home

setup.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from ttb.4filen.com and multiple other hosts.
MD5:
ee1b9c1831399ac7d2f7e1f48a815095

SHA-1:
fb9c05dfad23d8c65cc11d1f1dbcceb29ef3b8de

SHA-256:
c6081a2d397b3771cc01eb37bb1348fdd5b3de861775cfba01b723d2663a0e49

Scanner detections:
1 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/24/2024 1:02:11 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
MSIL/NewPlayer.D potentially unwanted application
8.0.319.0

File size:
2.1 MB (2,202,981 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\setup.exe

File PE Metadata
Compilation timestamp:
12/5/2009 10:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
49152:ZVrN+1glAk+dkv0AqD9JJWg4xZ7dz1ASUm9/lqsED1t:ZVrFldYdRPXmB1Ajm/Ev

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file setup.exe has been seen being distributed by the following 50 URLs.

http://ttb.4filen.com/download/request/.../3UQqjRnl?__tc=1461787161.54&lpsl=1819359687efa8ebf056fec12f49692f&expire=1461873563&PubID=oko_mix_win&clickid=VepspaY2e2zsHUL8hEHbMxuITnik9BLW9hOUeR01_hr5HoJZmHZwta-qaMXRs0CxFViO0pB6u7o71gxDhePH_kwEqsAaef9YlJA4kWppVJxMHBsIozLvMM7cA_JZybtmMnDuPcfpZ6bwSgHUwOyiwkRpdgq8MEjP5PNtZSPYY1ec-WNQWNQJY483aYdefHZQe_4nlcoSOZUc4tP75v2wadqA6nQ6o92sznug4p2wVk5ernaVDQZ-Ugv52WLUhn2AA6tGd49tqOt_b8NbFE-q-6B-UhPY0Xh9lRoMqaBnjuosbkFcvxHvllEeENm3Sr8NUwSAkvwstFl1KFI4fqHQL3oNqUOKUloqzwDjzvK6v-HzXc3dqCXhaUdxB4RoN2Z8fiERyiLcaqfREMiGC1KEiTHKUBaamKAA7V2VXB1_cKU.&slp=www.newfileord.com&fileName=Setup

http://ttb.getfilebv.com/download/request/.../k4LLh84j?__tc=1462402906.085&lpsl=54e12f5ff047994a134172c5b5faa3cd&expire=1462575634&PubID=609683&slp=www.thefilekit.com&ClickID=31462026951462489233&fileName=Setup

http://ttb.fivefiledll.com/download/request/.../4xERYwEo?__tc=1461522549.459&lpsl=db25371581dd229b42c60f594d10e7bc&expire=1461608938&PubID={pubid}&slp=www.tenfileer.com&ClickID=v1_7952287_249937_3pn_B91AECE87B51222142098359818_-1_4162377_130r3_536_B91AECE87B51222131208849294_m_m3_-8536340257885481993_895807___0_73_4o9l_m3&fileName=Player

http://ttb.dllfilebv.com/download/request/.../4xERYwEo?__tc=1462574512.804&lpsl=90d510fae1991a6531d18fa2f4d6e525&expire=1462660906&PubID={pubid}&slp=www.tenfileer.com&ClickID=v1_7952287_260217_3o1_21542AC8836617561477616558_-1_4162377_130r3_534_21542AC883661755251526205_m_m3_-5879594743872287866_907437___0_73_4q35_m3&fileName=Player

http://ttb.dllfilebv.com/download/request/.../f8uDZejp?__tc=1462653119.789&lpsl=edc29ea334b63cbdfced49bcd473a3f4&expire=1462739466&PubID=457069&slp=www.thefilekit.com&ClickID=414844261462653064&fileName=Setup

http://go.combosoftwarelists.com/d/click/.../?sid=112&uid=50263326629883384&filename=Setup

http://d17xbawxmb0m5y.cloudfront.net/Setup.exe

http://ttb.youfilebv.com/download/request/.../4xERYwEo?__tc=1461981491.385&lpsl=8e348961b7ffb314431072d1d5a3e351&expire=1462067838&PubID={pubid}&slp=www.tenfileer.com&ClickID=v1_7952287_260197_3o1_EC7BF7B5F17859961269950575_-1_4162377_130r3_536_EC7BF7B5F1785995524122562_m_m3_7036856820782360820_907457___0_73_4q2r_m3&fileName=Player

