setupshop1.exe

AcDc Project (BrightCircle Investments Limited)

This adware is a web browser extension that will inject advertising in the browser in the form of unwanted banners and text-links which may link to malware sites and install unwanted software. The application setupshop1.exe by AcDc Project (BrightCircle Investments Limited) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from cdn.airdlr9.com. It is part of the Brightcircle group of web-extensions that inject advertisements in the browser.
Publisher:

MD5:
c2cd0554c91f699685c833623ded9fbd

SHA-1:
83b673ce9f589d60b913637b8290aeed9e3d97e4

SHA-256:
542a2a761d682f28e5a515905d18002183306b2b45d79b982d4cb87ec33737cb

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/24/2024 4:04:18 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.BrightCircle.Installer (M)
16.4.26.8

File size:
154 KB (157,664 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setupshop1.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
11/30/2014 5:00:00 PM

Valid to:
12/1/2015 4:59:59 PM

Subject:
CN=AcDc Project (BrightCircle Investments Limited), O=AcDc Project (BrightCircle Investments Limited), STREET=Athinodorou 3, STREET=Dasoupoli Strovolos, L=Nicosia, S=Nicosia, PostalCode=2025, C=CY

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00BB5CB272841409598560E8776848BBF4

File PE Metadata
Compilation timestamp:
1/6/2015 10:08:08 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
3072:UKT0tyqa8zuNgvxG3iDxPFURJSfed6+Ogb+Mvs1C8/ehoraNUXmxlPb:UKTB8zFpDG6uLvs1C8/ehoraNUXij

Entry address:
0x9704

Entry point:
E8, 2D, 6A, 00, 00, E9, 7F, FE, FF, FF, CC, CC, 57, 56, 8B, 74, 24, 10, 8B, 4C, 24, 14, 8B, 7C, 24, 0C, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, 68, 03, 00, 00, 0F, BA, 25, 34, 66, 32, 00, 01, 73, 07, F3, A4, E9, 17, 03, 00, 00, 81, F9, 80, 00, 00, 00, 0F, 82, CE, 01, 00, 00, 8B, C7, 33, C6, A9, 0F, 00, 00, 00, 75, 0E, 0F, BA, 25, 58, 51, 32, 00, 01, 0F, 82, DA, 04, 00, 00, 0F, BA, 25, 34, 66, 32, 00, 00, 0F, 83, A7, 01, 00, 00, F7, C7, 03, 00, 00, 00, 0F, 85, B8, 01, 00, 00, F7, C6, 03, 00...
 
[+]

Entropy:
6.4772

Code size:
107 KB (109,568 bytes)

The file setupshop1.exe has been seen being distributed by the following URL.

Remove setupshop1.exe - Powered by Reason Core Security