home

weatherbugsetup.exe

WeatherBug

WeatherBug

The application weatherbugsetup.exe, “WeatherBug Installation ” by WeatherBug has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from cdn.off-200.com and multiple other hosts.
Publisher:
Earth Networks, Inc.   (signed by WeatherBug)

Product:
WeatherBug®

Description:
WeatherBug Installation

Version:
10.0.7.4

MD5:
81e80f8a38b0b5adff2a038595c67236

SHA-1:
e3501c2006e7b8368d388687871dcc60f59ba4cc

SHA-256:
bdb7197791b0aa5c3efb39df332f545556a73cdeabedb3792718dd220340fdc0

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/25/2024 1:09:28 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.WeatherB.Installer (M)
16.3.22.20

File size:
3.2 MB (3,397,912 bytes)

Product version:
10.0.7.4 0

Copyright:
All rights reserved

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\weatherbugsetup.exe

Digital Signature
Signed by:
WeatherBug

Authority:
Symantec Corporation

Valid from:
6/15/2015 5:00:00 PM

Valid to:
7/15/2018 4:59:59 PM

Subject:
CN=WeatherBug, O=WeatherBug, L=Germantown, S=Maryland, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
5753B94A4B4F428A574131A68539135D

File PE Metadata
Compilation timestamp:
12/10/2012 4:51:25 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
98304:R5dURE8TLxNYxeAVJPMVkj/ch2vpJUYOqKdpoRaK:R5dURE6NT8JPMyjvprOn7o8K

Entry address:
0x12C10

Entry point:
6A, 60, 68, B8, A2, 41, 00, E8, C0, 03, 00, 00, BF, 94, 00, 00, 00, 8B, C7, E8, 28, 18, 00, 00, 89, 65, E8, 8B, F4, 89, 3E, 56, FF, 15, E8, A0, 41, 00, 8B, 4E, 10, 89, 0D, 24, 0D, 42, 00, 8B, 46, 04, A3, 30, 0D, 42, 00, 8B, 56, 08, 89, 15, 34, 0D, 42, 00, 8B, 76, 0C, 81, E6, FF, 7F, 00, 00, 89, 35, 28, 0D, 42, 00, 83, F9, 02, 74, 0C, 81, CE, 00, 80, 00, 00, 89, 35, 28, 0D, 42, 00, C1, E0, 08, 03, C2, A3, 2C, 0D, 42, 00, 33, F6, 56, 8B, 3D, A8, A1, 41, 00, FF, D7, 66, 81, 38, 4D, 5A, 75, 1F, 8B, 48, 3C, 03...
 
[+]

Entropy:
7.9580

Developed / compiled with:
Microsoft Visual C++ v7.0

Code size:
97 KB (99,328 bytes)

The file weatherbugsetup.exe has been seen being distributed by the following 3 URLs.

http://cdn.off-200.com/downloads/offers/.../WeatherBugSetup.exe

http://downloads.earthnetworks.com/DesktopApp10/Installer/.../WeatherBugSetup.exe

http://downloads.earthnetworks.com.s3.amazonaws.com/DesktopApp10/Installer/.../WeatherBugSetup.exe

Remove weatherbugsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.