http://ttb.thefilebv.com/download/request/.../v5UaierS?__tc=1462970614.086&lpsl=4eba25332d405ada4c6e689991c5faf1&expire=1463056946&subID=MjYzIzI3ODAjMTA1IzIwNjY3fDI4MjEyNnxCUnwzfDF8fHx8OWE4MDhhZTAtZTAwMi0xMWU1LThjYTEtMWNjMWRlMDQyZjAw&slp=www.getfileex.com&fileName=Setup

http://www.epratico.com.br/demo/.../setup.exe

http://ttb.bestfilebv.com/download/request/.../iG7IkXww?__tc=1462589026.786&lpsl=eb12b3eca9ea164e63b6cc8375574438&expire=1462674997&PubID=293898&slp=www.newfrifile.com&ClickID=189057893962&fileName=Setup

http://ttb.newfilebv.com/download/request/.../U4YcxHzd?__tc=1462404333.647&lpsl=070fda9076191e3c014499353d2a4921&expire=1462490726&PubID=1066319&slp=www.thefilekit.com&ClickID=19527121651462404324&fileName=Setup

http://d1rtylazwb77ux.cloudfront.net/desktop/.../setup.exe

http://ttb.getfilebv.com/download/request/.../v5UaierS?__tc=1462145289.774&lpsl=1ef138a3f45935c65eed6577605cda6b&expire=1462231686&subID=MjYzIzI3ODAjMTA1IzIwNjY3fDI4MjEyNnxVS3wzfDF8fHx8NTYyZDEyMTEtMGZmNC0xMWU2LWE5NGUtMWNjMWRlMDQyZjAw&slp=www.getfileex.com&fileName=Setup

http://www.openfilesnow.com/.../download_TuneupPro_es.php

http://ttb.dllfilebv.com/download/request/.../v5UaierS?__tc=1462830706.859&lpsl=7d76156f68e4b06c666d374971c3ae19&expire=1462917090&subID=MjYzIzI3ODAjMTA1IzM2MzB8MjgzNzk1fEFSfDN8MXx8fHxkNDhiMWVlMi0xNjJmLTExZTYtYjZjOC0xOGE5MDU3MjFlZTg&slp=www.getfileex.com&fileName=Setup

http://media.fotoprix.com/FotoLibro/.../setup.exe

http://ttb.downfilebv.com/download/request/.../NXOlMVq5?__tc=1462331961.669&lpsl=873a130226b111c68c6ddb36cb5560bf&expire=1462418319&sid=Nzk0IzI2MTQjMTE5IzQyMDJ8MTAxNDQ5fEFSfDN8MXx8fHw&slp=www.needlsetup.com&PubID=793&fileName=Setup

http://ttb.dllfilebv.com/download/request/.../v5UaierS?__tc=1462832145.439&lpsl=9b4b1b437a0d5be619dbb6ed4bbb088a&expire=1462918533&subID=MjYzIzI3ODAjMTA1IzIwNjk2fDI4MjEyNHxDT3wzfDF8fHx8NmM0MzFlNjMtMTYzMy0xMWU2LWI2YzgtMThhOTA1NzIxZWU4&slp=www.getfileex.com&fileName=Setup

http://ttb.youfilejds.com/download/request/.../0uEGsUPH?__tc=1464796966.71&lpsl=e618b43a0c2caa858d14140fcfd17e10&expire=1464883364&PubID=ima_pc_ac2_19&clickid=aN2n9o0nRGp9Ma3sykJC64OtPmBUzEBMLJGEZn6vqP7nNfrsz7NrQet7LtG8e4_LdJU_Yi0JKOnclRhHC-CGZfGK0-TneBkCGh2bXo85qSgWEeqYGuxBWZjBQFMTTYlddyDZo3y8cE3A0MdgeOhblUUyR_tlg13l48q1y4mMdkJAvux-mhyo2OgMXkHhexBzQzkrSk_KvOELSyFmfSOaeJZJ14OYkXfVLk3rZTAUMr299Xn1-bxcPgJkLIaxvixb4GhqoAJruZ-jBZd6y-kQCBu_oYnzUauvHAhq4oHm0q4.&slp=www.newfileord.com&fileName=Setup

http://ttb.bestfilebv.com/download/request/.../iG7IkXww?__tc=1462534404.047&lpsl=3a15b6c6cd2a7088d7b33db3289b335b&expire=1462620780&PubID=216304&slp=www.newfrifile.com&ClickID=174012616674&fileName=Setup

