home

winzip setup.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application winzip setup.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.capitalvaultsbits.com and multiple other hosts.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
fd337bc754a189c2be82c6dfc52f916c

SHA-1:
9ca1ba5ee7f8e6f80c43368a98f08485125eeec1

SHA-256:
84b2b2f98187172fbf82e218c5be995fce46d2f93725c4c7a9b52f1536d95885

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 4:35:04 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.16.7

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\winzip setup.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:00:20 PM

Valid to:
6/1/2016 8:33:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:aQMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:aQMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9321

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file winzip setup.exe has been seen being distributed by the following 12 URLs.

http://www.capitalvaultsbits.com/c?x=gTtad3QsZFCkpBBAjIj0YB5IUEWjHUEfajKrfvm2yCI=&c=vrxQNnL8GLhoV8U6Gcb3nVABuxo8dbf/MO9LRGLe8dUpCR4h1pHJ2FUbyZOaX9ux9nzXUdOqfUcQWNSXogTyv3l8v6vv8PdhMc5eJraD0W90HwNCJjM2nuCyG54rLEuz&downloadAs=WinZip Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/WVl6OTRQWGhoUW5wWVJUTXlTekVsTWtZME0wZHVOWHB2WWpSNmRuSjZjRnBYUkdaaWJ6azBNelpwUmtOWlpqSlRRU1V6UkNaalBTVXlSamhPUXpkTk1IRm1jVVpRV0dnMlNsTnRTa3hXWVU0bE1rWm1XbXBuY0RseFRrUmlVWEJ6U0dJNFFpVXlRbTl0VVd4d09FazBUVGxMVmtaS1MzWnRjVlpMWjFjbE1rSllNa0pWZVhoM1JtMWlRbTFtTUZGQlVsa3pPR3BtZDBkaEpUSkdTeVV5UWtGYVZXTnBjVzloZFU5RlpITldSakp1SlRKR2REVnhUeVV5UWt4eU5IbGlOMXBsUXpsa1JDWmtiM2R1Ykc5aFpFRnpQVmRwYmxwcGNDdFRaWFIxY0M1bGVHVW1abUZzYkdKaFkydGZkWEpzUFdoMGRIQWxNMEVsTWtZbE1rWjNkM2N1Wkc5M2JteHZZV1JtY21WbE5DNWpiMjBsTWtaM2FXNTZhWEFsTWtaa2IzZHViRzloWkM1d2FIQT0=

http://www.todaysendsoftware.com/c?x=kNB4A2EK Df1OeIZzmeRNrkwoSBK52/xN vqfSIa2As=&c=5l HjGiMFhKE6IxxBvKDLiNS993 5dfnMImUAeGInSToasTTUUtSiUvpv1aeMfyhHmbLgUfG5K l1cedYY1JnOusFK47Us/Jrl53Fa2dwB5pVGonaV6T/CcEX2w9dpMt1DFwKHHBbTXGGqh9wPQoiwj lAzTfvPuu05uDgGNyefx8ev80c KeaOGrvje6nZW&e=0&downloadAs=WinZip Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/WVl6OTRQVEJUWVVadmJHWldjWGMyVDI4MU9EZDVUVzUwUmtsQ1VWTldPVk5DY25Fek4wTTVNa1Z6T1hGVE4xVWxNMFFtWXoxYWVVVlNRM1JDVnlVeVFrTk9iV3A0TWpob1R5VXlSakkxWmxBNU9YcFRRMkpFV0cxd1EyVjFRVlpCUjNoVWJrWk5VamN5UzBrNE5sQlVhbVJNUjI1NGNIcHJKVEpHTVZvM2RrNXFkV0p1TWtsalVXRm5SR1YyTm5vekpUSkdjRUV3ZUZvMldEY2xNa0o2WVdsUFNIZ2xNa1pPZEVKVlNEaGllak5GTURSRFdFZG9hR3RpUTNKMFkwdGhSaVprYjNkdWJHOWhaRUZ6UFZkcGJscHBjQ3RUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdVpHOTNibXh2WVdSbWNtVmxOQzVqYjIwbE1rWjNhVzU2YVhBbE1rWmtiM2R1Ykc5aFpDNXdhSEE9

