home

updatersetup.exe

O S U

Hudson Exchange Group, LLC

The application updatersetup.exe, “ Open Software Updater” by Hudson Exchange Group has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from softwareupdateproduct.com and multiple other hosts.
Publisher:
Hudson Exchange Group, LLC  (signed and verified)

Product:
O S U

Description:
Open Software Updater

Version:
3.1.0.0

MD5:
830185d98bbaf937687e3173e5e5de0a

SHA-1:
0d35163b3ed087ab3c3165c9a695f8ce681a402c

SHA-256:
96cdee4b5dc7dbfdeb33d0a61bb0c6e253b16293df9a0c67e71004db19dc81fd

Scanner detections:
6 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 2:58:21 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2016.0.2994

Bkav FE
W32.HfsAdware
1.3.0.7133

Dr.Web
Adware.Downware.11268
9.0.1.0249

Reason Heuristics
PUP.HudsonExchangeGroup.Installer (M)
15.9.6.17

Rising Antivirus
NS:PUF.SilenceInstaller!1.9DDF[F1]
23.00.65.15904

Sophos
Open Software Updater (PUA)
4.98

File size:
694.3 KB (710,912 bytes)

Copyright:
Copyright 2015

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\updatersetup.exe

Digital Signature
Signed by:
Hudson Exchange Group, LLC

Authority:
Symantec Corporation

Valid from:
2/10/2015 4:00:00 PM

Valid to:
10/31/2016 4:59:59 PM

Subject:
CN="Hudson Exchange Group, LLC", O="Hudson Exchange Group, LLC", L=Woodcliff Lake, S=New Jersey, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
5B78F4208F4D587B6FA9A6AF8EC8FD12

File PE Metadata
Compilation timestamp:
12/5/2009 2:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:iKatHI/2feC7lSzvqmvQ0U2dBjZP2dBToKI7SOI0WQdxdngf/LoOBnxfAiv3h4x:iKaNDtlSRM2dV9IC5m0xwfT/Aiv3h4

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9433

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file updatersetup.exe has been seen being distributed by the following 37 URLs.

https://softwareupdateproduct.com/campaign/.../fixdl.php

http://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://cloud.securedownloadcdn.com/r.php?vCknmisq2KTtAx9wZetrHNykZs5gDgg8TBwgTYGVIApj7yQ6Nkyu86P7yVoccFk6gRm9P35yDuSL3ISQ3qlbxaj66HiimDoDuLMkOSSsmLdpu6gxwBJ3L2aRJsa66zKAkwV8oOALzOb4UrBq2kuOmEG67QdepXPJuKSTysF8gQcahNBk868vLOCTFQ74NWNiGFce8RmpIzAZnbkvit13iDWXt31hZPAGvMVEDi3lRDlePGK89Lbrp8oTcqacgLSLxNqb5txX7TbXzW5IHha7qz0CZbOfWH1turFAVcy36J0FF6onoyuP7ur7FgmCXo6sQL3LYBO4lPK1W8olHTaPoCW4SjGPIMiyxljwX8AiYljVtIgbBr0Z3X3VgKLYw4w4pQBnZbFXxZS0I9bkAcjE9nzp8loEpVJPLkcLwSI3SB4ALfUmse0BCA1KVppkl8a6snSZfA27c6IYmCkOQkqsUrdQQCbcKljdIbcYMf6YmOXIqhxhCXKw

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://cloud.securedownloadcdn.com/r.php?U6mjOGqZqPyZV1TrhlqXxEKkLzGarfTlmgEbX4anUJmPKgg2BHZ8mJs7i9hJpb4MsJXpO8NIRaxBqOD2wDbSmE0ENhocttYVcWl148KVihxJ6bLDOWwaAwPoOdAhHzdUvyVAHFwZX3J4fuI3ree1K3pyh0QZA4T6CPGkudksh3xwxfzYtO0eSqMarD91H28kSPEn2YPj2nPzCpy5ezj6Z6grKqsrtBMlqrIsqyMsVB2x1ADf9Xm94DAO33gwE3R5uAyU8kn3WpBX0fdadAjidU6gYnMDqEIVegQnAdrxD3vDiINwj7Ow2VM0izDJemFtCvQdJiKmlf0DYN9hVXOXSBYbaBVpXASA6JOP1ycmOc0NZa4V8SS0tQcEs74qIX1OGPEIoQ4d2502f4XnXQorHB6aJaAr7CgOsUwQKB3NG3PW8Nk6DIylkEv3O6uVILKaFg1qR5dy92uiPOotxWORAkUpqpl9b5kQmmgdruMAwgTm5hPDeEuP

