home

gomplayerensetup.exe

GOM Player

GRETECH

The application gomplayerensetup.exe, “GOM Player Setup File” by GRETECH has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.megadlcenter.com and multiple other hosts.
Publisher:
Gretech Corporation  (signed by GRETECH)

Product:
GOM Player

Description:
GOM Player Setup File

Version:
2.2

MD5:
ff147080f8722f12382ff86ac9eb0fc6

SHA-1:
dbaf0c0fda97c524e22e680d8214f7d2b8881ce5

SHA-256:
8516b19d0d9f80c7c36bfed3b102c604c44158462b121e9528996cac6a27f7c8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 3:26:46 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.GRETECH.GretechC.Installer.Meta (L)
16.6.10.10

File size:
12.3 MB (12,850,864 bytes)

Product version:
2.2.53.5169

Copyright:
Copyright(C) 2003-2013

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Digital Signature
Signed by:
GRETECH

Authority:
VeriSign, Inc.

Valid from:
5/1/2013 7:00:00 PM

Valid to:
6/1/2015 6:59:59 PM

Subject:
CN=GRETECH, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=GRETECH, L=Gangnam-gu, S=Seoul, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
78A2255D0AB283A4DC76EF94B250B7ED

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:iOhVq/Kank99+xzTzyiyoLKzc1kQ2ExwGOQ8w4jsIdB2r/PyIEWC1WTHuH:iKqCGqEZcoLKA1k6qGOQo9+H5VCwCH

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9996

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file gomplayerensetup.exe has been seen being distributed by the following 20 URLs.

http://www.megadlcenter.com/SXbjhC6330bYcWUPIuVHBucb6s7opXSu3AmTA7UQI8GTCm_hbaIHhBsOjuFgjahlt4UPes18jXfCWpuKoUIF3dMbjKiktK1BHC6lC5f9cuk 7GYOLLpzaMkBxeQ5JdUX2sRFle1koPEOeoo9tztdFId6UQ6xqpdLlIplLxue8y_uUPxloya64j agsb_zOfyZQnyeBzhK0O04a47DtBoUmXPEiHlWOg9dkh31oQWTSp8uAPEBFFolHhW2mpzu9FuyHCmEmD2QTQe2NGSIspTwqKtC3kiGalvAw48eh6btsAsI2F99TWjKj2Q33aFotn8w5GmOJ4DJYQMBnBSCHD3AxbAvboINAzpWWZG126KHUtnJIn1nPn4h0U9FHKzkQ38IIyO8K0RUeMR_cl7QBdUiwtT1mFl2eH A76JW41tlYEMhtNiA2k9stdNfBJIMkvvR3Y4xsKWXU2R7KAlDqdIblqVCNI3G7kLLR9oImKy3Lg8aHNshpsvJBTHh7T8U8JRijH6XjweiDMnj64Ag6XC9x5f1vCvFQ==-G0MAAMTahjG9F7LhsKzHAUoXkyxwyIHDd0wTCoyCjbFzBYe9XOO i8KGe8uwzhZskNE7P1wK6u1gZiysTQ07AQ==-e

http://www.currentupdateconcepts.com/l5_w8IT1H_LXuGUEGJGV1WMdTIc6X2OWaE_vwz58dSZSSA9Bv9PN3Qfx2IS17SnAXS8_vIKKzQmHv6rDFk4zwwihmsiPDZV3chjFNFNSnMIFN2eoKTs7v1vgokkarD WFiy1wPKKlyszsAlvbn2fu uS6gFtdI4YY3Nvg1UQehZS1lasIvFQUG ezkVogo5Br6xACMx y fCYo94y 6 zCJX35WndQ==-G0MAAMTahjG9F7LhsKzHAUoXkyxwyIHDd0wTCoyCjbFzBYe9XOO i8KGe8uwzhZskNE7P1wK6u1gZiysTQ07AQ==

http://gom-player.el.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-fm6iJoaGmmJs=

http://soft.archive2.clubic.com/files/2565a18fafb783cb9c2db1763c003b7e/52a61a1a/.../gom-media-player_2-2-53-5169_fr_21309.EXE

http://qpdownload.com/data/gom-player/.../GOMPLAYERENSETUP.EXE

http://qpdownload.com/download.php?name=gom-player

http://w5.mien-phi.com/data/soft/2013/10/.../GOMPLAYERENSETUP.EXE

http://gom-player.th.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-enKSKp6SnkZQ=

http://www.slunecnice.cz/sw/gom-player/stahnout/.../?m=d37157932996a57cc3c5fa42fe7e781c&t=529fb094

http://gom-player.bg.softonic.com/.../3tjQyeLV3cjDp-Hw3sCixsiGa5-enKGIp6WilZo=

http://files.brothersoft.com/dvd_video/.../GOMPLAYERENSETUP.EXE

http://global-shared-files-l3.softonic.com/dba/f0c/.../file?nvb=20131124164754&nva=20131125044854&token=016fd8f941a536d96b1b4&id_file=36055&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=GOMPLAYERENSETUP.EXE

http://global-shared-files-l3.softonic.com/dba/f0c/.../file?nvb=20131027191939&nva=20131028072039&token=09deb8d1b93b41f3bd5b8&id_file=36055&channel=WEB&instance=softonic_en&type=PROGRAM&fdh=yes&SD_used=0&filename=GOMPLAYERENSETUP.EXE

http://www.inndir.com/inndir.php?id=37149&inndir=98b442a5075cf68bbfaf7081be0bb392&alt=

http://www.skidajmo.com/download.php?path=1199584049276

http://www.gezginler.net/indir/v/.../

http://app.gomlab.com/eng/.../GOMPLAYERENSETUP.EXE

http://usfiles.brothersoft.com/dvd_video/.../GOMPLAYERENSETUP.EXE

http://software-files-a.cnet.com/s/software/13/08/35/.../GOMPLAYERENSETUP.EXE

http://software-files-a.cnet.com/s/software/13/32/77/.../GOMPLAYERENSETUP.EXE

Remove gomplayerensetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.