home

teamviewer setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application teamviewer setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.grabpresentapplication.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
4e70d1e69ad99b386872ea7461290407

SHA-1:
2837c10cf8ffac0937323f548b6c04c56f6f6eaa

SHA-256:
749fb554ca1aae648a78fb53034e13db0bf8f0b9c767c580bc71bb4038a0ea25

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 2:39:31 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.30.7

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\teamviewer setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:25:15 AM

Valid to:
9/2/2016 6:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:t5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:tdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file teamviewer setup.exe has been seen being distributed by the following 24 URLs.

http://www.grabpresentapplication.com/c?x=LouTUn p1UoJxTYdYXcN4d4B75B8rOJJHUrViJo1Tww=&c=QTs J0zGadaMfHJi8krg4uvWLzIiEqufK0Uw qPyWbLV5b/wI7 7OtH7y7yryEaHGnS3oUy0wBMuRv6eBYw8aaxYRSu HFDMju8 OA1rqyP2MnQCUbN6P47X2thhGq9NR/ovhRuwILgPakaS1HB5Mw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.contentbinariestown.com/c?x=bRWYT9LWvCil UK2dN5HLJuuvH2BuEoA1jGzFlDomhk=&c=Or12gUUxid78L uMk9eUvHqmKSmuor8jH wlGgs2PnhexA1OhTxB4gP3BJSAFcWvV5w6RQb3w1bJ68bxGT6s3WOn9e8d/og/Luj5Q5bG0xe2S4RfLyFX7QchLSe4oxF1mYlIFzILMJitxa i7aBeA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.centertowernow.com/c?x=eT8nCjEupZ2ss5aBTZzDKtsniHVV9p3Z8iP4pxhdIb8=&c=IYCsg4kWr586GdQWLGaeoKwqpQJk6oNYPQS7AligY2 xo7EJUGctctfzVVesx0xSlus3GtpteRsPQULVi2vIRW8KxCuLLKPUHcHae2gdmSua479QnbJrxyJVIZjjPBOsYnWNjGwGwIDtqIHe38MBVQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabupdatebundles.com/c?x=USsK7yQHyBCVNkAqopGBf9ykJeFixlTKCD2R um8MFk=&c=f8wHAYgLzzaS78zCfQ36xZu18Azn9yKObwl5AFUTh1qlLKFxsbPYoVYUz9Q35hGI1V77AwhMNJPfUVb Ad9koKZd6PEsXsPxVUAuwTKj/FMhgJkL3dADVIQVHOKRMiEYS88Q6pZ9OLFtz5ppiKrg0Q==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.vaultsfilespackage.com/c?x=eXnewdY3UfR9E/T2AfMlSExCYR/nxtKDiLz/kT3/Y/k=&c=ngUH 1DaBMLIiOF2Lyb9939CLr2DL9Tu2MRhJ/TF0Jxg9G zv1kRiXtv/dUmM7LKoeg7R9/fQrq9GbfILwzAr8njLJ9MTf7JDrkMbmoXLnJsGpBS4VKoLJIwxAkDBtOhQFo7JbYEcQZ7tI2gzz4VJw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=ymHSrvHIIg1eL5XD7nsgumuilc1Q2bX1PDvzLTSDtmI=&c=XKgnxzx4IVJSoy2Li9zljJAUryFgffzMAU74KwjtmWy1YNBbAt4zxQxfKU43 xtfZZgWh3DFuykenvFYF