home

mediaplayerpro.exe

Hotigamama

Perets Smart, TOV

The application mediaplayerpro.exe, “Hotigamama Setup ” by Perets Smart, TOV has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.hostingbitspackage.com.
Publisher:
Perets Smart, TOV  (signed and verified)

Product:
Hotigamama

Description:
Hotigamama Setup

MD5:
d00ef2ceaf7a41797e5eec358cba7fa8

SHA-1:
fd7003bee2658a17c849bab4e3bed7f93689fca1

SHA-256:
9350d1630bae80ba94d1a7c6b6c05d3b0beede29581dc667b145c561ba10a057

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/24/2024 6:12:40 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.5

File size:
961.7 KB (984,816 bytes)

Product version:
2.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\mediaplayerpro.exe

Digital Signature
Signed by:
Perets Smart, TOV

Authority:
COMODO CA Limited

Valid from:
5/25/2016 8:00:00 PM

Valid to:
5/26/2017 7:59:59 PM

Subject:
CN="Perets Smart, TOV", OU=IT, O="Perets Smart, TOV", STREET="Bud. 8 kv. 60, bul. Lesi Ukrainky", L=Kiev, S=Kiev, PostalCode=01010, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
13E2E656DC165E1ACE084B816FB003FB

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:R5xNeVWGvbCuXHsxFTThsx0axAKMhkllvcAb+HZ:riWGvDXsxxqxKhkleAK

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8828

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file mediaplayerpro.exe has been seen being distributed by the following URL.

http://www.hostingbitspackage.com/2533MuDpNgJR3zMGa 9SzzSa0vod2HVr0xFEa7Tcw1hpYkjtFg_xbdjIGHxY0BKhvl28P1u6BA1n5LeiAlWjnU0iRYOeKfFjyMJMN6Y5Zowcs6L3atCZdSkxzK_Eaxbs9W1EqMJ5OiarLNudZaiPJUKDtu925fotIx8tTV NcFBLuiCtzI_mfgRBghJZi4pFaYxPwoKeO ldJT3gl0i7reqAG7J7tVQRYEVOMMa6mggnexg3cdqhjvNnWDxLvPmmUw4IfFHGZ1yLnXGqQ5OknM0Jk1RtzaPA1iofbsU6kjF4u17aqp6i29h5oXeECbZiFtjtwNPqxAmz8GThIL5gildzAQFCE6 kbXFMZZKqHvk42uJbhVQitCNKe1HyXBOSqqWKZKZ75TYZS7A5KAZ665QOpMvS UBpp1nvdhu v0aT8lv YZChd4roGhRi2CpFfyhwdPelHBs5AJAUMZors7h1sX1O7Km p5PthLgVINoMVNq XOLnwabcwWMkOzz21LFn809I_gRd_olA4uMp07Fm_yiQtTs0y4FYWhI4 BLSZDRkxKkFUkvhZPKDTtd_4xcMUOxggJPny7Wt8MzQfBr5wB3_YQOdZIAbAzalU_MVaDDeq2wVTuB7ggC_RjWoF8mMWRWMgo5_Oas8E98Us4oXLN_MWXsRoPsMAV0YVqZLFHJ20iVdfu980gYidUt4Ll26vdxUmT4IxKoLbM8j4vWNvj gU5XEgNRpPGdWTGSdveJ _FJD82oU6ZtwPPJFe0ODtlW e2GA0usTXGMdV_F DexgPNmEK2ZYLXx0Av0w7W2dlFq_KErt57JdFFgvliZ9KaOc7dKXC1y8tVeeX9XZ1joQfdpyFfbNRn_3GjkGDmNdKsU=-GzwAAORtm8 QRt34QeNKWgliEI3qQjZpSCIJdikaF PK_Y7pmOI3gMDtNyNbk3FCFVZqRr_oAXkC

Remove mediaplayerpro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.