home

h.264 player setup(pc).exe

H.264 Player

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dl.boxcloud.com and multiple other hosts.
Product:
H.264 Player

Description:
H.264 Player Setup

MD5:
8a0733fb767557bf094e346cea144d3c

SHA-1:
8d705f13e8518d3b8f2841706620e792c69ad640

SHA-256:
a10a2e43ff85bbe1922ec8b24d37f6e43d821463817dd19ade5afafd48f222bb

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/27/2024 4:28:59 AM UTC  (today)

File size:
2 MB (2,112,508 bytes)

Product version:
2.4

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Chinese (Simplified, China)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\h.264 player setup(pc).exe

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:C6tAeDDQoIbg60Svk3x7gm+ETVSERepx9Q9M2E3u7:C6NDfcg6jvKxQETPcPQ9Mn3u7

Entry address:
0x9B80

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 1A, 95, FF, FF, E8, E9, A6, FF, FF, E8, 78, A9, FF, FF, E8, AF, C9, FF, FF, E8, F6, C9, FF, FF, E8, D5, F2, FF, FF, E8, 3C, F4, FF, FF, 33, C0, 55, 68, 3C, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 05, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, E9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, DF, CF, FF, FF, 8B, 55, F0, B8, E4, CD, 40, 00, E8, AA, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E4, CD...
 
[+]

Entropy:
7.9961

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file h.264 player setup(pc).exe has been seen being distributed by the following 3 URLs.

https://dl.boxcloud.com/d/.../i6VV31rQ-LtUg71yGRh8nGW63QTBzxw9wDXFJQYEsoW8-mPVPuX7etQ27OMBarzfjaZmby_EpaIVhYx0sntRrJkv0E59ifEwiITm8QamPD70QIFfajDS8KM8RbGEYzyW4u8zP4VPuzSD9UJWsLDBbZ-Fu92lBzlwZ33xiCMkSuz7WBpHSL5NtldupEMKDQppPx3chEyEre4Qis2bG3Lc6yJ7DZa9IaR4j6WgovT1NpL_V7QWglOWeKo2vMtvfjzqkz98WGGfqYJTKlxI4wjqIkukWEHTBBSkf4OwUQoO9n7-VsT6UrHIYh3o2YYqSHcR1n-R-7eM2WCPJNjQRpk9cgZkweML1OsGHa3JrBeNn9bCozLsT9J6QA9J-YPylck3s45fqNVsFlqHOLW8i2EA3SqnUfSHli7P1jcgJeLc0YB29zZb980LV75MGGsbPcJCTzc473xAIrJT--JRi6qSQiz5Y4Rrm4TZO3DSars9E_rL3iMuTEOOm9VyhTtpGJDxFQTzXuzufc3LQtuFw_txflD2fqQilTM_mdIxhKWkEdgZDYDEuBxObw7eTzN4MOCT2N_0gu6rDL2EBLnqX0bGItXcvM0eluIq35kQ-5lahTL4nWHm13jYAkMlqnlkyad_pHt8vHKKUrqfL2J_t59L0Fsr2FnbdgHdae20L7TcCC4Kphk5L0L_MwFCfCiU753ONJMjSlSwvi4lK3YuOlHH_rDx_bQHOWXXI99HEbfFJ-3ou6VELme0ZyTHZltcEKyzE3r2FSYXFJ-PY1EU4OmYz3RACAiS2g6rY26q9cdubYij82XFk-qpsk53Ps39_Y0VoRvqHhxlg6lfJ02a7CxhQcqGx6pcRkhjLZCLrps4G3ZDJzG52jOGSy5-Ubz3VOQ3OiTVMCifd_LPeiEXhWmusE5eWmtiUgdM2nkfPd0jI_306oavitkd8iHhGGnMuzgDnYJonRNnoBgu

https://dl.boxcloud.com/d/.../H53M347g_RDqJ2z6XTwHHlWhlmbNkuI8BjQM3Pkq_z5giIbRADc1vMAjIMvzYOwudx3r1DXDIxQQUDQZCZFJVz-4O9vaiM5Aqt29a-dNzwnkHvxVE1Eo0cpnUJl-4LUb3487z6wxfYg7pzqdspW3oD-vY4eNM2rTYUOOOBFzte-zLlppQpnlKACDHlO2Fjr8Hkez_ivhoaROVaQpYrjX404yhJXBcgPtUNtB7EhcAIHK_mOxFTMxa9cCOKYTLQUOnQh4gO69di189DTxdX1O5dgwMjLpBYqyUCjONb3ewA2Fu5Qi6mlvULrozopXvcBbhU5Hox00rCtmtSW9uopZEPUpEE9i0aCHuYL-HD_Xo8e7ZDYDs8CIEngBKH4IqgXwMtymjekuR2cehZVslf6hoWe_XyxUSisegO7uZewG6USV9Kwnn7Kod8t8oioVIa6VAIT13cYIGkALKq85jn4LH9eyC-Zrw6ipjWpaR5vSDSQcvP4Bv8PrBeEmuqfFH3YVus6HIqgO_mvP3Re648ng4_BPz7k0mkplLmLsHn-oucF6gNNO57uBdYkYE3hCMatp_VxOP7ga_MdRKyMDs3Uyga0ZdtwmteHE18mwYyqDjIc4AucpJy7_RxmJGCApi7AAYO4v_abksVbRpbrUF35V2N9dFuqaxywGEMbKq9PpaI8FKZek2prkrGcj_18mbec4O01NPc-CrmMcc0N95yVD0iKMSgc-i42YWLx0KULiz7Kb66LgbgxM5R0fO1dqotP4bhaKlgyxlxS_1HWBo7-VitxIMAYK1Bv8IyPi6eGHE_jP8drzUTEqMEk3MvjJoLAitQzcL3sORH9pC5qUNsGa4rbyeAT5DnYpf6-8h9vHcRB1iPEhcXLIIaPoMncuiXq650mJ7-WvVhJOL-FtOb5I_JEhyhkaT3OMaPxioSaW2_e62ZjxDjwWKqTUIezM_kjcndji8s9ZrXA_

https://ferrismarketing.app.box.com/index.php?rm=box_download_shared_file&shared_name=uzau8nw72zav6n6aed83wkwfdlm5ass9&file_id=f_22596109017

Scan h.264 player setup(pc).exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.