t2UlTbhdhOPcbhDZ3EsBE/j1P9WFub MOFGVC9r3GwDOPL2GzF/hojnM5InLA8cWq3Vg==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.contentbinariestown.com/c?x=8kywTYtMItCEelA/dRS7V0BLpeerc COZ69ngja5Zd8=&c=GwRo5yLIBu/Q391d5WzzdRcjxIITO /X9nWCedKQSig9ahI6HEFIKD1wS1 /aV8rngwi47SXjwlesA OAWtN51n0chAHLdIud2u S6kaEFtuiZ2PqPLl9xCF6WOwv9U4ScW QJzx/bj4KSXzVMBI0Q==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=ZTumRh/Og15mZxCoTeyjH0/Yz/x1/QnZwfu v6JOOQw=&c=WJTH iz1HL2XinEt8rreoPlDnc uGndmTIHS9okKdRGSSVMaPfpl3LURGSmZg lkgvfKhTxayKh5QNVXGwkg7zXbIQukYecJj7X655HJ4ZDg5Wi1eAVvIzb6ucbKYqrE0ddhNlwF7Y4EkfPWVG0/dw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=x bHnEsg88wggrWMZUH4YOVtlrJNqSVpPuPSazUpdeQ=&c=gFp7XHrJ pSNY6cghrcrH0kkldAEVu1cd8VJb9RC1SK3tKLSQKJkZw5FvnGMr8AFlHgWicADHR55sI0uOSvB3DMB5PuV2WD2H9hXKzp7tsYUxv70xFwbxWXKiuFiDap6bB5QgQN9FWM3dw1hHTjZcA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.vaultsfilespackage.com/c?x=NdUa4D fygUmGtl b8Bs5661abz59Zgb n8B09M4w E=&c=T MjVm76j Nwp3Mqjr8r6Ivg01kMrrBBMV yhW492R6iZXIvuLcNQjDbCeHFKYgBUOqF5KH ld frB/ik/ op/MD579GWnOREvw3RYpA23bAs0wtlhftDi2buwgRX2xz2EpCpCf26cs3jshV2Jihkg==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.filescleartag.com/c?x=qjJ8QC6xwq9O6funJVxApPcYnBB53cCWzAFvrHRTJgg=&c=g hNHpX07P3wCdo6GK8fCbjCjlHfsauFo9ymUTBEU6tDNAAM1lBkaTVVnCSox3Zy83/p2NzLwin/wweMBxc0rVsQQ5S5TqJXuExNUd8C64RAgP6A0XRVrNimgIVCs2juWcz2N2gyzY05T2zsXo6SEA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.vaultsfilespackage.com/c?x=kr3O7PZPOBf GyZJlh2HuhuDXV0kgylut8SRW5a9U7Y=&c=SkXv9J2Fah/BZ21i5m25erXffzkl78JCKFPXFLBrxZvC20XnwEgaILAQJb1t5FGBRYHNTEZPRJI7FjWUGjPKB1FQp3J75R/CKEDof11WEpogTsyjtvIh mgLMM9M0sqlqt9O2Odvjmi6rB20Ex1rIQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.currentbundlescontent.com/c?x=NkbbU7CByA4VhMRD39U44/pjpJVDbm/qI4wjZ19oqQ8=&c=68BElkn3rRbeo2HpyL3bdXHAWu49VC6DDOMO4YRe4J0huSqVs4jy8cRrU40HAqYlcP2qSL/RWB 3NmyE3lR/or4BoKyTBwB yoVc2EOM1bKgmHHjWJSzS8hr4kWk7jmsKDuHw9pcaaH8LJldygokVw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=87v2fwDY7wxWJxtqiGVr6g2k8sT8X4OR78HlKFN kgc=&c=jY2cXvL9fyfe9SMuo6Xh/82xmk0fNfMMAV2TrwGCoQ2WzOx9L7QGfl2NVUGHUrV2GVGCRZxFVSKGnsGWbGA8LHyecWY UY8FFKPJNw2hMEdu/ vkqBnKWX/XT44tIl8OnmdDRUSSYe8BlEhf/EBesQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=zM 6 e1riEmwPL5/gg5D2410Dv3APzFmP8/PY3wn6Jo=&c=v6mYt2WGtRRFx6WPjCbARph4keGA1a4kXs4LLKum9SPc