Gridinsoft Logo
File Icon

The Setup.exe (Web Companion) File Analysis

Updated 3 months ago
Checked by Malware Check
Setup.exe

Technical Analysis

File Name Setup.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
12288:xNTTVILL5QE1NRPU5WLZAt6u/igKyjNaDzAuS2+aFLL:uv5DNUWLZAt6YidyaNL
Scanner Version 1.0.210.174
Database Version 2025-03-09 18:00:37 UTC
⚠

Suspicious File Detected

Detected by 11 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
15%
Detection Rate
744,712
File Size (bytes)
11/72
Engines Detected
2025-03-09
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
797aa8c275abeb03a35487212468f1be
SHA1
c8e75a5dfbc6c402ba9b37a49bc880c88b03a822
SHA256
08d92d143e047449f071edfad4546f287a04e1418d5f00f6c895c37d215fe149
SHA512
679f1a0927cf7d9f3913d0d4dcc593588fea35f5fd857534accb60f490a03487df8374d44895d2bcaba6d07091654e5d22c5c63410f5a772d72a1e6982f9a562
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (11 of 72)

Bkav
W32.AIDetectMalware.CS Malicious
AVG
FileRepPup [PUP] Malicious
CrowdStrike
win/grayware_confidence_60% (W) Malicious
Symantec
Trojan.Gen.9 Malicious
Paloalto
generic.ml Malicious
Avast
FileRepPup [PUP] Malicious
DrWeb
Program.Unwanted.5536 Malicious
Trapmine
suspicious.low.ml.score Malicious
VBA32
TScope.Trojan.MSIL Malicious
MaxSecure
Trojan.Malware.300983.susgen Malicious
DeepInstinct
MALICIOUS Malicious
61 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 5d22a7ff7121dddf8a76e69fbfa77d4f
Fuzzy: 12c3f1debd31ced5359a163aa35b6563
dHash: 00118ac8c4686900
Image Base 0x00400000
Entry Point 0x004ad8d6
Compilation Time 2024-05-14 08:46:30
Checksum 0x000c364e (Actual: 0x000c364e)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Digital Signature OK
Imports 1 libraries
mscoree
Exports 0 functions
Resources 8 Resources
Sections 3 Sections

Version Information

▼
FileVersion 13.900.0.1080
ProductVersion 13.900.0.1080
FileDescription Web Companion
InternalName WebCompanion.exe
LegalCopyright c Lavasoft Limited. All Rights Reserved.
OriginalFilename WebCompanion.exe
ProductName Web Companion
Assembly Version 13.900.0.1080
CompanyName Lavasoft
LegalTrademarks (R) Lavasoft
Comments Web Companion protects you against malicious websites and dangerous links found online
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 702,684 bytes 702,976 bytes 7.22 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 4209A07BBA292AB5276ADE5EB3343D17
.rsrc 0x000ae000 27,204 bytes 27,648 bytes 4.66 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 83F6DA60AC9C4EB835E1616673758AD6
.reloc 0x000b6000 12 bytes 512 bytes 0.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ FABAF69F4E7BF029F28A304ABEF87434
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 8 (26,707 bytes)
Resource Type Count Total Size Percentage
RT_ICON 5 24,251 bytes
90.8%
RT_GROUP_ICON 1 76 bytes
0.3%
RT_VERSION 1 1,144 bytes
4.3%
RT_MANIFEST 1 1,236 bytes
4.6%

Certificate Chain Analysis

▼
Certificate Information
Product Web Companion
Description Web Companion
File Version 13.900.0.1080
Original Name WebCompanion.exe
Internal Name WebCompanion.exe
Copyright c Lavasoft Limited. All Rights Reserved.
Certificate Chain Summary
Entrust Root Certification Authority - G2 #1 Primary
Validity Period: 2009-07-07 17:25:54 → 2030-12-07 17:55:54
Signature Algorithm: sha256RSA
Serial Number: 4A 53 8C 28
Entrust Code Signing Root Certification Authority - CSBR1 #2 Chain
Validity Period: 2021-05-07 15:43:45 → 2030-11-07 16:13:45
Signature Algorithm: sha256RSA
Serial Number: 4E 40 E4 37 54 ED E6 8C 00 00 00 00 51 D3 94 7F
Entrust Extended Validation Code Signing CA - EVCS2 #3 Chain
Validity Period: 2021-05-07 19:19:52 → 2040-12-29 23:59:00
Signature Algorithm: sha512RSA
Serial Number: 35 AF B7 7B 9D 34 1F 6A FC 8F 84 46 AB 31 35 2B
7270356 Canada Inc. #4 Chain
Validity Period: 2024-05-01 14:39:26 → 2025-05-01 14:39:25
Signature Algorithm: sha256RSA
Serial Number: 25 D0 CB 9D 7B 0D 6C 70 0C DA E4 3D 24 3A B1 C6
DigiCert Timestamp 2023 #5 Chain
Validity Period: 2023-07-14 00:00:00 → 2034-10-13 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 44 AF F3 94 9D 08 39 A6 BF DB 3F 5F E5 61 16
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #6 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted Root G4 #7 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
11 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware