home

gom player setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application gom player setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.centertowernow.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
867f4f864ff41989dad8eb36d4c1db34

SHA-1:
4223b18c42384a64deb95bcc28358a680c7b8848

SHA-256:
a6f94019e29f6fd9bff9a1d06fe1274706fa5c61fa46ac9a563c63b9cb0918f1

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 2:39:50 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.31.9

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\gom player setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 7:25:15 AM

Valid to:
9/2/2016 6:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:g5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:gdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file gom player setup.exe has been seen being distributed by the following 9 URLs.

http://www.centertowernow.com/c?x=s8tUGIV2cRYDga5OHt3D3Smo0qs mnCBWB1cLSy6zpE=&c=Qp76Cinz9stkq7Rhs6KhA2fnkSlBbsZNQJvkxr2bJoUNv3dWj2ygLu0XBsxuX80mpuRkpt4ZkcrDwzovkm27lmAI 8eVy9mLl1gwduI61HnXEm1NcfAtn0q4VrkmwI8eEeqyHuz4SFSWEzlCcyB6NA==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signssafebulk.com/c?x=seC4//NIHdpNF1mUS9maDg1BfB2igd3bzqgYkDA46yc=&c=klkgaHOfwvzBa5iGZWtIgw9 2AntC MBTLa0JEMbjXnCo2mgq/pc33Np5BEjLVqXr1uYl1UO03EW WyLqpP44s q5AJtdhUSeocre4MpRRrBOqIhcL8k/FvJTyyijeal2htryMRMrE0cJC15dV7ZOQ==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.universecontentvault.com/c?x=lan7pgPm4XX2eHYREVKrFUfGt5PC71jcWr4EB2zAyVw=&c=gdOJjSC iwqCrd5ax12hEMhWF/Q5pmUme9kuDomuUO9XrTviEALRTGxFa7auGVzNQYDYcZAB8Pvwn7D3R 31eejGqADUKJ2NrMJ2vdZBVXEvhdudC7b2tjLRbQtM9QM2FPSCZOtm DOcrP4OEoyuKQ==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.signssafebulk.com/c?x=QYu9FTavgYYEdS90nIH4TfufGGyJQnlYktJAs4tnDL4=&c=cze6wNoakVt0Zjyl0SCgfCvR0oYXrQcz8KAAsyJxnZNVOZuG7lFn37BsmgLUM aqNdYnWJTHLtF9EDk8RvKWS4vmfb1FgqQesHMoajpzEb09VAvW7zldhfY5dHKvh60rcJH4tsR gKSLj 80jXP9Eg==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.filescleartag.com/c?x=XIO0mrLU3Gl18wY5u7raf1oCkzh5JZ9zbmEOIGpPGWw=&c=uSc7/7HX2I s6yPgA03hlB4s FXoD7cNj8GbvFmf3vlkTQC6NUkWC2TEArhrbgb5PgFv3vmo5xrvDlD/pmbKMg DefTIQTtrcr U1nXxvAE3a3aLDpy4SU0ppfoav5eRbYcrx3WGUKe7MZ1mR4KPwQ==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.grabpresentapplication.com/c?x=inyll2jdoiF3r9bO3tWdZFf4dfgEi5BOphgMYSiE2 8=&c=vKXV6BHTCREWlTk4vRqowCtKhKI05SfR4VGMsZ7eLHc4N/C7 CQ9jyfvYm5RZSMlIjL5OoheE1n1XCkNzgr gK/ UgMKU12Zgj6T6o/R5KWaGXQGE6NiwspLwtbQO7M MU03RE15F7GMnhPXqGkucQ==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=WsOXTXV5gFBzn9Xw0lbpZUX6lCSrHKpL2o96D/vICVM=&c=4pFAq0rtdGliz0I2UUjgAf5wWCHsIdHaTlj1wfYrkGrthgpYfYsPVce3za66etBA8O2xOv0Xj7feLYdLuTWjhVEQzLT5 wPBk3gtfh3iM0xxsRWU1rV3X2ckwkW4JK1BdhCPpSNonLUIt95rzKsbEw==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=4xi7oaXD00J1zSs4SfrS/fkvcyARA6RXcumPV22mJl8=&c=qjxuN1weOPHOYVfKhA8i2NY3iiyJSqOPIRsvrJzhyRAo dGGKv6Rk3tbii9cNJ4pj4KrVzATm QFKdyoXp35UWBzTQDVQjr7Jz BBH43Fn2FEhtcvcVQ0xabydDGWlVW582Dm7744cZvTc9JX17xqg==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

http://www.chuckledownloadstag.com/c?x=CvSdk4d1FnJYdxKm W2tomno4YA5WRhNO5gZvqrOlm8=&c=GUrJyZet0h8ptxkDOcNmFqggBlZAiLbOutGRaGAmaPHI68De2ZhtdBX kZu2cjYamGeixdsmKoHr5yQrCugJcFLQkUspMKjkWN/aTmQRHPwwlhDb3wQUO6cl1Wbw8UQwzZOuFTNIs5JzguBXxF7J/g==&downloadAs=GOM Player Setup.exe&fallback_url=http://www.downloadfree3.com/landers/.../download.php

Remove gom player setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.