home

iptvplayer-setup-promo.exe

IP-TV Player WebSetup

ADSL Club Co Ltd

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from net-city.net and multiple other hosts.
Publisher:
OOO ADSL Club  (signed by ADSL Club Co Ltd)

Product:
IP-TV Player WebSetup

Version:
1.0.0.0

MD5:
daff7c5765c7ef8b8b067fe56f2170a6

SHA-1:
cc3fa146262ec8786b4b098fdcb1c02927c7e70d

SHA-256:
f2f13c5805641b6c91ba49878e0fc363a54f57f8da2526b130058a161472b380

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/24/2024 3:27:36 PM UTC  (today)

Scan engine
Detection
Engine version

Clam AntiVirus
Win.Trojan.Ramnit-8177
0.98/21511

File size:
111.9 KB (114,616 bytes)

Copyright:
© 2006-2016 BorPas-Soft, © 2009-2016 OOO ADSL Club

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\iptvplayer-setup-promo.exe

Digital Signature
Signed by:
ADSL Club Co Ltd

Authority:
Thawte, Inc.

Valid from:
6/24/2014 3:00:00 AM

Valid to:
9/23/2016 2:59:59 AM

Subject:
CN=ADSL Club Co Ltd, OU=IT, O=ADSL Club Co Ltd, L=Novosibirsk, S=Novosibirskaja oblast, C=RU

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
53F99E49636ACC9D6CB244DC2C3B4E2F

File PE Metadata
Compilation timestamp:
6/7/2009 12:41:54 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:hQpQ5EP0ijnRTXJwY9g9sA9ueiTRQUPD97tyHDqBndnyW3jRUfTORXH:hQIURTXJ5A9u/iUPB5AsB

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file iptvplayer-setup-promo.exe has been seen being distributed by the following 18 URLs.

http://net-city.net/.../player.exe

https://fs06n1.sendspace.com/dl/042fb0cb092b28f644817e58cc34e675/56f6b5927404c114/.../IpTvPlayer-websetup.exe

https://fs10n1.sendspace.com/dl/765ef7a8df21cf31c4fc32c1068edd2b/57b1c81f7973db23/.../IpTvPlayer-websetup.exe

https://fs06n5.sendspace.com/dl/1d84c83cc37093361de5a09a028d346c/5814001d427d7fa2/.../IpTvPlayer-websetup.exe

https://fs06n1.sendspace.com/dl/fefef51ce23fadf9ac8b77ebc579bcca/56f7360735af89c7/.../IpTvPlayer-websetup.exe

https://fs06n2.sendspace.com/dl/1ac79c2fcfc66004da64b258ff5bf645/57f54cf15ede0234/.../IpTvPlayer-websetup.exe

http://soft.mydiv.net/win/dlfile3ac4a_294532/.../IpTvPlayer-websetup.exe

https://fs06n1.sendspace.com/dl/2297bee3836038058bc3915aafd14714/5748e78f7daae4f1/.../IpTvPlayer-websetup.exe

https://fs06n1.sendspace.com/dl/d29c7f503f11bb6c52107ce95f301bc6/56ea43da1d8ecd15/.../IpTvPlayer-websetup.exe

https://fs06n5.sendspace.com/dl/bc4559e6a5edabac7a4e09e8669757fd/57518c8c45e7f8d6/.../IpTvPlayer-websetup.exe

https://fs06n4.sendspace.com/dl/d849405bbdbdb0de4833870ec832ccc7/574a92755c330236/.../IpTvPlayer-websetup.exe

https://fs06n5.sendspace.com/dl/9c1a98b19dcb175d8c14b3442431810b/56eb5b194694fab7/.../IpTvPlayer-websetup.exe

http://soft.mydiv.net/win/dlfiled5f4d_294532/.../IpTvPlayer-websetup.exe

http://download940.mediafire.com/2001ccpr8exg/.../IpTvPlayer-websetup.exe

https://fs06n4.sendspace.com/dl/8e25abba276d5061bda94900d164c1e7/56ea81ee59a87ebd/.../IpTvPlayer-websetup.exe

http://borpas.info/.../IpTvPlayer-websetup.exe

http://borpas.info/iptvplayer-getw

http://borpas.info/.../IpTvPlayer-setup-promo.exe

Scan iptvplayer-setup-promo.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.