home

hd_player__cd5mtcd13345_f2affadc3946b235928da183f7f40073.exe

Vlc Player

Downloadius S.a.r.l

The application hd_player__cd5mtcd13345_f2affadc3946b235928da183f7f40073.exe by Downloadius S.a.r.l has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.downloadmyhd.com and multiple other hosts.
Publisher:
Downloadius  (signed by Downloadius S.a.r.l)

Product:
Vlc Player

Description:
vlcplayer

Version:
6.1.0.0

MD5:
fe2cfb9158227f87935d771631d09ef4

SHA-1:
4995263afc4130b608c4806ac22e1d322bed529c

SHA-256:
465db6ac7881edf3d4ac4882cd676f106520ae7ab986690383fa91b1062e05ee

Scanner detections:
6 / 68

Status:
Adware

Analysis date:
11/27/2024 4:37:51 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/Toolbar.Montiera
8.10217

herdProtect (fuzzy)
variant of hd_player__mtcd3789_212e05631b738e80e6772fe5e5ada0f8.exe (Adware)
2014.9.27.20

McAfee
Artemis!38BCF7A0925E
5600.7046

Reason Heuristics
PUP.DownloadiusSarl.y
14.8.7.23

Trend Micro House Call
Suspicious_GEN.F47V0805
7.2.218

VIPRE Antivirus
Downloadius
32006

File size:
554.7 KB (567,992 bytes)

Product version:
2.0

Copyright:
Downloadius

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\hd_player__cd5mtcd13345_f2affadc3946b235928da183f7f40073.exe

Digital Signature
Signed by:
Downloadius S.a.r.l

Authority:
COMODO CA Limited

Valid from:
7/31/2014 7:00:00 PM

Valid to:
8/1/2015 6:59:59 PM

Subject:
CN=Downloadius S.a.r.l, O=Downloadius S.a.r.l, STREET="7, Avenue Gaston Diderich", L=Luxembourg, S=Luxembourg, PostalCode=L-1420, C=LU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
775495843B839D3AB0E83607CDC2FEB0

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:eE+DNGMr/+Zvwc4Ht+pY9nWW6NPBSBdZchgB9goPis/LnaY3:J+4MwwcfpYcPBSB/igB2WLn/3

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9735

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file hd_player__cd5mtcd13345_f2affadc3946b235928da183f7f40073.exe has been seen being distributed by the following 27 URLs.

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=5877345e8a1ef0fcec761d0f3511705b

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=4f23384940ba963fc4b4062f99d74aea

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=14f8177fd9f78f89602fd0705fdb146c

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=59c06e994d1665f388969488ef7a0f08

http://www.wantmydownload.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=7fde09712fc531c99a36f21306ac1f88

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=7f7eb65139f9d93922de5744088867b2

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=d9e3e1bc57e645e47a8b04da8c54b897

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=3cc4ac5acb98bc6762fc7eeb90e9757c

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=9dd48e80229a2c7b56c2b491ceae88b9

http://www.loadaaa.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=bb7ea51c3e121b34a79826989bef77f3

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=1e2a5aeb5590e5421a77a343bdd01a60

http://www.loadaaa.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=d2f5669e671a8947d831717c0a896bb6

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=429fb76586b4f4c205128c2d5f0f9c47

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=dcb2aec6373bfc837c384cae6e000ce9

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=6a25728877632db23ef2639d110e356b

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=251a74efc72fbab8ce68233a4a308f75

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=0b6b460a81af027f47e978a27d055131

http://www.loadaac.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=4bd96ec80994d608b14b8f8992de4f73

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=a883176cc259c0d3f267e4961f7fc61c

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=f872e10bbbf0080589b723e4fdd40cfc

http://www.wantmydownload.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=c75e8e0624ed8c949782667e3a6b7f55

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=80999b9625a8278c00ed1f57fc61a895

http://www.loadaab.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=f1b4450167a75288cb001b89e8458983

https://downloadius.s3.amazonaws.com/HD_Player__CD5MTCD5_0.exe

http://www.loadaaa.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=4bf2ad72fbeea1ec562eb583c005ea30

http://www.downloadmyhd.com/.../downloader.php?aflt=CD5&mt_aflt=CD12814&cid=d2c4df3262591f169f198eddd548f3fc

http://www.loadaaa.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=f2affadc3946b235928da183f7f40073

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.