» setupnow.exe
Overview
Analysis
File Details
Downloads (37)

setupnow.exe

YourUpdater

DisplayTime Software

The application setupnow.exe by DisplayTime Software has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from appdownloading.com and multiple other hosts.

File name:

setupnow.exe

Publisher:

DisplayTime Software (signed and verified)

Product:

YourUpdater

Description:

Your Updater

Version:

2.1.1.0

MD5:

eea62deb0b3b514447ef7b21da0008a0

SHA-1:

65881645e20be947b2af80613cfc4826489420b4

SHA-256:

5819265f80a5fc3061a3c4025ea0b27f5e0b4aa3eb6a370da4d94d2476eed49f

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/27/2024 1:13:23 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.DisplayTimeSoftware.Installer (M)

15.10.24.1

File size:

405.9 KB (415,680 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\setupnow.exe

Digital Signature

Signed by:

DisplayTime Software

Authority:

COMODO CA Limited

Valid from:

3/17/2015 4:00:00 PM

Valid to:

3/17/2016 3:59:59 PM

Subject:

CN=DisplayTime Software, O=DisplayTime Software, STREET=28 Old Rudnick LN, L=Dover, S=DE, PostalCode=19901, C=US

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

7A37A59103ADB39A13DB8D76AB62BA4E

File PE Metadata

Compilation timestamp:

12/5/2009 2:50:46 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:lffTaE2QUqwZF6Fdw4rKsxpigEm3lLejyaC4qF:lffmE2QxEwdw4rKRgEm0NqF

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Entropy:

7.8194

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file setupnow.exe has been seen being distributed by the following 37 URLs.

https://appdownloading.com/campaign/.../rdr.php

https://cloud.securedownloadcdn.com/r.php?21qZkLxQRUVcQ1GxIStDE1R0Y4NyXGj0HJZ2uwTlrOyhPePy6jbKl3Lj7yR4fb4WU3ZpASL1Hjjwx84DsgoNj96qIYuX9zU4DUtdMefuxy15H5J9m7XFh3502AXcaSgNMK1zYg3wO4BwakFwsCcKGiKJTHV3AcRmXSWV80sX54tfp9MSLZCshmca48dEl41iXYe5YG23LwjaF62r5FUm16x6eLLAQMSNL6TJMVNys6I7dLyiqsFszcyOXjoN6gARmtB9poHRvqZIbx1C0G4zSDnQXLD32eVoHwx7VfZqFY9QwatxQy7Jbuz8gdcjr7H9DfgyugZae81Ljuia2pTdUtmbGyu8GchjsySXOS7318OkC7uFwoTrSfDzO8HukYONwHKlzSoA0cVDjqiQPbiHrVgf3YKoXycugWPPPdqPqmtKMMBBYTjpPAFSzqhwYt0fqQ4f4v5uRzeElPgjJzJyaorJPIgNch3D77SbDYGvxV9SLqcu0V2a

https://appdownloading.com/campaign/.../rdr.php

https://cloud.securedownloadcdn.com/r.php?8G0lcY6ADyrUHWcYLD6b9Y4eCifvcE0lk0GxZN7Clyw3uJ1fn8rw6wLJP1e1Gem0f3xeRFRceofJ7hZvpr2wXNgMPuOvJbvZe3e6J5jXtyHBQG6g78N4W3RLxGhhRMg6QucAAvy34fEVVKb3TZ7P2ZBAFSRwF8DwDP6dlEgpTVkPFwSzv0pxZ07FTZcy8P4LFbY0PepJ9KzPgrpLsOisOq7Iqkgy9lkOwiOmxe6GYFwe7V0zJj1yK9hauxJDT3sqmhNTwTAuy6JG2JfM2hlMrCXVaHz3K2u6jh0PaAkJH4pJNFwQXRDptAkDhUH2Wb9gs96DJqmruMairG9pxMO1n8FF3mHZyRf10mEKN1biNmAf3JEBwsCTAhyEEgDd7Te8fTT3U5lHrWXuFB5c3I5E0EiFUWS1P7a5038V8tDApA55bbheTnST1byW7rYXz82zbbvkF8V4I0aTbs84Q1YRcxOkZMhyUj76vDraLmetmpnySwDIxCAK

