home

player setup.exe

The executable player setup.exe has been detected as malware by 1 anti-virus scanner. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from kyle.mxp2391.com.
MD5:
2f92836a1aa45bd4aee0c75f117165ac

SHA-1:
1ad8b7d4fe619be7b5a6657e6a8c79ff4ab6892f

SHA-256:
a2bc922b7fe27a971cf1fe207e08a88084aa83ceecb1d3fe6bde23543c7b3b50

Scanner detections:
1 / 68

Status:
Malware

Analysis date:
11/25/2024 12:36:47 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Win32.Generic
16.3.7.5

File size:
1.3 MB (1,344,251 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\player setup.exe

File PE Metadata
Compilation timestamp:
9/19/2014 4:40:09 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:lOiZzDXGLFP53UG7bL1HohIE6BvRx0GOb/4+a0q3bhAqtxex:8i1DWLFP53UGe76x0ZUphdti

Entry address:
0x6BFA

Entry point:
E8, FF, 3C, 00, 00, E9, 7F, FE, FF, FF, E9, 0F, 00, 00, 00, 3B, 0D, 90, 90, 46, 00, 75, 02, F3, C3, E9, FA, 43, 00, 00, 55, 8B, EC, 83, 7D, 08, 00, 74, 2D, FF, 75, 08, 6A, 00, FF, 35, 10, A9, 46, 00, FF, 15, 68, 50, 41, 00, 85, C0, 75, 18, 56, E8, 03, 45, 00, 00, 8B, F0, FF, 15, B8, 50, 41, 00, 50, E8, 08, 45, 00, 00, 59, 89, 06, 5E, 5D, C3, 8B, 44, 24, 0C, 53, 85, C0, 74, 52, 8B, 54, 24, 08, 33, DB, 8A, 5C, 24, 0C, F7, C2, 03, 00, 00, 00, 74, 16, 8A, 0A, 83, C2, 01, 32, CB, 74, 72, 83, E8, 01, 74, 32, F7...
 
[+]

Code size:
78 KB (79,872 bytes)

The file player setup.exe has been seen being distributed by the following URL.

http://kyle.mxp2391.com/bCIj_r8w4EHSNGZfLBBis50KquiCq_rWIwAydGoHM2ln7M2PboNYzlJCVtLiMlM2KS__-YYlv9wbsT5yefl6oGDea8KUInkm1MKH515wt1G7YjKMUSrD1G5cPLslSgD4?sbb=vkw1tvITJ0rxxwoswZ7owmJeoSzN7rn5MNnpDQdZIo8F0nbQzg1PVqbcMDiLiiA1kLJx0r7fECLRkOp3VE4YMwNpgXhlcSVtUaUYVfhtw73zkMGbDn83WjybXiBLrrGKAw9S9yBVPqrqpE7eTL6V4JCZLNDmvsbUK9twKqhNwvu0qIl06lobzFfQCGutHOsi2J0pLrI4Fy4iesmRnyf33u2N4CC8PsIcu37gpF9Zanm6RuAGZRgkNuhlbw2af7MzaVen38NBcfgqatdwySXtODI4C8vvsbaye5ZZxVbioiG2NkI61sbgWHxA5DztKwmCJnUPWgWLZNuL1LGufut62h1k73WRPQ7kTawSUQtkNGQISGTScp3FXEL5GDCVepnUHm7GiUjwgrhynJJMCa9cXGQZKzCQCY62WoI4AKcCRFpzQaOfuUlJZLh76xAivbBDSSGiGa6Mfdoa9fvMjoL2U4gaVhSQjXloWS0fXzSOoS8yldtUsUgdzic5Fjq6XD1zCYjbKDPMCPm4EP3FW8sT3iQTdmNg5LfsPrm9BxK0WCEUjx86E7f7crSysX1mwKdA8lGrNGX97rdnCO7xH4kCGnsnPmDDCME2yDWJg4V1X2rrQWuVuXItekl7wUN2pvaIWfiyQIOViwBDQKeg4PRYfZaD8okaj2BRo83amOlf4j2qXLOCUktYoVyR2Jd1IoMaGIpyOqRdgvierWrtIWIJwpoKqrpFr7VXLWUGso4p92llHfrvtVNsUvIox7IPxZfIVV7knJQQGrm3LsEtNludViXc2JRM4swKPIqJ2A401bMlK4XWWOvwhfRpi9wxvHmNjHERqJFfGB4

Remove player setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.