home

setup.exe

Kelicos

AVSoftware Ltd

The application setup.exe, “Kelicos Setup ” by AVSoftware has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.shareappsmega.com and multiple other hosts.
Publisher:
AVSoftware Ltd  (signed and verified)

Product:
Kelicos

Description:
Kelicos Setup

Version:
4.6.1.8

MD5:
88a72004c54e8882e124b3850ba29d75

SHA-1:
fc1102d24f63e7f8fab714dbdfd6ade9060accce

SHA-256:
4f177f92937d88f3e480bce8300b5d76a73be81a6a473dfb1ba42c1e5b39e2fe

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/6/2024 6:35:03 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AVSoftwa.Installer (M)
16.5.2.17

File size:
971.8 KB (995,120 bytes)

Product version:
1.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
AVSoftware Ltd

Authority:
GlobalSign nv-sa

Valid from:
12/31/2015 12:55:52 PM

Valid to:
12/31/2016 12:55:52 PM

Subject:
CN=AVSoftware Ltd, O=AVSoftware Ltd, L=Sofia, C=BG

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112134814B6C56AF7047C195AE1D737EC185

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ltCP2mRwENZ3pwk94dVYNSHWG1b0qFv12rHW7C:lI3zzZwmqVYU2Q0qFvcrHWu

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup.exe has been seen being distributed by the following 26 URLs.

