home

opensubtitlesplayer.exe

OpenSubtitlesPlayer

ALLPlayer

The application opensubtitlesplayer.exe, “www.OpenSubtitles.org ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from cloclo18.cldmail.ru and multiple other hosts.
Publisher:
ALLPlayer

Product:
OpenSubtitlesPlayer

Description:
www.OpenSubtitles.org

Version:
4.6

MD5:
8ccfccaffc3262ec8091f49648cac283

SHA-1:
147b5a7757f83af0f9dbb359e301dbaf05077b0f

SHA-256:
4588db68985db304ac4da8d6fadd2fd1ffe47f4482b94e067992704536431a45

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 5:49:27 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Funmoods.3
9.0.1.0266

ESET NOD32
Win32/Toolbar.Montiera (variant)
8.10157

File size:
19.3 MB (20,251,821 bytes)

Product version:
4.6

Copyright:
Artur Majtczak

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\Program Files\java\opensubtitlesplayer.exe

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
393216:OcxBnULmmBrfRNFY2vsvt9XpwiNoQ1SlaIq4cJKyOM2cvkx3Bb+Mo0jxK:bULmelNFZk5lNrgkecJKyGBByMpK

Entry address:
0x9B60

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 66, 95, FF, FF, E8, 6D, A7, FF, FF, E8, 98, C9, FF, FF, E8, DF, C9, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, 17, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, E0, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, C8, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 17, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9998

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file opensubtitlesplayer.exe has been seen being distributed by the following 9 URLs.

https://cloclo18.cldmail.ru/6Lmb7asqNDh6GVQDDDY/G/.../softlaba.com_MKV_Player.exe

http://gsf-cf.softonic.com/147/b5a/.../file?SD_used=0&channel=WEB&fdh=yes&id_file=324577&instance=softonic_pl&type=PROGRAM&Expires=1463130665&Signature=D6vl52pDOwWBeulHL~NSnrRwYp1dytDuKWJEb6gR9p6t3cYpwdBPU4kpPK13u5q~hRC0HRg9G9CxGAPuirQCDHQ35JCc5wBqmURMxsluF6WdSbaQ6F4pS8GT-pdYlN~wthNah5jmKaHdSQYeL5D~5j1SbF9DwWAT8ztRB8ab1Nk_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=OpenSubtitlesPlayer-4.6.exe

https://cloclo21.cldmail.ru/2txpggQEDdmntszBkbQ4/G/.../softlaba.com_MKV_Player.exe

https://downloader.disk.yandex.ru/disk/607a219fff9946c1efe0541dfc24e2e5e5888b078f2e4ebac877ae25e94ac3fe/5713f79c/.../x-msdownload&fsize=20251821&hid=377ce9221c26a9b27d2dc4e469c966f2&media_type=executable&tknv=v2

https://cloclo11.cldmail.ru/esPEA7krUNHUQ1spSYM/G/.../softlaba.com_MKV_Player.exe

http://gsf-cf.softonic.com/147/b5a/.../file?SD_used=0&channel=WEB&fdh=yes&id_file=324577&instance=softonic_pl&type=PROGRAM&Expires=1468008574&Signature=OBg4CKgxnY3gSR-mDEYrOVO6EpNYeHjOxNAtM~NKF6wxXR20Smu~8Vtp1qe~iyWhcY5gn8iunpkvJCZEQA5S9uB3Y-FfPoQZI~R9DG-tCPbxEUaEkoDX0fU~pkCEeLb7vGnEq2RpdTX1xIBkGako3V19YYeeMUsCujbPGlmh8vc_&Key-Pair-Id=APKAJUA62FNWTI37JTGQ&filename=OpenSubtitlesPlayer-4.6.exe

https://cloclo22.cldmail.ru/ZoV8gjeTDDYLByfQNrh/G/.../softlaba.com_MKV_Player.exe

https://cloclo21.datacloudmail.ru/weblink/get/.../softlaba.com_MKV_Player.exe

https://cloclo3.cldmail.ru/CtMJYFkE58eePTTVrVJ/G/.../softlaba.com_MKV_Player.exe

Remove opensubtitlesplayer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.