home

hd_player__cd5mtcd15092_708b7402a8ed2351fb54f186ed0e37b2.exe

Vlc Player

2432302 ONTARIO LTD.

The application hd_player__cd5mtcd15092_708b7402a8ed2351fb54f186ed0e37b2.exe by 2432302 ONTARIO has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.ohmyplayer.com and multiple other hosts.
Publisher:
Downloadius  (signed by 2432302 ONTARIO LTD.)

Product:
Vlc Player

Description:
vlcplayer

Version:
6.1.0.0

MD5:
00616dab3227062b92944f0ce054eac3

SHA-1:
1855d3e5417db89fe57a1c75ad9be910c07c443a

SHA-256:
65df41f6fb29945a1e3cc76dd486fa66f001d97a1688a51f715ceada35e5b6ab

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 5:21:29 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
PUA.Win32.Montiera
4.0.3.141015

ESET NOD32
Win32/Toolbar.Montiera
8.10569

Malwarebytes
PUP.Optional.Montiera
v2014.10.15.11

File size:
555.7 KB (569,048 bytes)

Product version:
2.0

Copyright:
Downloadius

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\hd_player__cd5mtcd15092_708b7402a8ed2351fb54f186ed0e37b2.exe

Digital Signature
Signed by:
2432302 ONTARIO LTD.

Authority:
COMODO CA Limited

Valid from:
9/9/2014 8:00:00 PM

Valid to:
9/10/2015 7:59:59 PM

Subject:
CN=2432302 ONTARIO LTD., O=2432302 ONTARIO LTD., STREET="120 East Beaver Creek Rd., Suite 200", L=Richmond Hill, S=Ontario, PostalCode=L4B 4V1, C=CA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
57767F50D877475D6CABE9215F9E4F37

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:UEwiHr/+Zvwc4Ht+pY9nWW6NPBSBdZchgB9goPis/LnaYW:HwiHwwcfpYcPBSB/igB2WLn/W

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9735

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file hd_player__cd5mtcd15092_708b7402a8ed2351fb54f186ed0e37b2.exe has been seen being distributed by the following 14 URLs.

http://www.ohmyplayer.com/.../dl0870f518302252af77290c7bae5322614d457c65.php?aflt=CD5&mt_aflt=CD15092&cid=42c395d9a1e3885e88cc6a39c79ac54e

http://jmp2offer.com/go.php?s=2104900023

http://www.sayyestohd.com/.../dl650b12b01f2511817f49d0618b9c4a1343785eb4.php?aflt=CD5&mt_aflt=CD15092&cid=19c3ed02b626067ec7ef78040c90628f

http://ebdr3.com/click?pid=923&zid=112356&aid=952644&cid=159978&advid=416&imp_time=1414111367&pclick=(null)&bnmlack=http://.../a35334d0-c524-4886-a9b7-034ec4e0a394?zone_id=[zid]&site_id=?DR_SID%&trans_id=%BNMLA_UUID%&transaction_id=%BNMLA_UUID%&subId=NjEyNjV8MTE4NTQ0fFVTfDN8MXx8|7a8ef7690fb5cb3e800a5191e4200df8

http://www.sayyestohd.com/.../dl241e20e5fec1fb0fa245a3b37853e9f22fa34b8c.php?aflt=CD5&mt_aflt=CD13378&cid=962cf3374ceb4084317cb81f16365612

http://ebdr3.com/click?pid=923&zid=112356&aid=952644&cid=159978&advid=416&imp_time=1414204665&pclick=(null)&bnmlack=http://.../a35334d0-c524-4886-a9b7-034ec4e0a394?zone_id=[zid]&site_id=?DR_SID%&trans_id=%BNMLA_UUID%&transaction_id=%BNMLA_UUID%&subId=NjEyNjV8MTE4NTQ2fFVTfDN8MXx8|7a8ef7690fb5cb3e800a5191e4200df8

http://mmtrksg.com/mt/.../&subid1=11440836741413344270

http://www.myohmyhdplayer.com/.../dl4e58ab47eb96d252d821feaedb03fc7125ba654a.php?aflt=CD5&mt_aflt=CD12524&cid=e922db3105b327d700fcb76a46f6efb7

http://www.myohmyhdplayer.com/.../dl09d58bbccb0f6a2a9e05c8664a9dde527d7ddef5.php?aflt=CD5&mt_aflt=CD26181&cid=09def3d5cc8369522c995c63fd523a6e

http://www.ohmyplayer.com/.../dl10f8650ee4bb82f9ea9500e59fa986476f96d664.php?aflt=CD5&mt_aflt=CD26181&cid=5e38db6e1dd389a2c8000a76675d38aa

http://www.myohmyhdplayer.com/.../dl1a07ab9a36d92b444d76eacd4882946692ebc647.php?aflt=CD5&mt_aflt=CD15092&cid=3a83c9972bb7ecd447b67ab5e2e95094

http://www.ohmyplayer.com/.../dl5db95b61d0b5a402cb00e23b828af4ea97a4bca4.php?aflt=CD5&mt_aflt=CD25756&cid=1e71d96d8f48d0b459cb3b8fa070f52e

http://ebdr3.com/click?pid=923&zid=112360&aid=952644&cid=159978&advid=416&imp_time=1413992746&pclick=(null)&bnmlack=http://.../a35334d0-c524-4886-a9b7-034ec4e0a394?zone_id=[zid]&site_id=?DR_SID%&trans_id=%BNMLA_UUID%&transaction_id=%BNMLA_UUID%&subId=NjEyNjV8MTE1ODk0fFVTfDN8MXx8|7a8ef7690fb5cb3e800a5191e4200df8

http://www.sayyestohd.com/.../dlf4d5348e97202e47d05ef07a18f2fef49f3b1c9e.php?aflt=CD5&mt_aflt=CD15092&cid=708b7402a8ed2351fb54f186ed0e37b2

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.