» hdvideoplayer_3241869127.exe
Overview
Analysis
File Details
Downloads (1)

hdvideoplayer_3241869127.exe

Nesino

Secure Software Products

The application hdvideoplayer_3241869127.exe, “Nesino Setup ” by Secure Software Products has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from coolbar.pro.

File name:

Publisher:

Secure Software Products (signed and verified)

Product:

Nesino

Description:

Nesino Setup

Version:

1.7.3.5

MD5:

a3a5e4c758a4fc5fa62a3ef361386774

SHA-1:

b75f04f42289e20c0da57b9ba028c1924fae50ba

SHA-256:

00a34cc1126029081d15c5ff596f1a360c8ac446eb57dc22ed4c1314a97617a6

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

12/27/2024 3:41:28 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (M)

16.8.7.10

File size:

948.4 KB (971,144 bytes)

Product version:

2.5

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\hdvideoplayer_3241869127.exe

Digital Signature

Signed by:

Secure Software Products

Authority:

GoDaddy.com, Inc.

Valid from:

4/20/2016 4:29:38 AM

Valid to:

4/20/2017 4:29:38 AM

Subject:

CN=Secure Software Products, O=Secure Software Products, L=Las Vegas, S=Nevada, C=US

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

5E7095902F2C0288

File PE Metadata

Compilation timestamp:

6/20/1992 5:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:NF1Jc6nAE5wksdRL5E4T9LmOQJ1RmFs6tke7:/eE5XsBhiqV

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9361

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file hdvideoplayer_3241869127.exe has been seen being distributed by the following URL.

http://coolbar.pro/tracker/go-new?url=http://.../aiUNo1Pu5bQpzLww3FVto702F7t7ztFr4SspYHFCHiPEcVKxAuMgiOKrr5mKk7UULS9RSt3BdEQAfT8VYFohO8862NK6xRmB2MN0ivodKz7kUkWYTFCTaaSEexbYJuKJSN1s5zOjYLb7xpmQvjr6jFFbO_v sRqttLWWRk5Qdk9FVN_xyRILdt16hr4PZbQta9lGmhHKxiecrHuohIPd0Db8XEiamTbZBqfn2T E0502bEk3N8dSCxQFPXOCh3DQceoogQcuxme7wnassztMJxqgb3hC1YS0DTu6RbacXHzwIL M27nN6Qk2 0P8pJKH5alLBXVOaNtLTwfyWaD76DcOfHE9PLYr1Cca2P8uajhKAGz2 SLUrAN3vCHk63PYZVQS9LfAQ0K 0QjnfxV_j5wNkxYGsZ8M17yzWG7rc3d5WAyW2LB1WYcUD_bf8fQLvyG NIqboBPGPoVe4 a8Id1qaCefZ1jsGY92gicg0HuqwHVIFATA1WSvUgNgjXvHTTQGFHQJH4SF6XXsceIWhwSfu10_AG5Mliesv96uKoyCQgZUq4HHCjxv7d2zEroqSYZ58YJr_jGtVpGS8wvP9ecHUna_d2jsQHErHTZaqZRuQ00DGi0XS70lVSGU1wQQdON6tMi6 OBcrJO6VSLnxYBTfjy9r0HK7dB7aV8 cVbXLw3sKu2yi LXloX00mabjCzkmrqW4868SknPN_HlXuBhOha_IU9ZfxfQheLx EkGs4l2cRMaDUPYmwXGXm 7 GPR1lzMt3UoVRcAqVgjFB6MDcnDwNc3mK6zhijYy2dVyLjpozdxcDLeEcJITCGKxY2mcpc-Gy4AAEQ3F5slGeyny9EFwR_D5eddCCcCLSS3DuTGa74Jz DR685Mk8IaPXTgdNGPAg==&cid=12

Remove hdvideoplayer_3241869127.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.