http://www.shareappsmega.com/c?x=s6Z3vHYsqAOilYlhT8HclNXRAE18e4sufD4Ev4gbWaY=&c=lkuq/upC5uBqFlOyM2OFPVU7aR5TCkd/6RLz8WbcFM6ci3hYo/qCKyVn48QToMoeXVkeK BkwDPck G WLvLH3k0rKvf0RJ4q/0swW25y8MJJhXcNciE7J/91APlPbpY&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=ia1QHm sufSob5to5eH0VrYU2O0oR50u5 sc2r/H3KQ=&c=Vt5PXMbR8 BtQL5fdFSS4zkQph2oUV80upq4iJTvSQSuFyGv6zXFH2 6RoFKzHWu20/cHd9l7E4dv9SAwd6x3K6zrUPwQ3JigLhHTZNXvMhyVzFv3x04Sqju/FudoP9L&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationsfunbulk.com/c?x=v9uJbbKprSYrCKMU3nG8g9j lKKt5p9Y8YP3q8bYjbE=&c=XBHnN5GcjvbC3O3v9iTfMP69Y xzeGKhWQuVzCjKpchsxMEJuM4EL/V7OhKXAy4ur9xDdT S9Sv7QxbOO PsuB9GczPED2nj4AtQG6L97eVaTjuabCOs0HsLQWWG2NkS&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.shareappsmega.com/c?x=JU3VnGh7/wt q1U D0xFaxaLUD hVU5oUhCC9DQ690M=&c=SLGmj/ZbWuHbwGkpEAB2zSkfhDXozAnUZY9Hsuz7FxZKpqGCt6IaI9JSBJ8DSU7uqhJjgTxVNGgYHRw61nWMAQ/eVuRjLT plMEw4yTcQNWa55JHYbqjXtKP rb iRs/&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bitsdownloadspackage.com/c?x=Uq8m/1l5X1xRt8K105BC3nZ3yuglJUQwAChLUxlNAmc=&c=2V36vLm9gZgkogZ2ZxuW96qCUVNOjQQ8DSuK/rUNwpy194On9dzOVHmA1u8b1109AfbEHELWu1xWMd1Aft9mRKRdssB2u33ANMZniWJKvJyzmTSWsw18BBjziD5lXrYD&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=YMNxcnwsuLrHaqnCs4Si8D/EMAtongQRILsl qJ67xU=&c=SH37XHEd8EaT9Hi/S/K49y397PX9cK HHv8zSil0Z2w0kKgkqsf0 GJccK8nhARpyX6Mh3lDUnTuXkio964eBqNDOIi1hS0bPKJGOc37ooQcxHXgSh3N0QJ/vDTfTHSW&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationsfunbulk.com/c?x=Nvcz9Lcwm28VgtN5NMpwWFjCIVNvMj8u5gbP/8 h6SA=&c=iKwUc bz0VMB9cIICJQS iwq9PuT1I3B5Hfio5PK8eTEJEtJk0fuS6xnlMScxTCtyCQHOWQBkdQKs T7O1wGwREuybnP3TtunD/X4NIiGDygil7mLwganHpU91zxge F&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationsfunbulk.com/c?x=JnbuPKoMKiyR0X2ZF/X00bF ESBfjVEhaYovTaq2fJ0=&c=9s/tLi 7AcNAffZXK8UB4I2tJindeNrUlYdvzlPK7a rjNymuuU3yXJg1Oi 7XQvgeTXhIFfhlmq9W9JuLerLb8a3EN9rq97g3IgXSOfDIhW8KUf6kd o3radeYgJW00&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=ac4aYrag E2o4M8pPeP Dkr1DdET98te3eYvIO6NZAA=&c=66C3JjYan9Rl4YPlihY6 Ut8QLHUh67yXhmdnU7bWqB/1syGvY/1UHgrLRZnWAZ1PINGEbu6uJ54tV2io7yhZbrR5T22I0q1CZXDYfZLSTPv4pXoCP5dHsALaRWjUPYe&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=vcTDrN6Z TRTC4qKsVeJW4UdEnj/hFsmk NU23Ceyi4=&c=sutfJuENuQ7SW0eIqFeqPlBAY616H/bILppWjUog gR5i6UfJNCWCbSecNA5F00XoAoXSBSPloSFl1QnQUElarl/eBovZ6CqyvyYUP2R1vTwGqud9Zg2YsJUFzMzHko7&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=fwSZ8Yf6 7q3v9BipwJ3SKGTlPqq3bstwL7uWAIIHmc=&c=dHiYDheAbQE7JFx8Tk7FUn0Y1oamNY5a4 TDrx/yzvhG9ydat3pKVaP95MT8MXozz9JXwkafh/6ktjcYsvD/O8UpYDVmeGyUz0Zf7YIlW81l Zn0y kKQKGkpgWktFl &downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bitspackagebits.com/c?x=QZEz7TUoiRlvTPlSfRIv6KgvQIFavP/wcYNk2p9NTv4=&c=7uF8nYyblDq40DRqEfJYfG/WNOI6ashiD EJfTmeQa3O3Cm XTDJ0Svpjm3knemmxU6fvfNxbu91wb5dyC8bYCFNstTMm3PqQVjeGOLIEWneTbEGOIe/BKqPM9PBrpa8&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.metabulkuniverse.com/c?x=Sbg8YRX7QAZmkb3EqEwFKpiNZLoALdqzRKG//RdiiVo=&c=tM14zitezxJOS14Shdiic38IKuMDkRiiLhQ/zpz1rG0rRMANp4 28Vcu175ZsTF3pD5E5E6VDu26wnRtYsxvA oDFiAU/vvhZ68EgF1yTlhYMTaHILJElUqBEbJGgnVO&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.shareappsmega.com/c?x=mvZ4GnD1XMRovH6AYXmnewHQGu/QVI8GjuCPVWHKx5A=&c=gKixHC2cpvfT0puU7EjFZVR0rLX9vQnbIW3Rw4C