home

vdownloader_setup.exe

Maraposo

FlashDelivery (New Media Holdings Ltd)

The application vdownloader_setup.exe, “Maraposo Setup ” by FlashDelivery (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.vaultbytehead.com and multiple other hosts.
Publisher:
Tufecidafo   (signed by FlashDelivery (New Media Holdings Ltd))

Product:
Maraposo

Description:
Maraposo Setup

Version:
4.2.3.3

MD5:
16a521762eaf4a074fd45019c26b8543

SHA-1:
dda01380d912cf86126b87e1de170c8a52ffa051

SHA-256:
f035be1d3b3edddecdf4c9a6612993e8cabad1b3937ee049c14d25d43229cccb

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/5/2024 2:38:21 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.5.30.12

File size:
1.2 MB (1,266,000 bytes)

Product version:
5.0.7

Copyright:
Lite

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\vdownloader_setup.exe

Digital Signature
Signed by:
FlashDelivery (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 11:14:48 PM

Valid to:
6/26/2017 9:47:33 PM

Subject:
CN=FlashDelivery (New Media Holdings Ltd), O=FlashDelivery (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112107BDB832CA5BF7FCACBF752B12BBB5B7

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:4WiWS3VlAiy0CUPdZxHUWlMcgjswIsfPRvLvwsxG8L:4HDAiyjUmWlfg339nxd

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.2981

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file vdownloader_setup.exe has been seen being distributed by the following 22 URLs.

http://www.vaultbytehead.com/c?x=lcvzMrgEVhh33gjyxcxQLOQ0nuHERR9gAG0zqqu7h20=&c=Hb67DQMTRva6JX1M1yw9GSKGPXB7659syoVef1 W/Xk8 F4w94hnR3z7qhyqdKs2w4hLIAmcMH D6P5K lEQyg5rQrH0hkuumIIplde 6oYwpTyd6cSHv3ujY0Myzh8GCE 8VdvTDuWqt1bkv 02kQ==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQVFpSYWtOdFlXeEpZVTF3VURKeGQyNXhZa2M0TTI5cGJYWmlSVThsTWtKRVJsbFNORkJ0WlNVeVFsRnBOMDA0SlRORUptTTlWVGxCV21jeldrNWtTMWRSSlRKQ2FEQjZTRXc1ZW1keGJFcFJhR3hFVDBveFNFbFdOMWhNTUVRMlVFWnpaMUY2ZWxkR1JWQldXR3R0VWs1RFFWWlBkazFxTjBWdVZteExaVU1sTWtabU4ya3lSbU0yTVNVeVFtdzJkMGRPYVhwU1RHVkNhbXh0VjB4MlYwUkNRWEJVWWxoNU5FbGxNa3h1TVhseVNqZEVlbkowVUZaRmVtOGxNa1phYmpFNVVsQjZiSEZKZG1zNWRUSkJKVEpHVVVOaFp5VXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejFXUkc5M2JteHZZV1JsY2w5VFpYUjFjQzVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtablpYUjJaRzkzYm14dllXUmxjaTVqYjIwbE1rWWxNMFp3SlRORWNHeDFjdz09

