home

setup_2.exe

Application Web

The application setup_2.exe, “Application Web Setup ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.factoryfilesbody.com and multiple other hosts.
Product:
Application Web

Description:
Application Web Setup

Version:
2.5.5.3

MD5:
1e2f31986195532a94ca68f5e37c68a7

SHA-1:
c3f43c9d44bff1d6874c6fdc23d56726f18bca56

SHA-256:
cc72f6adfecb745ca02ee4e3b21a198a38edbc8169e61ebf573ffdac02a8bf1c

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/24/2024 6:53:19 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.AFF.gen potentially unwanted application
7.0.302.0

Reason Heuristics
PUP.installCore (M)
16.2.6.1

File size:
928.8 KB (951,043 bytes)

Product version:
1.0.3

Copyright:
Prog

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\Documents and Settings\{user}\My documents\downloads\programs\setup_2.exe

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ryQ7OD6Fk7uU5YDx8yGOJnRDixBCFQ2YiQxp:rxqu/N18yGOJnwjmQ2Yjxp

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9281

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file setup_2.exe has been seen being distributed by the following 10 URLs.

http://www.factoryfilesbody.com/c?x=DjD/WQz6YXyQn7JzQavdkn/27kkejno7uIsR4WVeGZM=&c=fqLbwlOY4c4PnLw5 KiJaC9M0KfgH4/2UIrYkS1DhJNNc Kf6cnRaV53QMtzG51j8WxMu9PsgmjBXWBMgxPb/TI07KoLfyIXXfMxLMxkNP1tvddenDeY0OgYn9P0YrMz&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=pE/RwxC5x8yILG0i 4QrJPNYAYuSh/x4a4OW0JfUCbs=&c=G3vWHwT21CcLMXsr4r9w1RuTe/aFdwQmiss8BWf9FjXFG/1DmPUlvUdAY0 8Rk0X6v6Ce GrLPiP5HYowYOBV7L2pB5OrpiIHJ4C5pKMhpmJEh2pXYo5O1Fl0ZGqfggt&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=9RJowHPilMFalreQ6qTUq3lrPfpFidt0a2 JyNQC4xs=&c=eVSflaQK0KmX/io GwtANINimjwEMODRHWFyOoTmdws3D6o9YnuG2hmB94Xg8GoOIrJJm9T1z2jHP7eAnLqq898/rCMyrcDxcSgs7sVrhMup32pe7ohTrQggnugcTXyK&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=LsJCAhPy6tIcYh9seDmlua0HYnSJZXU6B0kWdhNLfB4=&c=M5vKFGOf/K6hfNY9m3LMc3jjnC3fzMXKNCSjwOnnSPRB4DsPW6kBYXuX8nf4EVCyO2LY0R/Sb0C7ImBvn5thX8TVIXaMhdVPBWUlOnY1dGiVZvz4SiKUJ8DJvD2LskgG&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=pTYnD1Jztp0pm6ukxCQZbDv NuC8dGQUVhnIWpimHMw=&c=T12lGb2Rk8LV6TLOfDaBbtB0cWLbmh5QPNMc9cyyLXfQG//U0IWhHPwZVy7xWMJ4f2WcNhz7qZ0okMXeZbcv9pGAu4x5FJpvsLMdrybL92zIajgmBk6cEtZilTgC7koI&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=PT4DbJ26lLckePGBwQJ8W5plPRZCymqEmwucIu5reCc=&c=sGmwmWiHupfV3XUBGZZUYFykkF6b Ry5OPHhWjqzbvoZwVwXSa1wAdMXvFxQzrdPz1KKT i7UbJSY2SQSMlIMH7wekkPgruEkOfA2bSz8zpJcSuONAjnmeSD/FeTN31Z&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.funranchconcepts.com/c?x=h43dMKVyBJX5TJHYuybX/XpJKtUZB7OlT1pq8zhWuhk=&c=oz0eRogxhfB2gmipShDqsADcE7/lL1gttSZxYmQpoWNvbFg6Bh 68jE7VyQJb/QDQaJSSO/rOPsMzXUrrEIZp0XI3owayKz2VHlN7G0N1mZ2pClqSRrjwIj7TCwzTttB&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.todayappshosting.com/c?x=ypSaR9zxorOd0fHaSbOwCjYtHxNbx0fgSuA6QU84BJ8=&c=jSqbEBMsfr/TokQLqbhc4a5HfC FijcXJ4CJR6mQvrq8KmWn7V9CbHH8M7WoNzbkxWbwursn8bbxZVuYGyoGnMNDLUlfpr6FrBE09D7J/Af920SmH79/A7JcsIX8Adim&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.bundleclearbulk.com/c?x=NcQpFAlo5xtxHqrDwKr7EG7rbtP0qnnFT8rPMB6cDew=&c=IIUDP3Wioz2KMYMjIm7Y6uvxdy6kbLV HvXTi2CNfEu1pWydy8y/hdHK4FPe4mspw5FOgWiEdWpCuemJ9u8hJzaKf0OxZRvTFELuu52L1vaqqXO55aXP2I39CoI0sLEk&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

http://www.factoryfilesbody.com/c?x=67TjTCi1Ab4oDluo2fFblAD8BR0vBdLoStE5EpdvSwk=&c=NgRFEJs40si8emVXFt3LC0AB57lrXgZ0YUOzNDgzXpIRDRZQveEu9yamQRSkSDpZ5w3rDQlNRRsk5g2s2FPABS8mN8x6lMfFhH5pkJuB aIGesuLb14GXb1 308Jblls&downloadAs=setup.exe&fallback_url=http://.../setup1.19.exe

Remove setup_2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.