» teamviewer setup.exe
Overview
Analysis
File Details
Downloads (9)

teamviewer setup.exe

Soft Installer Program

Media Theory (New Media Holdings Ltd)

The application teamviewer setup.exe, “Soft Installer Program Setup ” by Media Theory (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from www.bodyranchtag.com and multiple other hosts.

File name:

Publisher:

Software Installer Web (signed by Media Theory (New Media Holdings Ltd))

Product:

Soft Installer Program

Description:

Soft Installer Program Setup

Version:

2.6.5.3

MD5:

f0cc152f7ea32c7db023b4950ffba8c1

SHA-1:

75b418f6ab0868f2f5dd4c51551a846c238cd285

SHA-256:

0bd41b5dd41e6ab5ccbeb4ffe91873140491764feff73b5700f4592ca8bf3daf

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/6/2024 10:40:47 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.NewMedia.Installer.Installer (M)

15.12.24.8

File size:

959.7 KB (982,776 bytes)

Product version:

2.6.1

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\teamviewer setup.exe

Digital Signature

Signed by:

Media Theory (New Media Holdings Ltd)

Authority:

GlobalSign nv-sa

Valid from:

5/25/2015 7:37:49 AM

Valid to:

5/25/2016 7:37:49 AM

Subject:

CN=Media Theory (New Media Holdings Ltd), O=Media Theory (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121BA944A31E4793A274CC4ADECFF1E7349

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:XzUYA+88/qxmNIqyIHgVRP0zKfyxHQr98X:XzZANMgmuvIu8w

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9334

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file teamviewer setup.exe has been seen being distributed by the following 9 URLs.

http://www.bodyranchtag.com/c?x=lCjVf2UPVM29jdnrMTRU//GjZJq/JJbU7jPirm07uNE=&c=V0YfzwZT3d7Uci0W sDXdzyzZeQmkV5SBh BqA0Lv5pHfqgBmSECF70pu0AEdTBU/kqp5DDpwCsHidlNGP3aEoWYW28DhSwefhcj9t5V/7HciN3d7OMhNL9nCHbLTvtNVV4UGVjERSn0E4EnUm5s6g==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.dldeliverygrab.com/c?x=QwHA6R0sLJFdiThCtfFNWf4wkTQFYNYVyHuYYRl9P3U=&c=NU6Wi4iQS936Fvtj3dEJmMNzNN2YJNqSkmdd/wQ o27C1zqWx47bDYP8onhJDZJgIgcgcnMatmHFduZI32VE0pbkRnKrckcnv70l4 P2xDWt1WWjtTx3BuGg3kX5LZ657U9zcHlJLOOPcFjbt7lOKQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=LTmbAxTUFAQ7tDTdQFhPthcHRRml9enOrD5Rr4hG734=&c=dO51ZQp9n4d8woZHSqTLWDO2zHzAkIrYi6AGwIuDE5YU/2hb3Lhn5BXaWZlX6Ym0N35YxNHKIXjLgIKlIH3O7N9SZtCKCu0 y/cOpkXeQfoZDwwAsLBPTXJSXkTXJpZx2kQ1nBfrvX63 u47HpqSLg==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=0f2ESHM5e Cnz8EToShvzoeOLOmKUg3oEhj8932D6xk=&c=WvtnlAvBYltTqHORmz749tPH0d5h/tKDJQEKRiz1odWfZAzzOa3rikema79ub53kvDqywDJ2lIw9UAylqABBTUuxOkiRGCpQhHOBI0yGnm5Fs27uUbR/dmSI5F6q485i7ikoPJrHWnrTmcJXZTw8fQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.dldeliverygrab.com/c?x=OdmZVO2VNViG33ECPUw4S4u97OVNALMXsegMRK3XLP0=&c=gmSkdTnHCjWq1TueUjXI w2HBjCwcZlYxfj56Ew36XFSZxRVqBiOLJA0lLyovmp2VKiNRP/7C2AsKWYPs24JQy BN3JBBdQukGpA9F9zTTLLkLeNf2151yehVUcG7T7dIHGBfX0RD/RrTQgF6ASoxA==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.contentpresentfactory.com/c?x=UoAzZeZxFIohMA0ldvuZUb1KQFbEeqM9/EoMS17Znps=&c=ZijgL8Xf741cuWjlsCIWJInkWjtH9rdywr533/SAZovm6pt qn8xz 5dnUsWPYXIzhZLd8XwsvzTdycby23EkPGJqinx/jMHoiWb4G1Bx3994L3dx0VWQO2zupBhd9075GVHSBMtkB1c2Lh7NadEFQ==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.contentpresentfactory.com/c?x=pwnoZ3c qgW7U2/eku0pm9PAkf4XgIWIIRno7IfqCbA=&c=MJzY9tp5MbIHgM1Hui5giq9dddFuHFmj1GAIKZov60h6R0q4UpqHw5uxlXk/2bPNby682Af0pD1Iq3GgiytRwa5MlBlY2paMnSUQuFKE1Omun9RzFhlufS2eVt37E6Z63bntmxoe0K4rzwoRYL5Uqw==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.grabpresentapplication.com/c?x=28VWBQMZ0AsXb7Es5i/gZt/5HqO8xud/oQn8m7fU15c=&c=pd7EtDFUIn5H51Redn8TqQ88ft35PatgWpNcRuCTITasIK36F4UDl3Dt43XL46sh91IWUyrJ5oeNF8FPYnQL12IJFPz7oM0uhyVVFM0Szel8ckGbk6xC1HeyFkNQVAXAr0OZHYfLUVPwhTiW/A/CEg==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

http://www.bytesendsigns.com/c?x=egPEfBVXyHR0HIF9LbU6J knVwyn5m7QkmarL2yicGg=&c=9cCxZZ4fZqSDJwpBlqDtUEpezgTut FH83SGGxEULVdaxVomXUL1Zw0vUwZbX8I8j5q5aRnS7WogDq499Tv67QmbRbunXPeO/r8pQhkfAVGrnAFg3u0KNeefHwavZyjaFrpa6FggKmKaLcIkPiEo2w==&downloadAs=TeamViewer Setup.exe&fallback_url=http://cdn.downtoad.com/.../teamviewer.exe

Remove teamviewer setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.