http://www.vaultbytehead.com/c?x=gH6jjM8utSu4WQSOEmtus2nsZ9WanzCztYhBWXeozEw=&c=Xq0kwUuCKN8YL6tyP8f2TBnG6ruP9XA4JcIm2tv9adXobw0xyxaumAStCo4Ul32srkcWH2dWGSgL0EhJBgd0Y nBvjfAJsiaqVH/of2a5nf /PF78GdF00HC90AQp/KJKuE9xpxCmIbHHBSegB/RbDhcmNUvNj V2Aml56Jy8Ss=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=Pu12AdU9Ahjq7QAr9GCmfIF/7eNK4nRQ2vLgtGyZjwE=&c=RMJkvaHvcimIOB3jkd24WWMFCprwrYg36nFKYIj049Pcgx1P1vW3OafQ RAF2pLPnzBlomtAEgN3XD4IkhImiGB7Z3W4pSoaO5fBG8KM2cFVGD15UVreKB8F 9W60Hdb85s7QscDsALqYx8IqWo1VrRxK2fpPFsbs4vwwHHksrQ=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=01d BAKt6FXPUSCbGzd5QI52pQ1GD6RSjnDzqCNR2tM=&c=pzcSG W 2Sp16RbeiFpyAkw9iDGtYehq344iDhwtYn55lhJTlOFHtW8TXZiBrlpGAwknwwkq19nAbVC76KwOxhJMAvyxcvb9bzey0VJLJuB/3aAe0eKYKL2VCk0zEAToA A665Dt2UxAodOfeuVf4PEYyrum5nfvChEIuhoJiOc=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=njsMMhk3cxNB8PpnF r3sJcu9ODa4saf50F1h0yNNOo=&c=inuLlAvD29EbXH6E/yvlnE9/R0chQDky11qxhZ6PCgPIqvNfIEy25Jl6q9BG XEJIfZd/a44uEIKwJ/TD9HRl/3TFxFQdw9KYDdRlmg7eAfl06Gl2ORftlQJ 4uATCrjeOyshnGCND8kv2i5J4YU1V6VfBlSie4D0LY3P4LEEqE=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=PRDD4SzpX9w4Mm/rf35RuhHCDrqstinw1wIBnMlLH1Y=&c=VKy mdcAUI0rGIMiodnt50ODRus5sZ gCoAWwW0YE z/ucAAIJj3qNkXDispF/3sxzKIjQB2uVQ8nFGztwffAgn4vHp LcIhc0avRopjhJ IgW5psNI/xflZZ1mC4 VB2R5W2gX9h1wTlk97/epp4qmOO 4mz1n1tYNfjY7oiRM=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=kQ/3Zl2NBwjk4OWIyBoiB1FVuJ U/snen2ybsxC 2t0=&c=Q0 GyRUlrq6Yg1QzcucwZ8g3Uhy/MN9qRuxS9Rs wvOvuf6DuYKIIon29Z64aGQY8l1XOyosLS2 NFLBItKeyKjpGnH94NrGY3H2StDcCJbI1OU7jL9QIT9nKHr/P2GLYatoa21NE373yMG0W9x1hg==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=wFoAG/8ZK4W8HZRmrZsFOr82VIyXmRPu6ct95U88Dzk=&c=xxVKxbxDtIMqJPeNNZ97zZHn7K6dVw43qRcnIM4ug6AAKfb2M1svVF404AQ8yif3Z6gwLJPHMZJMm4NVjseN0mOb5Ie3r7N5mL4Y17nhmjPBzlaXGMIb0xCUR0nY8wMFhkAskD1AsEs9iQMGGjxPklZYJo7J7pEMh6iOAq6j58Y=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=fRwOrBPc1b2NuZsEK4zw3izV1BFAI/lSVnS5JGTW7uo=&c=BYjooEFV2/QR6SbybtMiJ2NCCVqKzgq4/pFnJzMiYIAoErLG2kbjzHIXFdtMITGUcMg5JJ92CTuKOTmptljWh2TUVoAeXVA4P1Pr 4UdzYs7nc5JQ/eACRIzQjvxJfdsYQ4O4fl5h CGhHqFTiLM5r5/Hl1HNzVkJuUogFDYC9c=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=xk6EfjAIvJEOfRDeWQ3b6TXPoM0QtKq4gJbkKnBJ/r8=&c=y1vi/adVNKQ8EiPy4eI0TN5O/gtUcAbuxvtivEl5TI08X3T5Woq2TIyphJCt803nk0bQ/vg/gkwLREm6Jp WdQCGwUQqh920QFiwWpH7x hHosglEoHRPtp92HE63EMlzn2wVEqso49wrns4DwQiOwl4HnOzoMHLqEYA50ZM0Ms=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=uDlFvk4b6rDmjcoX6 iEd7ER7zi1S2fKzIaLAMlwDRE=&c=LD7GhLc40xGYXxzrDgod0w8ikzsnRfSK3Q46CyG8sPFuBLSo kbv6LXOfIBr3RL2yUFg1B GQU8UZeRxMiS/37n MrKEsVKU eCuoEeVc6MB7uvrHfOpvI5sgXAvi42vi3grwWvke uc1m41q/LH3MeNJyMVtnnEKrP8YpkBg9k=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=Ms67WILsRCTgkcMbGH4pv6TWtLZsZSx7ClaSUpdZsCk=&c=c2Ng5KSJw6issGyGVCAfH1md5dVNCqFSiqCwyw7ApTnevxPz0fH/cQMINLX P/HNswSa8Dwa28N/zOss1T85ok2QjdHja8ZuCsDipNoBOR8er6QP/oWxbrHD8QpJ9 5RqGRuJDCA9gxxSpXPzQkSA9oKnUcQlSW9oqzDG1KH1g0=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=ZDoUvT1LM6e1ExX8awniCLlnZbmvx9u8omAc9pW7iJg=&c=CEAj5g uD2Z6AxWUoeus9pA/PjJwahlfJgIuarAI5BfBXawcCD0ZXOqGWC2kCpYvZjCsjGvpAqJaZ7qeP8B23jn139PV9yMITAwpeJI1slljEkYPYYVv/Wsp7t/uXjEp9xlu5BdhoOjCbHPBSRrRuw==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=EVIePAzJE2aAa3fpjQ8Jxp6XqBM8SqR1 8TWMxVs5oE=&c=jSIHvf9Fxfo8lvZyntF3398SOofU3yFlLMxQl6HMKJiF8R1r8YXns4ksguEYjTXsB3ouzxGlQ7O4VMaPlb3TbJBCBuUpM2QRcKJTCw6zdF4wp3Dt5MdP3mLV co3jyB47SCs9yOCe/ qGPnbiRXcIZBv oi/m bjX8LOfcVvbg8=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQVlZJTXpGaFFuSlFRVU5sT0hSSFV6WkNUVFZ3UzNrMFVGTldUR2RFYUhsSk1UTXpOMGRVU0VsNWVUQWxNMFFtWXoxVVZFRkpWa1V4TTFOVFNGVXdVbTFHZUZwSE5tWkhWMlprVlZVelEzQklVRTlFUjI4bE1rSktSMjV0Vm1keVJGSndjbHBsYXpsRE1FdExjVVJSYWs1TE1qRTJWMU0yZVUwMVpFNTZSbU5TVGxFNWJ6STRUaVV5UWlVeVFtZzJkbWgxUkVKalNuUlVSSGhqVlhwS1VqSkdkalpqTlZaV1JYVk5hbkYyWlU5SWFuTktja05VV0ZSdlR6WlRlRzFXWWpsUmNGSTJhRFExTVcxcWNHY2xNMFFsTTBRbVpUMHdKbVJ2ZDI1c2IyRmtRWE05VmtSdmQyNXNiMkZrWlhKZlUyVjBkWEF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR1oyVjBkbVJ2ZDI1c2IyRmtaWEl1WTI5dEpUSkdKVE5HY0NVelJIQnNkWE09