http://www.todaysendsoftware.com/c?x=hWBbZXyBUum/ABo32fb R4MTygGQbcQ730cJHHfBa5w=&c=BAp8ysFhU2Vd1fZP8A0 Ge37nYFGSFMaI8RUQXqExc3ylf4x9LyUJwGVg4d9c6aInYaIXiW6/lXWpq24d/YVpUwpHNvWnHxRYMK0mIrxd6pbjuO4Hh0me9YHNi5VBKI3qzF77NIxb5e4n4BBilvVsK5074EsDL AsmxbcaruzQE=&e=0&downloadAs=WinZip Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/WVl6OTRQVlpGYlVwU1RrTnVjMGxJTVU5SllURndNak5QTWxZelkzcFVRVUV5UmxsQ1ozTnBReVV5Um1OU2VtZFBXU1V6UkNaalBXZDZZbE0wY2pGTFREaDNTbkJJWm1WeWJXUTVWV0kzUm5wbmFuTXhOVWRtY0c5M2MxTmhTalEyV1ZwaGIzb3dUVTl4YTNCeVRreGthU1V5UWtKMmQwbFdUamtsTWtJNFJFSk5hQ1V5UWpVM1VYWXhTVWxFWWtONU5scG1OeVV5UW1RM1ZrMTNTbE5ST0hwMldGRjNVbXRrZG1Oa1lUWWxNa0pLWkVoNlpFbzRaak4wTURsM2FEWm9jeVprYjNkdWJHOWhaRUZ6UFZkcGJscHBjQ3RUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdVpHOTNibXh2WVdSbWNtVmxOQzVqYjIwbE1rWjNhVzU2YVhBbE1rWmtiM2R1Ykc5aFpDNXdhSEE9

http://www.capitalvaultsbits.com/WVl6OTRQV2cwU1ZaME1qWm1aR2xhYjFFbE1rWnpNbTFCVURCUlpuTjRUVVl4VERKMFdFRnZVWGQ2YjA0NFlqSjNjeVV6UkNaalBVWktWV2RrYzFsaVlVd2xNa0p2UzJoSVYxZDROMU42TTBwNVowWmFSR1JVSlRKQ1IwdDJORzVEWTJScVdqRlNjMFI2WXlVeVJucHBVVUoxYWtoaE1qUmpNMGhrWVVwemEwUXpkVlV3WmxWbkpUSkNRVzFsZVZsV1VHVndNMmhtT1ROWllUY3dZbGwxUm1wRlluSndRakZYVW0xaFdtOHpVMjk1VFhaNlpUTjVRblJwZW1neVNtY21aRzkzYm14dllXUkJjejFYYVc1YWFYQXJVMlYwZFhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkM2QzTG1SdmQyNXNiMkZrWm5KbFpUUXVZMjl0SlRKR2QybHVlbWx3SlRKR1pHOTNibXh2WVdRdWNHaHc=

http://www.capitalvaultsbits.com/WVl6OTRQVXAzVWxKMGVGazFUVkZpZGxsMFkzWmlTVEp3Vm10SlMwNWpWVTFGWkd3MFZXdDZabkpWTldsNGFXOGxNMFFtWXoxdGVGcExlVGhSY1dsdGFIVTRjWE0zTldGWmNpVXlRbXBHZFV4c09XMXpNMXBoYnpsSlFtczRlazVuU25GVVpsSkdlakZwVTI5b01FSmxTM2xWVTJseldEZHJXWEpQYUVocllYVmxhM0ZIVW1GamRXVmxja3hIT0haWFpqZFJiVzlvYW1aYVVDVXlRazEzUWlVeVFucHJUamh3UlZkamNVOUhWazlUVGtwdVpYcHllazl3YVNaa2IzZHViRzloWkVGelBWZHBibHBwY0N0VFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VaRzkzYm14dllXUm1jbVZsTkM1amIyMGxNa1ozYVc1NmFYQWxNa1prYjNkdWJHOWhaQzV3YUhBPQ==

