home

realplayer_16-0-3-51_fr_9527.exe

Generic Prog

M6 WEB

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application realplayer_16-0-3-51_fr_9527.exe, “Generic Prog Setup ” by M6 WEB has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as RealPlayer but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Generic Software   (signed by M6 WEB)

Product:
Generic Prog

Description:
Generic Prog Setup

MD5:
23923b9c0690fc4268c279eee26d30d8

SHA-1:
6508e5810878d0a6b491251457c12609c815fd49

SHA-256:
9047b17097e80cce110ae3e702496392bd33f2dc27fba0e275ffa6f42868e121

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 2:16:02 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.7.30.17

File size:
720.2 KB (737,488 bytes)

Product version:
4.7

Copyright:
Generic

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\realplayer_16-0-3-51_fr_9527.exe

Digital Signature
Signed by:
M6 WEB

Authority:
Thawte, Inc.

Valid from:
10/14/2014 2:00:00 AM

Valid to:
10/15/2015 1:59:59 AM

Subject:
CN=M6 WEB, OU=IT, O=M6 WEB, L=LYON, S=France, C=FR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
41938036880A482F301584F5CBE39508

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:4/PpbwfmaD3QMKoL80StAlkWoqpKIDCexrqh7lyaCShFRT90wxokepjvZQrWLF:4/PVwmrMYotI9TpxpepTKriF

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file realplayer_16-0-3-51_fr_9527.exe has been seen being distributed by the following URL.

http://cdn.datafilehostfiles.com/c?x=U9aeFsanZsLZ0Vlo2VQRIkkQLf4Q5T/4XzH9aNMdqrc=&c=RMyIYEBnWi1pnplhtLBPwRptUiJ EO/7VxuZLkf4Z4 /GBuJ88vwvgdER88u8EdjuCWRGeV2Sg0LgprhpfXwjg==&downloadAs=realplayer_16-0-3-51_fr_9527.exe&fallback_url=http://lb.cdn.m6web.fr/d/c/a/0c4a492adc4c0a4e49d13f14711d40fc/554e3a69/soft/.../realplayer_16-0-3-51_fr_9527.exe

Remove realplayer_16-0-3-51_fr_9527.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.