home

setup_v2.exe

Tuguu S.L

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application setup_v2.exe by Tuguu S.L has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. According to AVG, this software downloads additional adware offers during setup.
Publisher:
Tuguu S.L  (signed and verified)

MD5:
4c947178d48a08a86c13194ea988ecd3

SHA-1:
d657f3f72d5f0443f0777637607798da1669338a

SHA-256:
280ac65a5a0ba929fbab2c33ba9548db9b844b81e848a6117cf5ffbd58150d1c

Scanner detections:
9 / 68

Status:
Adware

Explanation:
Bundles third-party components such as adware in the installer.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/24/2024 10:50:52 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:DomaIQ-BP [PUP]
140813-1

AVG
Trojan horse Downloader.Generic13.CLLF.dropper
2014.0.4007

Dr.Web
Adware.Downware.6176
9.0.1.05190

Emsisoft Anti-Malware
Dropped:Trojan.GenericKD.1759647
9.0.0.4324

ESET NOD32
Win32/DomaIQ.BB potentially unwanted application
7.0.302.0

Kaspersky
not-a-virus:AdWare.MSIL.DomaIQ
15.0.0.494

Microsoft Security Essentials
Threat.Undefined
1.179.3144.0

Reason Heuristics
PUP.Installer.TuguuSL.I
14.8.16.9

VIPRE Antivirus
Threat.4150696
32210

File size:
182 KB (186,352 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Common path:
C:\users\{user}\downloads\setup_v2.exe

Digital Signature
Signed by:
Tuguu S.L

Authority:
GlobalSign nv-sa

Valid from:
12/3/2013 4:13:51 PM

Valid to:
12/4/2014 4:13:51 PM

Subject:
E=victor.camacho@tuguu.com, CN=Tuguu S.L, O=Tuguu S.L, L=Adeje, S=Tenerife, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121111958C6091E136AAD058195A273968F

File PE Metadata
Compilation timestamp:
7/14/2014 11:02:09 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:DvstUKlvJ2+usOKDUcJaCcBBoKxiAga+4WvNc+xiz8TnYvclg6JFa9EGyLQEXmsS:D0tU7bsJ6RBoL4T18bPlLJFbLQI1L0YG

Entry address:
0x3B7E

Entry point:
B8, 4C, 25, 47, 00, 50, 64, FF, 35, 00, 00, 00, 00, 64, 89, 25, 00, 00, 00, 00, 33, C0, 89, 08, 50, 45, 43, 6F, 6D, 70, 61, 63, 74, 32, 00, E0, 82, 38, 0C, 62, 3C, 4D, 3D, E3, 3C, 5E, 97, 42, 73, AD, CC, CB, 05, E2, 2D, 5A, 9C, 64, CE, 0B, 5E, A4, 28, AD, F9, 0F, 49, E7, FF, F0, 0B, 05, FE, BB, 64, 50, 8C, D3, 48, C9, 1E, 1D, 65, 0F, C5, 52, 8E, A7, 3E, 6F, 6B, 2A, B5, 69, 91, 27, 0E, C5, 82, D3, AD, 56, 54, DA, F6, D9, 13, 32, 2A, DF, 44, BC, 56, 30, ED, 22, 85, F3, 44, 38, F9, B4, 10, 81, 60, 7A, EF, C4...
 
[+]

Packer / compiler:
PECompact v2

Code size:
112.5 KB (115,200 bytes)

The file setup_v2.exe has been seen being distributed by the following URL.

http://www.lpcloudsvr303.com/.../Setup_V2.exe

Remove setup_v2.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.