http://www.capitalvaultsbits.com/WVl6OTRQVTFIVGxJM1NFaFNWRTUwZFVVMFFsUk5hVFE0Y2xZMGIxaGhNMFpMU0hnMVQwSmFjbTlzYkZwc1VXY2xNMFFtWXoxS2RFUnBhblp1YkcxWmFYWk5lbGt6YzJONmRsRjRXVkJhVjB0T1VtWnpiVXR6VmpsRlNHODRTbkp1T0hGc1YwOXdlbW96VEZGa1NsbFljVzVPV0hkSFJubHFVRXQyY25Gek0xWXlTa05QY2poRGFsb3lRVmcxVVRkaVUwcExTRk42T1NVeVFqY2xNa1lsTWtaMVdtTWxNa0o2YzJOcE5tbHdlbkZyY2toclJYcEdURGg2ZEVNNEptUnZkMjVzYjJGa1FYTTlWMmx1V21sd0sxTmxkSFZ3TG1WNFpTWm1ZV3hzWW1GamExOTFjbXc5YUhSMGNDVXpRU1V5UmlVeVJuZDNkeTVrYjNkdWJHOWhaR1p5WldVMExtTnZiU1V5Um5kcGJucHBjQ1V5Um1SdmQyNXNiMkZrTG5Cb2NBPT0=

http://www.todaysendsoftware.com/c?x=fGzuclfGL7cNiUTM750 NYJj2OBTVPlBJkYHmQXvRQk=&c=1UZ4E4wb7XwE72lkVHKPN2PJ1PvyjJUq01227P0BDmcN9GfCHy0EKsqRRFa17f2afEwejxGm0qg87iFF1pbmPWWh9BgN1xzQ5/w88EnrOpxS5dXtY3sBSKOu4Br7FPNZaeDvTPy4as1Yqz4gtU93kTRnMBolmvNB79hhbxAWnz3/sxtZeCrYzKryRApX5I5t&e=0&downloadAs=WinZip Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/WVl6OTRQVVJoU2lVeVFtUjJla1pyTlZGelFsUk5SMmhvVHpSdGFWcGFkMUZxU0VOaVFUQjNWMmhPVm1oclpuQllZeVV6UkNaalBUUTFNRFFsTWtaclVUQnNjbVU1TUZwbkpUSkNkVkJTWTNSNlMxWnpTRXhzZVRadFdqTmlhRVExTmxnbE1rWjBiQ1V5Um1sR2VVaGxOMXB2TW1sVk4zRm9OME5rUkRaUVZteFdTVUZWWmtSMmR6VktiR3AwY1VoVFlqSTRVSEZRTUc5SVduUmFTRWRHU0hCSWEzZzRjRkJ4TXlVeVJtRjVPRkV3V1hrM04xQlZXa0ZPV1NVeVFqQnFXbGRySm1SdmQyNXNiMkZrUVhNOVYybHVXbWx3SzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHWnlaV1UwTG1OdmJTVXlSbmRwYm5wcGNDVXlSbVJ2ZDI1c2IyRmtMbkJvY0E9PQ==

http://www.capitalvaultsbits.com/WVl6OTRQVTFVWW1FbE1rWlhOemhIVlNVeVFtZEhUbXBYT0doWlpsbFNTMWxDZVU5TlFWVkRlV1JpVGlVeVFqZGhTR3cwYjNNbE0wUW1ZejFIYmtSSFVVcEJSamM0U0VKU0pUSkNlVEJVZFdZM2JtaFVkMFZ1WVVSNVl6bE9hRWRhVEZOTWVEVjVZVnAxU2tzbE1rSjFVWFJwWlhZemN5VXlSa1JRZHpGNmJYUnNOVGQ2YUZvd09UZERXR1ZFYzNwdlMwdFdSR2w0ZVdwUVRsVWxNa1k1V0d4bVlWZDZTbGgyWTJoTlFVVjRTV2RTVERCMldVTkljazB5U1daMmIyOVZiRlF3Sm1SdmQyNXNiMkZrUVhNOVYybHVXbWx3SzFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um5kM2R5NWtiM2R1Ykc5aFpHWnlaV1UwTG1OdmJTVXlSbmRwYm5wcGNDVXlSbVJ2ZDI1c2IyRmtMbkJvY0E9PQ==

Remove winzip setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.