home

hdvideoplayer_4185745795.exe

Palimupadi

Secure Software Products

The application hdvideoplayer_4185745795.exe, “Palimupadi Setup ” by Secure Software Products has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.headmetavault.com.
Publisher:
Cugel   (signed by Secure Software Products)

Product:
Palimupadi

Description:
Palimupadi Setup

MD5:
4ed13fb39389cacc96c8b0c8e2db04e3

SHA-1:
55feee06459065820f68dfae6c000b53b00cc1ee

SHA-256:
a0c1ba912c18181a991407966e03d7505c2fb1fb54df74c1aaf275d72bd16536

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/16/2025 2:50:12 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.1

File size:
964.6 KB (987,784 bytes)

Product version:
2.4.9

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\hdvideoplayer_4185745795.exe

Digital Signature
Signed by:
Secure Software Products

Authority:
GoDaddy.com, Inc.

Valid from:
4/19/2016 11:29:38 PM

Valid to:
4/19/2017 11:29:38 PM

Subject:
CN=Secure Software Products, O=Secure Software Products, L=Las Vegas, S=Nevada, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
5E7095902F2C0288

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:VnEybbUVTZCQHA+DJ8Uqt0yim9rJZxeIumjfgNP+wPHY:VEGOouAi8Umbz4ICNP

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file hdvideoplayer_4185745795.exe has been seen being distributed by the following URL.

http://www.headmetavault.com/YzRtU1_lauZnMUzhWFTtapaRiN2YbkPMVToGiYh5Re2ZAILs82iB9tvNfysDZumdzXEF5muPg3lrYGax3 ueQ6Pd6tI7FtE_C4dUh7LKrPC9VeEeIanuDy9Mg5uqfh4KRhbNzEDZfGjYXcxp5t GcbRLg2nTm1PPtcu4EUblokDV8EKljD5Eap TJuqOtAfLI1J3XWwCelOuZHozOvmb4aahsJGd1Zk27SDNOrU3jU0qaraGH72bxbelEtimtLWPuc1x r0UKh_BFFgxZECZs4STY8UmjkMjSETGHdYCDpAfgUtlXfhwTm_rnKsPO9h1kOEpQlr18TzHwV28_a88RJwr86cPBaQeGRFa cbhfHmzHmSvYrsbVaHT0ydUTQQy6 qfA_o2IJkDrr3s9SIB8DYym_X z4vvtdRAOA80mjKvjj2SYuEf4xEDd578wLmgOsiRo_tI2Ahz4oGOGMfkE5qR0JZ_zxjZzccagiT3i06V_us5JSde96P0RmVQrqvlseR_CVsr2PTHOADExnoWaVcF11P8EnwnW42IgrOSGhbUeiA8aQkoTOJ55873vV0ZVl_Wpcj23EdbxWx8qy68gX5mMmbkt0FAWC6_Eotf5YmpoIBq otb5SNirwcAUvuoowQPU_Sg9Ka2W9k0FpLX21wDDh6mz3h7ecpqFuw4znX09zP24Sc9acPU1oV6BnG pi_fHvCcsDO37vONkChDX_Pow9E1XTQm8HbMD00iooxNlwAKT2Dug0OeV757ev3D4eKmz4p ileI_ZpRItTmLf9kQJ_mwMLGy_VV10lF cBlVE_7vGriUbrEWM4b_cfCKzPhitpqkjcTIJTXocvuZ8Q MitjKg==-GzMAAERPFttLEnTrDwiKCRSwAQcO_ULjQDRsjJ2vBc28xvNoZCLa_MEjVhU2f2i5N_ga

Remove hdvideoplayer_4185745795.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.