» mediaplayerplus.exe
Overview
Analysis
File Details
Downloads (8)

mediaplayerplus.exe

Dehaguris

Delivery Superb (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application mediaplayerplus.exe, “Dehaguris Setup ” by Delivery Superb (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.

File name:

mediaplayerplus.exe

Publisher:

Delivery Superb (Fried Cookie Ltd.) (signed and verified)

Product:

Dehaguris

Description:

Dehaguris Setup

Version:

5.2.2.2

MD5:

e2642c2898bbf28cd20c88b8c272034f

SHA-1:

039fdc96c3455b8a071e998fb4d5e840d344e637

SHA-256:

84df34aa16cae1311d4361d9079aed421a66f3df57ce0a44c4496274efdd66f7

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/26/2024 8:44:59 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.FC.Installer (M)

16.5.25.0

File size:

1004.4 KB (1,028,480 bytes)

Product version:

5.0

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\mediaplayerplus.exe

Digital Signature

Signed by:

Delivery Superb (Fried Cookie Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

12/17/2015 3:59:53 AM

Valid to:

6/22/2016 7:54:14 AM

Subject:

CN=Delivery Superb (Fried Cookie Ltd.), O=Delivery Superb (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

11211DDE033C8F24FD358ED7B6271AD4DE2B

File PE Metadata

Compilation timestamp:

6/19/1992 3:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:tAXig5IPGWqO0JScVrVkvyxEWgYQqDSvqGkc9YWY4UEFl3i:tfg5lRn9+vIZQ7RlLyQi

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9275

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file mediaplayerplus.exe has been seen being distributed by the following 8 URLs.

http://www.downloadclearbest.com/c?x=T3nfsYhiqR3HDewGV7gZv0woAT6h3LMvUFOcH20XFG8=&c=2siLZcwHQnTGRHbtzuuV KpBvnCkK6F5hE0fXHAo4u68t DJ3b4doMU7o EqDwXIsVdn8ulOS eP4DwSdLx/HCYWsUEBtZKEtQ3N HjYV5f7zkiPE1/jL QKtKpdsbEw8XuUcNiSFNql njpBRx04eStVtQLwvNh2talNb0xC8=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=djN8cMAo 1DatqYwzhWkNSulXcn4vlfVICx VPSUdwQ=&c=P17L8HcxpP0YXwiIEEsTCg03rGFei/KgHOJiwuTDWjKqkM9lg9Rj 4sxUj0WN3Yc9EkZIfJ2XlfuacWzMWApFWMHDS/bL cmlkSedIAbTe6S oYjHnUZa xoxLlZsagnUsPRGHqAkE8Rn3g21TWYJZgPybKfVvm8obDlHPWIZDo=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=cjRDQdkK h0vnop5LcX EM9tmm64h1wUmRFqcV5DG9g=&c=5alSx O0jltZj6ppBIEXevmpsjwui/K88NYbF84AaHjm8 eo LeIQJPSn/UhajPwyo7yEIlSpROW9q7vl1JzcKl6 qLh1b1pOFonVACEG8/CyAiJbbmjrv7l0mY4fsNQfJTB9vKDYB7fpjB8OtaedAFx4bd J8xG a2TvDmgEDY=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=3Pge1q3cvfs0bCrgDcfTzu9Nr6sFhpY8ragvEa0PS0o=&c=F2hxanBSAC8aWhMd0j3VtwC7O/eQX9tH5OLPEgu4nRYO53CFMsHRDtpmDjYZ2/nKPO/8U7REP0WQEcJTsNd/YiJhK/TQbtr8XUq9BHBxKf6EBOwQo0hbhYvZishQ93f50Y2Yrc34Ext8HJqwyp8THa5U3jyfLpKAy4NfbXAUF2o=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=QdTiUMygzc4CU0NUHW7Aw6t8pt8L66SBVWIXeN8puto=&c=XPjOLawkfdMgDPJL7jszeKIHuEshI4idQSPyl5/ZpPELDFfQu0lq5y93iQu2L/orSa8NhyfJAWo543IWBY22HKaJsGj0iBAeOak1yM5oLLyy4hevkU/LWdwJtvEi/RmHG4HNwD1IfoGjH25 k2FDR4/MLiiT7emPz2KuTfXxM9c=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=xkofJpjZ ppbLVqviDqoZusbAe5NwpRkIgLvNYGdyFs=&c=eX4smQHPo7Np4csFQW8G8fiSnsXhR0LUrgIf/ngLBYceNCDMrPQky6Luig21G8tQl8Jd7/SMv78Ruq7pUn45wuneAjAFvwiT2dSfO8 HmE8n8H3cQdXCMREjD8cvLBYzNwEeT MmP2rELtD4UN5EmzahycNlOd5xkFxs1jC/G7E=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=RfHzk7Lx/sEp/CNn8YL AxAyXldx7U9IVniv4zEr9GA=&c=UoksyhiOebbT5UnHnkhas3Oh9EB7mcQG6awZoCwCXzMVN b2YQfmKDUr3wS8o/AiQIuEYF9whjUSWbXYio8YV4Mz3x4KqU6LZ8AoRuUTIiVbNhkw60JLs16NCOAlZvazAGdbXFtvXi5trHvnZ0qwFAOzsVdA8fcge jUnsVv hU=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

http://www.downloadclearbest.com/c?x=y56SJF0j4Gfzfaf/cP tJy4GrYKN2c3WKHa0Gy0qWlM=&c=ulqhK6Qp0PffWpDNT91bhjzF6YtOB2Lcu75y41PTarCzWdsfd82UsIqqy20YvQVlhwORv5KGVshbFw4haKop3p9JQXcFKM8bXpT2/BWr2l/YTyEioUJfKDL/kif4VfxF150AG4eZJYfFSFUdVFTii9wQfl4ct5F/LuG88VP8lLk=&e=0&downloadAs=MediaPlayerPlus.exe&fallback_url=http://softdownload3.com/s4m/.../mediaplayerplus.exe

Remove mediaplayerplus.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.