http://appdownloading.com/campaign/.../rdr.php

https://cloud.securedownloadcdn.com/r.php?sjx6FKSXch0ieNPXlNwAv8Rk6A1gwkQZEn5j7XgkehCt4rrqfX1L5S5ct6s0qjZ5G4oO2F9hXLK1dbss8tdemiqQpTQPcPUTUjIWZRdWDYYQ9qjhUwwhPW7eQY43NZWIiEFhwTe9RcZ0CiixPOOFLWTBUYFIXBqgg5yMYMVPYVQAe883XWJITDkNBZvzBWPR1nD0azQ8uHJIPRMNOvwH9QvKQ1jsX9jZxX0HxQP1xyJnqwbe2HWbysVotfQroarW8rDFisGP1qdrXoGZ5DaD562zlT0K4rHcTkSbMz0OZegWCWWIz6mFcoeyifjmH0zAlrL80MW00cXD9TmJ0Ioc7DLpT5MA6marNWzOJwPJIMnSGJBGs0TzDEZwKL7R7ijVeTKXpzH8l502PCIhCBQggQN0BUSJdbFr4pptY7CkdCm2e5kQGb7W1UXDPQm211u5rUzq2bLfO8i2dCTTN1QPVOsLEONFQhLhblIdwttlBLoOohIcjy1e

https://cloud.securedownloadcdn.com/r.php?BUKAVThdzUC9vo6dxMzRpl7UbPxYdugOp0pkUHxtBaD6yJk5wUXVf5QrUnp7SGWiGmDB3b4FlILTr6ZY0XTg2JHX7740N1juoW5s8a7tSTnkZni0kbhnVYk36o4TqnnOkshsDoVvhjPhG7i1jzofyIjE7nxyLVn5oEx12twkMmBtuTuOsS41BnFILdhw8EBwi9xkC4EprgSVamKDfOEQcjzXwQuFu5bNfJ7RNMgf29bcvVQLKuBWNbUk2oZxubkJUsBIeRXh08uw4khOOTLC5GX74XEz8Zi2rTLGLIXMRsiWNALCtweydcGh9lQhk9kM25sNOqAGSSCGtniWUxv7JcpSxgaSpuErA6fowP5pIH5b5o80VE7EQxxoNHgccUEM1UbyKgXsY3E3rM4nrc1hJzFwgWJsRofSiqq2GovFs9JUWNhnZjFISkf9hZC8nR1FisIZQdEjnndjavHaPmSHH8RY7t6vl8aEATDq7hKuFYOQtv0iRT0y

https://cloud.securedownloadcdn.com/r.php?e0Kw9muB39VNiv4tcDSpnY9Icd0Ecopqo9Xxwr9AA4nSArmM5ebtdlbpzb3LAtbYC8w9AGJaK73kzp7EEj8REjhevlZ5Ob4rjBAUhk52r8n0yvFdON5t7mHCIHIwSNYcpy6GTbJkk6lTB17qOcTWyBzhiiNa5LmuktbdFVy02TTDU04JcYGLzf2RxQ2DCo8WSjaxeIxgBrUwsZgFXWrwctnJkpnWOvTHP3e3LMknefUGealc7MIjg63AvqxkWq1LtgPf3aDhpxXEIjQP5y9lFdWaDuvAVxlpNaEQkh8KP5oxofnuOwQtJNEnh9XcGiCutglNytynzWVYcis0Ojty67WohTBXcdsGuNt3g2rQZmObEhbtBE2HMY63RI14VtKqhetygUofhdqVuCp5grN3pT7hB8lxC6YTkrrBmQRD3izyUYDaprePll6Xtsv6ytZTVrvhimVlEvTytxJTYXIkjPhMhMTQgTKblftDCpYgUSPopzhox0IQ

https://appdownloading.com/campaign/.../rdr.php

https://cloud.securedownloadcdn.com/r.php?iShfvhyrKxPGe5MRKqMTL55rhMe7lERDx9T3qsvaZlReqE6b5T5QYbigXxojbfXJoQMPih0iCSx3xDeCwksvvKLsi9MtpJdOAZEShEbUxIX4lcGSw9n1U8ucihGI0TwATbtaQE5nm3rIf8AMhYOb7jnpA48BXFbRQF2Gj73GavpqD0cVY175kvvVzDwxiIo9nqPHxTnIpM82MlYLm5QHAlC9Z9GhR4rfvgW2akKz7TCUeAFAGvhgRUqQ368VbzbGQ7J0suAzndtBO9buEtLwnbmrivnt4yaVGTW8nwIKKcmylx201OwpZTRhoeLtNWpuPlCdSlYCxkaSSdSU1oj1iajHp4bc0AGQVj4NE2qcnA4fOW9QltREDal3fwgg6W72gbQVdg7BRcQF90vutn87yubN0r37nb9EmZAAfHb7T1M22ixwFGEdaP1bg5iEgriCrScHAoOuqAwsT4YzKDMVsO6ITom9QFMhxZY8nNCNo9ghdfQYSDUk

https://appdownloading.com/campaign/.../rdr.php

Latest 30 of 37 download URLs

Remove setupnow.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.