home

transcribe!_setup_download.exe

DownloadGuide

Covus Pro GmbH

The application transcribe!_setup_download.exe by Covus Pro GmbH has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Covus installer.
Publisher:
Covus Pro GmbH  (signed and verified)

Product:
DownloadGuide

Version:
1.4.0.1

MD5:
268fd26d97c910a2047e3501529ced5a

SHA-1:
b1a0663938b0d828998ef296479f982b4e085618

SHA-256:
527773512159e3595498f7cc3f2dfcade4f308c1b8fc1f0a2974449e23a40461

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Includes bundled offers in the installer/download manager that include adware components such as Best-markit, and Search Protect (ClientConnect).

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/24/2024 4:34:44 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Covus.CovusPro.Bundler (M)
16.5.22.8

File size:
607.2 KB (621,800 bytes)

Product version:
1.4.0.1

Copyright:
Copyright © 2014

Original file name:
in.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Covus

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\transcribe!_setup_download.exe

Digital Signature
Signed by:
Covus Pro GmbH

Authority:
COMODO CA Limited

Valid from:
2/5/2013 1:00:00 AM

Valid to:
2/6/2014 12:59:59 AM

Subject:
CN=Covus Pro GmbH, O=Covus Pro GmbH, STREET=Schwedter Str. 263, L=Berlin, S=Berlin, PostalCode=10119, C=DE

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B3EC5582300459EBAEAA1DCABDECF1A8

File PE Metadata
Compilation timestamp:
1/17/2014 12:05:33 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:alEJERw9M9ZU6Z1s4gtZ/5uAgiboj+wwIRqAXItHKEvLuAXjd9ELMu7o:5JERw9GZZz7gJuAgCoRqAgfaAb+MuU

Entry address:
0x6F7BE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 48, B8, 00, 00, 00, 00, 00, 00, 00, 00, 49, 39, 40, 08, 74, 0C, 48, B8, 00, 00, 00, 00, 00, 00, 00, 00, FF, E0, 48, B8, 00, 00, 00, 00, 00, 00, 00, 00, FF, E0, 55, 8B, EC, 8B, 45, 10, 81, 78, 04, 7D, 1D, EA, 0C, 74, 07, B8, B6, B1, 4A, 06, EB, 05...
 
[+]

Entropy:
7.0190

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
438 KB (448,512 bytes)

Remove transcribe!_setup_download.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.