vdownloader_setup.exe

Mobonulutu

FlashDelivery (New Media Holdings Ltd)

The application vdownloader_setup.exe, “Mobonulutu Setup ” by FlashDelivery (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.vaultbytehead.com and multiple other hosts.
Publisher:
Sibakasu   (signed by FlashDelivery (New Media Holdings Ltd))

Product:
Mobonulutu

Description:
Mobonulutu Setup

Version:
2.2.1.1

MD5:
669d2c9d5ef93b11ce5d87ad212265e7

SHA-1:
97d6875d1aa71629f1c4c8fa0eb63c6214aabe4d

SHA-256:
c844e7dca29c5c24d3e8e7df040599cd827080343f7308dbb4ef858322ae5eb8

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 12:25:35 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.6.6.15

File size:
1.3 MB (1,355,216 bytes)

Product version:
3.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\vdownloader_setup.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 8:14:48 PM

Valid to:
6/26/2017 6:47:33 PM

Subject:
CN=FlashDelivery (New Media Holdings Ltd), O=FlashDelivery (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112107BDB832CA5BF7FCACBF752B12BBB5B7

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:5afiuAUSBnMC2HtTw+sbYX9Bz4MgfHier9CxOq+Fdi2W2EEaQ8sw9G291A7:5aq1BnMCrBbmL10ieeF+F3EEaQ8r9G8c

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.3469

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file vdownloader_setup.exe has been seen being distributed by the following 34 URLs.

http://www.vaultbytehead.com/WVl6OTRQV05YTVhaUFJtWmpiblZ1ZDNGWmVrd3lTa1F5UzFsQk9EVkdkak5GSlRKR1NXSkdjRTl3YXprMlJETnlTU1V6UkNaalBXWndNa1I2U0ZoUFFWbG9aVkY0TTBadE9UZEVjVkZhYVVSS2EycGhObFIwYzIxclUxZE1ORXd3ZFZGcmJVTjVkV05TWlV4elFXdFdVeVV5Um1nd01tSmtUakJQVERSSE9XRjVlbTlHUzBsWGJFTnRZVTVTY0VVbE1rWkVkVmhRZDJWM2VIZHhSelZuWm1ad2JtWjZNR2RpWlhSaFoxQXpkVmhYYVcxVVMwUnZNVzU2TTNCUVRHeE9NbWt4VEhKeFduWk1RVE5uWVdGcVMyY2xNMFFsTTBRbVpUMHdKbVJ2ZDI1c2IyRmtRWE05VmtSdmQyNXNiMkZrWlhKZlUyVjBkWEF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR1oyVjBkbVJ2ZDI1c2IyRmtaWEl1WTI5dEpUSkdKVE5HY0NVelJIQnNkWE09

http://www.vaultbytehead.com/c?x=w5qLj4UXU/RFHJFn6Z53ypiL80AWha9UXuDfAoUGyy8=&c=vJPhadZavSWOKZq28SCGOu/l0j8Th1GowfhQpwNF/u/ljpwWMpJ1EWEuPz3/0iaFOKYneaTG 5l14yMJ5xEUSC9JnJrvH8qaL3FF6e0Rojmijq4auIz6TY7QUmPHvaHc1c1eV0DV rumQGHttkuBqC9wCGvH/ZvgL7QNA2rxBgc=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=m6c/F 1YMMZQn5BdTl7Oka52wGVyOUq/ZKdyY87AKDw=&c=yRE0JA/ApR0ZyVqI8e17S5HcmZNd nufZIrIyZ4rC41jT98KerdhF4YEpYOwltpa5Wd3Wxw57CpOHF 9zA6gD CRxTPVwjs3QHUgAAmgwivnW PEde/Gem3pGWiXmyWEKqsYfU0FLE1iy/lCSSwnybVONv06O67znALTETG7fhQ=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

C:\Users\Sine\Downloads\VDownloader_Setup.exe

Latest 30 of 34 download URLs

Remove vdownloader_setup.exe - Powered by Reason Core Security