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

http://urlology.blob.core.windows.net/.../UpdaterSetup.exe

https://cloud.securedownloadcdn.com/r.php?X8RXZ85mkzO2r6PuSgrsopIpvW0AmYdk75h6dmtxWhAooqTgGkI5JrufnuPKt34A8lHlIaTFst3QTW7AhPF1gagEE6o89tJhPqDyAwd3ZhUTe1uwQ9x7kOMZUb73EQlthY1RufVtxPnMQRiH1QPlEBkyMsBqiWUzVWrpbnTJcgv37OL8EAuibORXhtozqj9lfBKrZEacUGf2v0a9BFsMtkKKN9kdsuzI6k95YkhS0xUvy5F9K8WesHZfQktjP31Wnb1lvjevR91qfGzZOwehdew4y0oo3qkrBmN6G1CxbDYqkyq94EqiTXnsXLQ1catNxgTdivLt9JUtikCmZ2FSZ2kXObZ0msOTJH72dTwmDqQVLsiKvXDv0YtPatQwWEqFmxHArdX5EN0pgiaMgOihML6WfWtbBTRYrzySMvXrjYRAh1mxPEOCqVyFS2QuVIsmh0f4wdvQbmqtoM1drQPSLoxEqo8m6AJnBYr8cXYojpRHcSVDILvu

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://cloud.securedownloadcdn.com/r.php?r5hp2UOw0qPfUAVwlR8a8d8KMrESoYzQ3Qg6L4CLvs1q2WWnO4xWiGG57lYwkxnnoDu9I6VdzWEBTAZHFxEXdl2lG0S0xfoWSS5AZ0OyWtaQ39xJHbHUxJgdK8einDegvkRvkG3h9e7dnEW4QDZongB7pQqMtF3ZZUujAyBKMIX9nTeeweCUue1U4sGy7Kx7E1rfz2ZlLWv8QKmmZZgtdiniL4QTPo0upsJZuJlfGQnwBKTAKa4Xtsgex68mu9QUBAT5jfl06JwHuqheAmb4OsjlyrI3AyYb8Shs7CtdlZVPqd41zf5nHpJgQrkr0jD9bUBjx4xT4sJvFNwe3CCL1m1SOmjOFWYRRAboEIhJa1fQOL5RoHCq4EiS1BHGxFyogJNVs5ED6TtUFyM4gouk3Md4oVLWBjkR38Mwdr9jlCd1b05roAMsm0wKVhGxB1oFabbnClGYYUZ9U5BjFnL1niMjAtQcufRFq323oJ1mD1wy67SLuENS

https://cloud.securedownloadcdn.com/r.php?6ngvQYbmFeEuW3xfN35khAOn64V9oOqvbH02Gcolq3Pn6mCTpHdGi23o6YyvNY0YF11lepGEtw2zSEtimHZEJ33Q2BlPAmOfoPBCfihIOjiHYLZltYZd1333FpTfMHvaw7NMp4ueoMVmyVI2UHfWLi0qITFuBbF8isUIwpWVcSiKN0NII2EtlET3yzy9Kdh3FcLcBH7NApyopl67nLAJquMY4l8PyqSdCDpdlw1VWzjlVqsjb32ByPzCaIrI8jWKXmYiT0ePAxavYDP9HRKfHkSR2jAbDxVATUSMU7BuEM0CqPM8HwooRggUAR5do1NhVG4QNGkstl5UaR2RoqffHwahnfuLgi3cY82MPneiJjcTbfLzG1PnxZEUf9GwrKIpTLcI9q0SKdMVsxv8ylv5la0AjH6LrPbkBn2LN3DxgqtIXYRvkmBFxCfRjmCKcN5Na8yYbcwrC0azZ15joHYWjeNCAqnMdtAoB8nMkUeXUpxTrCcQkaMD

https://softwareupdateproduct.com/campaign/.../fixdl.php

http://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://cloud.securedownloadcdn.com/r.php?qb8itdqa6dEa1O7KbxTdCjTK0Afl2jntuwMYJc8PpM0qB7bMF5ZioT2ptiLwB9Z6FL4oYden0eOBm0n15njugmUJEFgfOglt1qR0D6nEkcfGcCHhZ1LgnGZ2lgh9wDDy3vyHBVlV7ACkdkBdlnuJ3uLoK3ygHcOKHnsijOeqpQLCamQwKlgNP1cz5LQMXFxF20XlOcMd2xQdTHJE20rR1Er7phUnWr2Ys0jgc6teDksx1cb3cDVehmlHDg5AI7za7SqkYUzCf19gekkqYgEgC0Xgg3RYaq9iizChucUJd30rokSmBxCdyAuPDlOOLX74xKm1WgLajLCI6u4H2HVAippVLdKwbRBICXKydvJxhlfoPk6S11sjrSfc60JhSkZuhJ3vfM2x7hWXC2PD4iXwacJgcsx4Nxz5hCAxpD4wV0tx3ja7B8DLkn2xPACD7cIoOjWdW0KS1ep5xAc9IQV3dXB3xeHFqq4fJ0tG1dy2sX70xk9gb4jp

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

https://softwareupdateproduct.com/campaign/.../fixdl.php

Latest 30 of 37 download URLs

Remove updatersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.