home

kmpaddedcode_oppercd.exe

Sundex

The application kmpaddedcode_oppercd.exe by Sundex has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from files4.downloadmanager109.com and multiple other hosts.
Publisher:
Thin Supersonic Software Installer  (signed by Sundex)

Product:
Thin Supersonic Software Installer

Version:
90.7.3.526

MD5:
c275dc5ca6b7bbafd19bf2c02963e2c0

SHA-1:
a6bcd42b8354eb082d1e133cf19bf17d1d0dae13

SHA-256:
42ac7c7bcf1c5618f02eb3efc47f714ebe6b13ff972f9f3d51b25c1f0d3db456

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 6:47:37 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.Sundex.Installer (M)
15.11.3.14

File size:
836.3 KB (856,336 bytes)

Product version:
90.7.3.526

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\kmpaddedcode_oppercd.exe

Digital Signature
Signed by:
Sundex

Authority:
GoDaddy.com, Inc.

Valid from:
9/6/2015 3:47:39 AM

Valid to:
9/6/2016 12:47:46 AM

Subject:
CN=Sundex, O=Sundex, L=San Francisco, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00F0FF9C795F266C56

File PE Metadata
Compilation timestamp:
9/11/2014 5:53:16 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
12288:nCoQ09Jz8o46iH6/xoqPLrhP1lyrMUHyevQU2rVOhX/ziqCMpelyayjXQgJZZ/KM:n7QKWjKbzFwWU2egMqVeQGz

Entry address:
0xD5EE

Entry point:
E8, 40, 05, 00, 00, E9, 57, FD, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, 30, 4D, 41, 00, 89, 0D, 2C, 4D, 41, 00, 89, 15, 28, 4D, 41, 00, 89, 1D, 24, 4D, 41, 00, 89, 35, 20, 4D, 41, 00, 89, 3D, 1C, 4D, 41, 00, 66, 8C, 15, 48, 4D, 41, 00, 66, 8C, 0D, 3C, 4D, 41, 00, 66, 8C, 1D, 18, 4D, 41, 00...
 
[+]

Entropy:
7.9671  (probably packed)

Code size:
53 KB (54,272 bytes)

The file kmpaddedcode_oppercd.exe has been seen being distributed by the following 25 URLs.

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=IR&cb=-1300280400&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=BG&cb=1508326408&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=632614353&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=1882338582&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=1162796388&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=MA&cb=1016344990&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=SI&cb=-423759411&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=-1866859293&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=SA&cb=-381779126&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=RS&cb=1145240391&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=SA&cb=875356885&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=IT&cb=-270038035&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=-1973298214&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=MY&cb=-622973779&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=IR&cb=-1541885595&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=-1978456466&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=BG&cb=310972243&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=LB&cb=318508891&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=PH&cb=499315428&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=VN&cb=1295678473&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=1331740112&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=VN&cb=-358901523&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=VN&cb=2004705674&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=RO&cb=-1109647492&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

http://files4.downloadmanager109.com/download/.../dl?bc=1188307&pid=kmp&brand=kmplayer.com&s=noprimary&country=TH&cb=1854277589&osName=unknown&browserName=unknown&zTmp=1&executable=1195377

Remove kmpaddedcode_oppercd.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.