cfaee11ae720606d55ae44f3c0beaebcfeba4b1019abd4c088c8ccc

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/15/2024 1:11:14 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Outbrowse.Outborwse.Installer (M)
16.2.10.8

File size:
1.1 MB (1,146,600 bytes)

Product version:
1.9.3.0

Copyright:
Setup

Original file name:
Ionic.Zip-2015Mar07-151938-fa0fc76a-103d-4215-bc02-661893d66638.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
boxI DjV

Authority:
thawte, Inc.

Valid from:
3/1/2015 12:00:00 AM

Valid to:
12/17/2015 11:59:59 PM

Subject:
CN=boxI DjV, O=boxI DjV, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
33DFAD27DDB3D03E8A4DA1348D2F9E4C

File PE Metadata
Compilation timestamp:
3/7/2015 3:19:38 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:xbSaE4mvt/m8xyd5lva6Vv0yF9xk0UDWcxOagXzj:xbSv4mvA2ydXvaUbFf9NcxO13

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5748

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://www.anyprotect.com/dl.php?sct=NONC&data=4517bac3ec263878ef50ed0ef707ccbf&anyprotect_id=1&r=ap_mtm1_nc&pr=s&prm=dXJsPXt7aHR0cDovL2QzODltNGw1YjV3bGNiLmNsb3VkZnJvbnQubmV0L2xwNC5odG1sP2NoPWFwX210bTEmYXV0bz0xJnN1YjE9MTA1ODcxJnN1YjI9MTc2NjgxJnN1YjM9MjB3TXZ3MWh2MWNhdUhwYTAycHhZYjF3SnVvaTAwMC4mY2VfY2lkPTIwd012dzFodjFjYXVIcGEwMnB4WWIxd0p1b2kwMDAufX0=

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.