» hdvideoplayer_0849732541.exe
Overview
Analysis
File Details
Downloads (1)

hdvideoplayer_0849732541.exe

Nesino

Secure Software Products

The application hdvideoplayer_0849732541.exe, “Nesino Setup ” by Secure Software Products has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from coolbar.pro.

File name:

Publisher:

Secure Software Products (signed and verified)

Product:

Nesino

Description:

Nesino Setup

Version:

1.7.3.5

MD5:

5cf8360d94988a38b80d8fd57eeff5e6

SHA-1:

a1ad79b7013fc42d232ed422aa6cfa8bb5e9007a

SHA-256:

0f9e3a23f87903b7bcba74854b5e0debdcb3cc85be825354ab4e65c2182a7471

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

4/27/2025 11:02:30 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (M)

16.8.10.4

File size:

948.4 KB (971,144 bytes)

Product version:

2.5

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\hdvideoplayer_0849732541.exe

Digital Signature

Signed by:

Secure Software Products

Authority:

GoDaddy.com, Inc.

Valid from:

4/20/2016 2:59:38 AM

Valid to:

4/20/2017 2:59:38 AM

Subject:

CN=Secure Software Products, O=Secure Software Products, L=Las Vegas, S=Nevada, C=US

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

5E7095902F2C0288

File PE Metadata

Compilation timestamp:

6/20/1992 3:52:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:tF1Jc6nAE5wksdRL5E4T9LmOQJ1RmFs6tke7:feE5XsBhiqV

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9361

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file hdvideoplayer_0849732541.exe has been seen being distributed by the following URL.

http://coolbar.pro/tracker/go-new?url=http://.../Vj2xd153XwIsPY6fJPzeuiB66cizbfhX1vfi7MXlAPVea0psmgvY4MymgoXCuqNGG95vwk7eCIXrhBGo9ijf5mcnlvTMFcS39Cagvp_aJGypJZP1esjPRbD3WT65sNrYkRSyFzkCdycmJbTGlltHwF8kIxoj1lyHB3Fox3y_qexQN8fdJazQNcun5eBViiYMTzIFKYqCcZLGYwBwBgxzHkw yFra13HS9d3dX tCzw5IEJYaKGfWZqo V lHTISNZ8t4wmSsl0Uc8M3atNmoLmPHrZ2buvOGWoOpR SKkWYp3tX19kFCmeflY1xOTiMoqzVQJEWWJ2tu8XZh0bd HICpnxzb5XXsf3aun pQbh5lm_vBmVfhvbYiaxo Whd6_Gilzj8I0fjZNnNZ_FOf9U4OBo83SP6eAWrh4I0HjDcp8KKS CdXYPxm134aawr6UDQmN9sxdHA4DZeyYB3 Nfx7K83i48I40ujPO_Cl wDYe2Nu08Kp_3oi5DKzRU4WVCl_nMGbkaXo byrHWuXh3WkXWNU8f31r6300hB8FCuHrHovb_KpajFD_tyBzV4k7ICBrUgH0_uChLBSBqnWedhKrmKdxa_7OT 4e g3J9Q qileZKScR3soFTfFXRBJYXoVulQuTCrF 0tzq54SGhK3V QVdgevXpcfvDE4QiUJLGot914 7QWVXyTeWjgHHK2pI3NmRFUVQXgYHwXXIsOrm6GmsWy3N1RBdIQHuLC75U5NPK_p6XDAsruKzC67W tbBMkH MVBVbfnhUl5mq8Y0gkI1eHIuCNbtIyoMTmlZ7hwQB0uqiqi 0UfDxPkF4AmNxr_-Gy4AAEQ3F5slGeyny9EFwR_D5eddCCcCLSS3DuTGa74Jz DR685Mk8IaPXTgdNGPAg==&cid=16

Remove hdvideoplayer_0849732541.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.