http://ttb.getfilebv.com/download/request/.../4xERYwEo?__tc=1462239398.404&lpsl=cc0153a62ce2d2305be0ad7b94b35b72&expire=1462325791&PubID={pubid}&slp=www.tenfileer.com&ClickID=v1_7952287_260217_3pn_6A893C10B231186301861868769_-1_4162377_130r3_536_6A893C10B231186291072916561_m_m3_-7628098480009694984_907437___0_73_4q35_m3&fileName=Player

http://ttb.thefilebv.com/download/request/.../v5UaierS?__tc=1462886485.745&lpsl=e820922fb1342cd0e20984d3fbf1ac4c&expire=1462972881&subID=MjYzIzI3ODAjMTA1IzIwNjY3fDI4NDM4NHxVU3wzfDF8fHx8MGUzNjUzZDAtMTZiMi0xMWU2LWE0OGYtMWNjMWRlMDQyZjAw&slp=www.getfileex.com&fileName=Setup

http://ttb.lpmxp2181.com/download/request/.../CJzxGx39?__tc=1411347845.12&lpsl=915f906cf1f021b5ea2bb4bf562e63b1&expire=1411434305&PubID=151651&tgu_src_lp_domain=www.prosoftlst.com&ClickID=31862683271411347904&fileName=Setup

http://ttb.myosofwer.com/download/request/.../009ng9ey?__tc=1426345586.959&lpsl=7e0d6b708ebb4461476c69384ed702d2&expire=1426431997&slp=www.youafiler.com&ClickID=55044e7c427d49ae1d8b457b&fileName=Setup

http://ttb.lpmxp2111.com/download/request/.../llCB4Edv?__tc=1408314289.889&lpsl=f1efa949fd58a035a2a1a5b064fe27c7&expire=1408400676&tgu_src_lp_domain=www.dlultimatesoft.com&PubID=44&tid=dSJYpxBf09opVTn9YEq8mHBt5mxp6cFO-j35a63cDAOM6G9y6VXyEgaiq9HWYxryTdERQH-UUelQcPry_wtuPIpyM4wVHPJHIWuAMioLKzTVBq0I7sBa1pqbFASfbSr29-QeKYNTO7xSn4cOLqRp6SB1ci3CWo_IGuMBRooXlBAjU65BHSCdqyE8BtwTqiPop6jocdZC-9ZR-pkVUR_Lqxr5F3BnKJ4ScSJhGlW7l2odiWUjSs3eo30MC2BJ81IFQ6z0x-SdLQe20QqkAd_buYYylPbTOcX6IqGIhRITJ1NaG5guHSZJJE3PMYcu7yxTPH1mNtFOj0yRrQHux9SYGgwTxzB1X8jIGL0gxr1aIjl1upxGZwFz-gBCx-4-NEHmThKhgJ_aN6Q4KD8aYPSR93wSVZEYmlvLLe6PSHcRy1rgKqwMen6uEA&pid=44&ref=clickated.com&ClickID=M_317451887412ba2d67f31408314274&sid=M_317451887412ba2d67f31408314274&fileName=Setup

http://cdn.downloadcobra.com/.../setup.exe

http://ttb.thefilebv.com/download/request/.../v5UaierS?__tc=1462930375.693&lpsl=34e711fbf219bf58ffe26936ed350b59&expire=1463016755&subID=MjYzIzI3ODAjMTA1IzIwNjY3fDI4MjEyNXxBUnwzfDF8fHx8YTM3NmIwMTAtMTcxNy0xMWU2LTkwNDEtZjhiYzEyNTM5ZmY0&slp=www.getfileex.com&fileName=Setup

http://ttb.youfilejd.com/download/request/.../0uEGsUPH?__tc=1462934809.59&lpsl=e126e2ddfd4ce4b2518f06ba0d6d6eca&expire=1463021192&PubID=ima_pc_bruno_chrome&clickid=V3nZqPNZ5tMMDOQFmU6t3Va_GWoB8Z99Y-B-IQVx4FEXdF_gDVIOdE23rTniG7VC811U5r81gEm9yNwPe3TIhogUhdpTkdvFv82Y3wfVjLxdYPLZjXrRXGlikRdVPJaD6qumwWwB79D3WGA9WG24MI0oAd02bMS3i2wWu00sjbh7l6lqlGQKUcw16rHgYjsJs669svFoxP-IMKLCPuDEHEHOPFHGWccUNPcgMq37GOOcMCpxBMMzWZCnBipXbRSPiX8WhkbMB64zT63VfC_hwtXiVbF0pN1PLB8C3QmcI2A.&slp=www.newfileord.com&fileName=Setup

http://www.fraps.com/.../setup.exe

Latest 30 of 82 download URLs

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.