» winrar setup.exe
Overview
Analysis
File Details
Downloads (14)

winrar setup.exe

Bage

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application winrar setup.exe, “Bage Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as WinRAR archiver but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

winrar setup.exe

Publisher:

Darwen Marketing Inc. (signed and verified)

Product:

Bage

Description:

Bage Setup

Version:

5.5.4.3

MD5:

ec114275f15a00e4b4cf638ed1be45d4

SHA-1:

866f6918e568fb9cbfcb86b37111e291db66fd3c

SHA-256:

86d8bfe5f0f8bc40c5eba0ec1d97f9a020075c054af9e78d13789f23bc915cce

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/27/2024 9:31:04 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.DarwenMa.Installer (M)

16.3.10.7

File size:

1013.4 KB (1,037,688 bytes)

Product version:

3.8.4

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\winrar setup.exe

Digital Signature

Signed by:

Darwen Marketing Inc.

Authority:

thawte, Inc.

Valid from:

2/15/2016 10:00:00 PM

Valid to:

5/17/2017 8:59:59 PM

Subject:

CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata

Compilation timestamp:

6/19/1992 7:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:ZqkRgzlGUy5dJ6zP5XvMCpBSDbF/X1IhsyPRhIT0miGNGK:ZZWZGz5+zxXvVXSDpv0sM8VNG

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file winrar setup.exe has been seen being distributed by the following 14 URLs.

http://www.todayuniversebits.com/.../ZvtzSe0c7v7xoiF5rohvdsJn3cW1aJ33R7yQT4ZCCWMu6pdGj LoXoVCsq3A3l99YvX&downloadAs=WinRAR Setup.exe

http://www.cyclecitytown.com/.../j0 EeieUm1cFxYljMU7fS8iyXjmaicV3UX0fkLabV13WnYZaqh0pwLv7CveE9R0Oh15 EnN0IZEYcoY4QZwpdtOfl8&downloadAs=WinRAR Setup.exe

http://www.towngiftchuckle.com/c?x=BSRQJuqi4QnyBL pbhV/mWp9TrwfC/NtpZN1zUg5GE0=&c=vPXIIQe/ /.../EoxfqRFqcWIUHCl1jghBQl1NPhJb9c1un6dOi2lb88B1tjLgJ8EkABE1o6BSvVOdcakzUd558Kntm9bt1UCMZZQ7dZmUKFX&downloadAs=WinRAR Setup.exe

http://www.updatefunpresent.com/.../ia NUa6J6B8gCqxVPuP8WC84Ph43PlCIgI9bstNODdI2U Z1jOj&downloadAs=WinRAR Setup.exe

http://www.updatefunpresent.com/c?x=pGox1Qvv9GdRUjwxDeH5G9o/.../9K2i0NJVsWE983Di1eiWqj7J844FxU1KdZqjg1ghMZkePQwr9QitaJJZfxPwA82RjNZXxyp&downloadAs=WinRAR Setup.exe

http://www.metapresenttours.com/c?x=pmbD poEjOTevTAj8fG6O1qBRDms7sHVGxcUMOkFvng=&c=f0Teoar3WB 25tG/pd7yP861UwELdzwBmK1FPFdu7a 6BXJkcaiw7sHhhKJw4Vkgkkrm31sNGo9sgq/.../ErPA&downloadAs=WinRAR Setup.exe

http://www.updatefunpresent.com/c?x=43TC9L mvV7XFsnNr1gjgKViFSxE4xdojo6LhzCGzTQ=&c=OaDW7zqcpLoJ0Mlo9qyhvCI3c51ht3lprhSJ0ZdEuD4ld8opWghGyFDV6NCgbY5Ya 046ncA 5H9xTuhoyL48wjEweIrS8TN9jf7LMIhGhr6SxCoVL326KWSd l0fxxz&downloadAs=WinRAR Setup.exe

http://www.todayuniversebits.com/c?x=p yZqe4cL0VJobg5vO7xjY7lj/.../b6PlTZ5ppisZaFp5edbjhj4D31KWMPbpOUQ98WO3QJgstRPbdIqyPR9XN1iMFF5mOFfnrKOXS604YdKgDWkEbRDlHtop6nvXaomYLTJRhDQD&downloadAs=WinRAR Setup.exe

http://www.metapresenttours.com/.../Mmo0qUvDFCQwQJUCuv4fvOcu6rMB&downloadAs=WinRAR Setup.exe

http://www.towngiftchuckle.com/.../6C296g2fHfMt1hatdQRhkAEPFdoPnfkDUTPT1g c=&c=Xca3KrUmqSNMTzef6qMUcgdKx6oCxIu00JRxTdaJHFwtMkaabK8MhB69NnJ4fmjChdEVHMyyt00fP6clv0btC7nc23kJdMlmTIPjDer8sX6n3xqgr0eLsShLxt5pujHp&downloadAs=WinRAR Setup.exe

http://www.towngiftchuckle.com/c?x=Z/ tA941Gkr9J7ZONKLEF1xG44fMNyAuottzv4DoB A=&c=IxVBT M8EcmzMRvWql/.../xURjrql3rRMlG9c6epvs5A26MR5fylGssNK&downloadAs=WinRAR Setup.exe

http://www.quickbinariesvaults.com/.../XKkGFyNH8UaMTXcKdoO1uosZ9M=&c=VqD730ccJ61UgVIPdC24AnIblrTH0uYgRFyl fGd THwAdg7yfwH099pi NwiUQhhaUhlEpcNZLoWGY6ZQVbkehCvhVYmwcXfaH37gGezztTAKejypWq39QM5flywG7 &downloadAs=WinRAR Setup.exe

http://www.cyclecitytown.com/c?x=40nAvPGrFqLVTIGWhAJ8w72/.../ZLSdsngkFbzR1sFWJedXkDthTSMmsfYEdTE9UA WPNfvxaymtHh&downloadAs=WinRAR Setup.exe

http://www.cyclecitytown.com/c?x=CEzsdLbGf0mUq4g3QVutZBSvUA1Xu0Ttgm6z8hvkIuY=&c=qBuZnnjLCKRd02DkrY1Ot9udJG6ksqDLVLMdyROiI7NieXC40EcSSOw 2LOqDA yGuONFZMVZ/WvTfHnMq6/.../kLS0AJLefJ&downloadAs=WinRAR Setup.exe

Remove winrar setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.