home

setup.exe

My Online Media Ltd.

This is the Bundlore download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application setup.exe by My Online Media has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the Bundlore Downloader installer. The file has been seen being downloaded from cdn.downloadcobra.com and multiple other hosts.
Publisher:
My Online Media Ltd.  (signed and verified)

MD5:
87000abad28940cac7abcd44b49e005c

SHA-1:
f88d59107ace0ca9042d96e3a0ae1704e61f5354

SHA-256:
6adedcfb42a44d3f5e1925786c4f0de94baa9333471d5a7028ab48afcd982699

Scanner detections:
17 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 4:28:04 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Graftor.186081
593

AhnLab V3 Security
PUP/Win32.Bundlore
2015.03.17

Avira AntiVirus
PUA/Bundlore.Gen
7.11.217.176

avast!
Win32:Trojan-gen
2014.9-150316

AVG
Adware BundleApp
2016.0.3071

Dr.Web
Adware.Downware.10329
9.0.1.0173

Emsisoft Anti-Malware
Gen:Variant.Adware.Graftor.186081
8.15.06.22.10

ESET NOD32
Win32/Bundlore.S potentially unwanted application
9.7.0.302.0

herdProtect (fuzzy)
variant of unconfirmed 841109.crdownload (Adware)
2015.6.22.10

IKARUS anti.virus
PUA.Bundlore
t3scan.1.8.6.0

Malwarebytes
PUP.Optional.Bundlore.C
v2015.03.16.01

McAfee
Program.PUP-FOZ
5600.6727

MicroWorld eScan
Gen:Variant.Adware.Graftor.186081
16.0.0.519

Panda Antivirus
Trj/Genetic.gen
15.03.16.01

Reason Heuristics
PUP.Bundler.Bundlore
15.3.16.13

Sophos
PUA 'Bundlore'
5.14

VIPRE Antivirus
Threat.4150696
39486

File size:
284.3 KB (291,144 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bundlore Downloader

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
My Online Media Ltd.

Authority:
Symantec Corporation

Valid from:
2/17/2015 5:00:00 PM

Valid to:
2/18/2016 4:59:59 PM

Subject:
CN=My Online Media Ltd., O=My Online Media Ltd., L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6AA804F3A58EAF0737163328AC5B0831

File PE Metadata
Compilation timestamp:
2/28/2015 8:40:53 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
3072:5konno7dSzYRVW8MoyFiDA660yO3z0gUNIUJY4pSugteeMC+6EDoBx74PuLENCwX:1nFYact6wzsSNYNCeoBtguLQZ0a

Entry address:
0x30BA

Entry point:
E8, 8D, 48, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 48, AD, 41, 00, E8, F0, 2D, 00, 00, E8, 5E, 4A, 00, 00, 0F, B7, F0, 6A, 02, E8, 20, 48, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, DF, 3F, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
7.0282

Code size:
77 KB (78,848 bytes)

The file setup.exe has been seen being distributed by the following 5 URLs.

http://cdn.downloadcobra.com/download/.../?software=MediaDownloader&name=Setup.exe&no_cache=0c309cf75f7745ab336060939ebfa640e9e648ae2db440

http://cdn.downloadcobra.com/.../setup.exe

http://cdn.downloadcobra.com/lp/?appid=1612&subid= 43fVX2RLR 28XOKDGff5i9pav6GyokJ33xnX7QRPwJTap7H5jSUJBAfDWNXxjySChs4GAk04tp2TeF45BC0dJv89PY99sySUcWAjWe6dOCaZ1jH/9NjueDtaxcBoVhSKYMLDlLYRwW/FAB4VdwgPwlNYZBkLhjCydwfWWr/15Hiq1osmxGtabnKNnhxGtCsxnBD7c5cdpN7otIqpDUzqfLMGWVa6t5dv9 4aR7k6rEnKfXmfy0FK25vmGWVl30xMEQ2ZH ocbQfgfzc8Dk8gMTp98/eYSO2amSXNEei3RobTZB cbFNuU5ZZSihM47hvSwl87PQjtAryj7bXqNeMsDkHK2E0nethQmyq0rnTpP5YFaL/Ye93yW0rtr5aRj4 O5z3M8KszJe0TssmU1DjO H3zcCN XpZg2ff2muQFzz1AnNpQgukVXz3jxJwv4rSnRdd2ZmW8hhdSk85c6em7rKC0x/.../qF6A==&c8=service.srvmd8.com&btp_h=9071aa4ebbc76e5a9597e742b66591a8

http://service.srvmd8.com/serving/?appid=1612&subid= 43fVX2RLR 28XOKDGff5i9pav6GyokJ33xnX7QRPwJTap7H5jSUJBAfDWNXxjySChs4GAk04tp2TeF45BC0dJv89PY99sySUcWAjWe6dOCaZ1jH/9NjueDtaxcBoVhSKYMLDlLYRwW/FAB4VdwgPwlNYZBkLhjCydwfWWr/15Hiq1osmxGtabnKNnhxGtCsxnBD7c5cdpN7otIqpDUzqfLMGWVa6t5dv9 4aR7k6rEnKfXmfy0FK25vmGWVl30xMEQ2ZH ocbQfgfzc8Dk8gMTp98/eYSO2amSXNEei3RobTZB cbFNuU5ZZSihM47hvSwl87PQjtAryj7bXqNeMsDkHK2E0nethQmyq0rnTpP5YFaL/Ye93yW0rtr5aRj4 O5z3M8KszJe0TssmU1DjO H3zcCN XpZg2ff2muQFzz1AnNpQgukVXz3jxJwv4rSnRdd2ZmW8hhdSk85c6em7rKC0x/.../qF6A==

http://secure.pn-installer9.com/o/.../Setup.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.