» hdvideoplayer_3435115496.exe
Overview
Analysis
File Details
Downloads (1)

hdvideoplayer_3435115496.exe

Nesino

Secure Software Products

The application hdvideoplayer_3435115496.exe, “Nesino Setup ” by Secure Software Products has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from coolbar.pro.

File name:

Publisher:

Secure Software Products (signed and verified)

Product:

Nesino

Description:

Nesino Setup

Version:

1.7.3.5

MD5:

ef925895a37a1497acfec711a273dfde

SHA-1:

30eca52eb62c18db14dcbe2152096da7be1c573a

SHA-256:

e8441e7e6625e8df70f458bd37ac0c469097ed0fe255488c29505cfdaec1b5ec

Scanner detections:

1 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:

12/27/2024 3:00:45 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore (M)

16.8.5.22

File size:

948.4 KB (971,144 bytes)

Product version:

2.5

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\hdvideoplayer_3435115496.exe

Digital Signature

Signed by:

Secure Software Products

Authority:

GoDaddy.com, Inc.

Valid from:

4/20/2016 2:59:38 AM

Valid to:

4/20/2017 2:59:38 AM

Subject:

CN=Secure Software Products, O=Secure Software Products, L=Las Vegas, S=Nevada, C=US

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

5E7095902F2C0288

File PE Metadata

Compilation timestamp:

6/20/1992 3:52:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:MF1Jc6nAE5wksdRL5E4T9LmOQJ1RmFs6tke7:meE5XsBhiqV

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9361

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file hdvideoplayer_3435115496.exe has been seen being distributed by the following URL.

http://coolbar.pro/tracker/go-new?url=http://.../lKH_z Xiw GJ2baXj8 oVyzb7MaZcqTrB2Ril IS3lhfFKg3b67x8a1p66 GOZeL_mnyAdQo6zoVk6JVFs7C7 sxUEDTZ o1GFnJKwtvTS2dT_6r9O9gWdbZrSFDN4uzCaY5P7RIa KxWXQHqoeiqrkpUNG5Qrq5m0YCnhsAjQqwYHHw87PHn42V4JB5N3dyxR4sbozlZ vC57xrbWyv9eGLORX6b2f901baZIdCSR1OMuVFK86obmwkjN6FGGI_zgaMiwvHLRJ3SvMh3wwqWEX_BTH8 8fybhnZjffQRwEXCkXcP6fKslW_Ww SteYynvoGDy8MxAue0TlOuZh1c8aXQDCZo_b8Lc DAjixl_Fud2T3y2QGmHdBf4U35xZAYE3UTOJD6oh6DrvoeODLWPxyiIMya4z_MYlQnLQ8rEbiXJ09Or5teOA1pLf5GSJd37odwAgkaCFfwhvEtjrxNQwS7x9OgTQq8sNBit_92gMEvRbsIjmr5zyA7OeZW72dPJnUz5f_gHcWVrZ6_2Rel2YXIwbrAbMogHaqK366q btWb2PoDNWGz0 _pZPisW9HeIenStAUjii9_8K_pu6Uy2Yp6ZSl8shEytN 4bS1V1GvXUy152Qy1gKHx6vuUw4in44gnWpftf3PKbChDlnzv0ulTbm847Ci8v7GNPuWrzTyncfferMtoi2QQKBpw7IdA0F6azO3OPUyH6Xl9d_6wDxM0oojp4idzztXkvZO0GDQJDAaoPhzxRmVO7aZfYfdqHjzGDUnPeTIGPg6kJYaVTMwC5o52Bd7pbTLUXBhWYNiuWe774iP8HISOsDXcltoPH2wW8b-Gy4AAEQ3F5slGeyny9EFwR_D5eddCCcCLSS3DuTGa74Jz DR685Mk8IaPXTgdNGPAg==&cid=17

Remove hdvideoplayer_3435115496.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.