aGhh0B7BiawqtpNJEnRs5aANUCdK/plqnUY2/bx85L1zNjiOX0WHV1Ise3jyCof/FnbY1IHpvOChZxE64ndSMZTV&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.centraluniverseheart.com/c?x=DK0KfhuR3SHRpUdHUgo2zvQ3T8E4lxfZzqfGR9NX7xY=&c=ck/pRIG9M16uvQE2No9F5256NCdEwD/R4TXQK/8TO0idqkOgN2DkpU67ku38Pg6qwdnIV Sgitq8tr uqRa8tr9Z Dtnen/VqZtZrv3ojRYi86X03YCS8VL/yZfhjaGE&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bitsdownloadspackage.com/c?x=ox90l67oVS6UB9mF/TE1h3xMYtuZ8nmNSawcAAl1qj0=&c=CNY4dX dvPc8rDMWDhhi8AxTMZ8EKY27tsqfnER1GNbakZasDM8BIYnkRcYGPH2ZwXn0XssNzS6SA2CPFWNuwuvFHkHSBp3hatSA/DuwbaKs/1WZX39u4EGFT4nAugI/&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.toursheartflash.com/c?x=9CwVcnbCUN4KcmnC3bmSQU4gHH7p7uS3O092eKz57uo=&c=yLQ0no9yTq WkwTumi8MCVcY6bQxASlIi8CTT6oy X1cPil1cNSb9wMLPPVdnsOLKvq5Xt/cHn0WVa2B5cmsgbl kP0 4EcT6Md5/8ChjUYrvjHowJLOw4woGSHzw73o&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.centraluniverseheart.com/c?x=1muUzVedHsY0y9SIknqmkRpVIZCEr4No1CHlTIfdUZI=&c=6 04uLOQvGVr0QArIbewcOSyQjz0zYaXJ/qxKBfgpY//0400/imwDSAwVcyiqDMxw0QOP5KMzEjTiDfOzs7FwqRFQpE/OKj3HqqEDxYjnT7vlBTiToK2c3B4rGOV1NfZ&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=tttX8LtS9VB7D7yxGGI3lcXSDPcUulg4O4i5CXeqUlc=&c=UWFx3HmsYBVTIiLQeKkgxflqOqlRIc0cM1jGIWWOEWNOxvvHL1YOe08rseAayWUe4si3Af rsiA2wyRWedA3IDcPB1vFBACi1OWJWPX2QLqmg6WmRE4UlKqL9kZoIAy4&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.downloadpackagebits.com/c?x=0CNlr5QfFfcmFwX2yXWgsxTE72LX62mH 5NDVySTkjg=&c=dmUGk2lq1k3kc8vaAt2U HPQ2/reFs5rL7KlMBkotbHGnQQTHMYa6ny2eUgxjR1VEjlERA0zIpxX8/1ArMW5PSm WhbLEPmnqJuZ8Jl0xBegwXGqxJemKqYpfFNj08hN&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.centraluniverseheart.com/c?x=S7pvDu4BCIbvz/d6gxzMMCSLNhD8/y4NKeFfpZO/jQc=&c=KZkfp40Ta1MiVkEJNuEzbKUS8n89dWoSjiGTLfayfWOK5ZP4TVwGIYCCDfn3hW3aFHVGS7tuTnWs44/d90UTaQMIcM2AHsmvuStyepKyxr3aW73sv/50oI2pSMZp4W8r&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.centraluniverseheart.com/c?x=3PEa/fkatzWhcRpqml/mQP0vC1/osgJYrf9gvxPIorI=&c=GqUvgUDj5PMs kESgJA3ZN9L5z59iT1ISUVuVoDtOUICptcBu oDVOsglXCFs/zxkoaGvgmgOZzVZClkZn8oYkJpDrUD8PLegOAyqXipPwdV2SsW3o6bU/vdv4PunEAS&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.shareappsmega.com/c?x=Nhi g3mNtk2OguM66wxhUVnH9jArCJymf6Us6b0F6Ps=&c=sa6xxnh2akdKs3sR7aMENuyJVreGc4IVTNUWBouYB9qfcP5IcT1jTfsK8V08Z0x 7XNLfpZg7X5l SYlUuxkqIYOLvDaxnT7UAD197Kr6AjcrcLIAj2FjC/eoGRBtRs/&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.applicationsfunbulk.com/c?x=jE4G32uCsRCtswuQkKkTNqWkb1MznwVFyJSZa5qd6wE=&c=81ZgzZpWQ2L 6sEyV5UqKRGJnkIJ0/UKQFWhXjVH6SJisiL1hx6ahPZhOzkWTo/ZIHcGXslaYel/ qGrmRjqLL9VwFMxAicBsOb9M IR7ecXh3s9ayWQrvrIORGnZRB9&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bitspackagebits.com/c?x=EnqLBIunOsTrpHo9dfZpUnZnG7MztGBsWPLvrkhLwao=&c=lPx1sDJMPeog7c0JmZkD79UMkDaYRxEg8ivHHPBGNfpObr 0NR9zchQwYkzH1 0I/2LhRc k9LMRVlfCj7VHHcfvON7ORcP1C5NK1wJ9fn8DJvhVP7ePJdzxWtmCr/IR&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.toursheartflash.com/c?x=p/i6fWxexdlIc3DO9RgY8O4dmZ8xwDAVauCqWsRpsV4=&c=Zc8A8ftCe5Gcyd2qULDWSX/yovkq0bQRx88s1zL7gmswaFeeyWgoy0gCmmbyAar7aZAy/UuyYN1QxuAMOE5eC/CdU8mxclYZhoA3zk6CN5aZ2gtl67foKtlQFg9J1fca&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.