» ilividsetup_6.exe
Overview
Analysis
File Details
Downloads (9)

ilividsetup_6.exe

iLivid

Bandoo Media Inc

The application ilividsetup_6.exe by Bandoo Media Inc has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from lp.ilivid.com and multiple other hosts.

File name:

ilividsetup_6.exe

Publisher:

Bandoo Media Inc (signed and verified)

Product:

iLivid

Description:

iLivid Install

Version:

4.0.0.2710

MD5:

e51e0ffff1c151a5fbdc4e27a9b95dfb

SHA-1:

e7b30105ed6407db1e100719ba2f7bc421ae4f66

SHA-256:

56b090904a90c4c95da0db15296ae3575ef1d905fbb6a415fe17a061c383f3bd

Scanner detections:

4 / 68

Status:

Potentially unwanted

Explanation:

May bundle additional software offers in the setup installer included a branded Ask.com Toolbar (Movies/Music Toolbar).

Analysis date:

11/27/2024 3:35:58 PM UTC (today)

Scan engine

Detection

Engine version

Dr.Web

Adware.Bandoo.12

9.0.1.0105

ESET NOD32

Win32/Toolbar.SearchSuite

8.8434

Reason Heuristics

PUP.Optional.Installer.N

14.4.15.19

Trend Micro House Call

TROJ_GEN.F47V0419

7.2.105

File size:

1.2 MB (1,274,312 bytes)

Product version:

4.0.0.2710

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\ilividsetup_6.exe

Digital Signature

Signed by:

Bandoo Media Inc

Authority:

Thawte, Inc.

Valid from:

9/18/2012 7:00:00 PM

Valid to:

10/5/2014 6:59:59 PM

Subject:

CN=Bandoo Media Inc, O=Bandoo Media Inc, L=Panama City, S=Panama, C=PA

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

32B24D9C6170CB3DA53A710307649B95

File PE Metadata

Compilation timestamp:

4/10/2010 7:19:31 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:/mJDC4SsH0/xUXl4Lo9PR4Wzsrlx1+Exg3E/Q0rg3f5+9YR7V4:/r4rwyl4LoTi4gg3E/Qvqc7V

Entry address:

0x354B

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 84, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 98, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 86, 40, 00, FF, 15, 80, 81, 40, 00, 68, 04, 86, 40, 00, 68, A0, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00... 
[+]

Entropy:

7.1089

Packer / compiler:

Nullsoft install system v2.x

Code size:

25 KB (25,600 bytes)

The file ilividsetup_6.exe has been seen being distributed by the following 9 URLs.

http://lp.ilivid.com/download?appid=400&subid=2906947979-158370-1366938520.7989-691

http://lp.ilivid.com/download?appid=400&subid=3557903414-146554-1366749872.7764-691

http://lp.ilivid.com/download?appid=400&subid=2918353851-146551-1366280849.657-691

http://lp.ilivid.com/download?appid=400&subid=2017308212-152796-1366309460.1621-1235

http://lp.ilivid.com/download?appid=400&subid=1176122319-146556-1365825766.5116-691

http://lp.ilivid.com/download?appid=400&subid=2957694787-146565-1366396761.3689-691

http://lp.ilivid.com/download?appid=400&subid=1509052262-146550-1366387447.2654-691

http://download.cdn.ilivid.com/cdn/r/.../iLividSetup_6.exe

http://download.ilivid.com/iLividSetupV1.exe

Remove ilividsetup_6.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.