» setuplocal412.exe
Overview
Analysis
File Details

setuplocal412.exe

Sitrad Local 4.12

Full Gauge Controls (Full Gauge Eletro Controles Ltda)

The application setuplocal412.exe by Full Gauge Controls (Full Gauge Eletro Controlesa) has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

setuplocal412.exe

Publisher:

Full Gauge Controls (signed by Full Gauge Controls (Full Gauge Eletro Controles Ltda))

Product:

Sitrad Local 4.12

Version:

4.12.1.1

MD5:

d7d0468e67c2e83a4eacc04f7e703623

SHA-1:

1acbacabc9c6e75e459e4fe1ec9d41d750b1d005

SHA-256:

0059d4b922d2acb696923efe59c7e17350491c3b227a56b8506a367db9942026

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

12/28/2024 3:55:32 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.CSH (L)

17.2.9.18

File size:

25.2 MB (26,408,808 bytes)

Product version:

4.12.1.1

Full Gauge Controls

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\setuplocal412.exe

Digital Signature

Signed by:

Full Gauge Controls (Full Gauge Eletro Controles Ltda)

Authority:

COMODO CA Limited

Valid from:

4/6/2015 9:00:00 PM

Valid to:

4/6/2017 8:59:59 PM

Subject:

CN=Full Gauge Controls (Full Gauge Eletro Controles Ltda), O=Full Gauge Controls (Full Gauge Eletro Controles Ltda), STREET="Rua Julio de Castilhos, 250", L=Canoas, S=Rio Grande do Sul, PostalCode=92120130, C=BR

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

563CCF27EB2108FE31A6F5CAB8EBD3B4

File PE Metadata

Compilation timestamp:

6/19/1992 7:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

Remove setuplocal412.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.