cGm/mVrfpLyiGtjx9P8j74YxP62AnZ9/kUVDDi02TzaFjZHV3J35a3veTVE81AbamNJuVas8NZFUKbl9mofRYOJQL6bHZLjbX8RYpbXNQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=bcShuv1XTiGy5rJhL0ArEL9z9EkmXbeCcEz4MOGEyDo=&c=BAJ4JajMKPcjFV QF8AfRAfyvVUZNPPnj6dLmpBGVN6Dyfl15x0FTDKEYucfvcATLfV5hwjvVeRPdoAdiG/5YEUaFDqhBHRsQey6ZWaaYv2mbr 02IyeEqN5QQLYa7i8i/nV9SVxx VSKFUmuEb8Cw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=czb3yUgvS1cTX5yTGJh7UqQ 261ZVyRNVVUJ1V2FhFc=&c=APfknhu V8GmEZ9G1NlgH8Ub309R940JWPjB5iNth1ZocLWgfZ8lr4oFWRFS4FkvE5mZ JD2cwd3I0BHJtfTnSlvom9Oclc0dZCGtknSLJwf1U9zxvrB9xad9kNNkECc8btDeG575xdcVq16bvQNXg==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabupdatebundles.com/c?x=gYj2Mw/n/ph0Y6Q2j9ITAKnCd2lTBC2jQFfsKYf4qJ8=&c=4zWgmoIiozUaGACU5dr2g0E8rAX2YVIR8NaMHUgnL5AFp3I78QFGhUpENsi6MRJD1YhG73VcRlTYCuH6MnPzrHvYNbgMAQqksVHPuUFg9Pp8jAYuaNBerTgtq3jux5rQ0KC51HhHzKsHDQp5AkxzaA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=oM3rjSX3/39Hw5qsmRsiFOsg5Oei1zOqwUhYCYq2jvs=&c=MDLFUsLFtphwdjGXZErOaxvOKuXb1Uh B/ju4xtcYmApToSexHvM3D5md9UoRSclkdPePFWqrIXS87BYHSV3IgbQoK5puZwVdYk tvABY1IYOhJkj1GcpZYbKxaQBCae4fclg PbNnO0X166v0YXEA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=iHxyrjMtGFLJjv2a4OyNPONWokMG38qhgVhd9XKLXnQ=&c=GKNv8yHZYh0UvvP 81pj0e7zF5JfVdbAUAv3okuAG7nTfEXJOKRTBPumUFNM2WsL6T1OGQ79MyOIbYGUjjTMaUueBhp ZzScC/H9u1ektJ J35a8PLv0VyaL171tuHHu//dk0HW3Jgx4nBf MH8KQw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=OeJuieItBWWJghqGfvN nbK9B4pElkdfGbc652jcyGw=&c=nSd0DemaBaZPixZfjhoPV9U2lr6BnpFfxETjkApDn6RsOA0e0Wgy9Dt8EHAr3m3IeQRQc4GF3rASOs45JAUdEWjK1Qujdxx869Q0zxd6t VtWz3mYZY3PxXtaJ4z7mNdYRc/m3dk/zJW/DCCFgiadQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=AjptWVUPQstIwzj5Z/wSWaW2QgRUayuM0h5fE656xJA=&c=YhIlnzwLHhRvzUHD5ACuXCsrYFcvfELiDEdhHsWpR7AGQ6hz64gMVno0ll6Q6OLppd5a48Ha1SoSdjofLcSz3 t0l3eEAWctHR sT/1xIiqBF9WRReWaxEqID/uBpBwO4xx8bXPge3SYBxmpmoLkhQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabupdatebundles.com/c?x=Ex9 yC7dHuIp3 ECgxLPqsV Yf9yOBiD8pmS1Hdd7CY=&c=nQZ8cKxJCSmim6d /SIbV9Q1LQl8UUd6S4WRndGZdN8/xB4Bd6niNS0AIl8tzNxHZpyHvNikzZzSX7EuKHa72weZ3uicEiXa/mfI0PzYa0CswT7sCPeUcZ i0Ln8HHWgdCBcYE/K51Knxta0QbfukA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=W8pSl2AiweAYMszlYtQYzvFoqv5PNUUfC3UxJTRBpBs=&c=07XwBZbkCnLOvp//f5oqJy1v Wn4b99HlJ0yfgg3K/ax gBYHr7fDng/s/fQFbKtDpruO6TUW0sWa2x5s lo3EA5j2DWwOw5iYlRtM Tf7SpWSIeFhdtuH K0ZhIMP9ILuQuOhdnN7QsmWPZSpxmDA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

Remove teamviewer setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.