http://www.vaultbytehead.com/c?x=MCeTv8Wz2eennze4LMul1fDLXKR8NzXVUKaJzfSTNog=&c=2tvfPpo2vX9bAJn2wP G87FZxNsSBSCc XxKswxMLm/hAmEd6QvGuxdmvsT50hb6f3LqLlOrHM9zYjzoDVTP7MumMJ6bXNt wdajFLC8Pl5O3rOz6glDmM8FPPymDiU8sG88AdqwQ8hxDAoSRJnqqw==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=U5qf9GYhcWlD0xfVAM0/29AkzMwkoUI0RQr9CzhBy4Q=&c=URvhD1Q/0LciEG1LKQa78NROgR1wj39GteoQs4me e iCkU56XxY0etYZSSzsp3F12NV7qAbFc0apfzEsyubUJ5qYgo2pxWKoZL8rimMgFKVk3u2XaqWeN5Rn7TRlnZqswTvyKeXGKPM07NHX SloHWOqLhvok0EDwqQHnOe9os=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=EElEBkfKRj6JcWXU2YbUPA/vteX/I5BIxfqhcs8sey0=&c=EIpXF0zCijAhKv7ffi0yCOOmt/EKY3LByZBfsICWB6FvMuLXS4c0soQCINcDv1MDYZkChMFW0eYI76TTfSbQV5vmK0jf6YApdkfPoGORVg8Ub/SAi8ono5JJQlPGcvgdCd0buafoFbXd2MabImal9g==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=N9RJRg 8B5QNT4VfghyB7QOFDwOMXXooqt NC9ct4aQ=&c=gIR3Y3D/Zq8pcUW964GkdJqqxzRCZLvloI4UwJKBcsj9cW cQNT43XA8cgOyFY8rJ5jCaBD5 N76IZPoId4k6Uitkw78disCuS3O2gTJJveFBssEwi6DAbxZsiMlRvM3xmSYYSw/mm15Q5ulJVWLnnSDg9Jqp9yIdUCozh3rWis=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=6pWJGX9bPGrzqEGoGH1g8/ goQB5zijxO9 KKRA6SOY=&c=bnJEgKp4EMRsc6mnnoPcvfd01InP5yMSZBGaZS9GTPoY4qr/efyJe1wWdt2PS0vRFEeK6ghATAUD6NqYGsbArB wjRkxnCVeGWaK59k0nQaEaCGLYwPyse5iLd8Z 9WPHp7BOUQsm0qSKUdKm81NIUjEzKQsfeaZ/Z7czWOdyQ=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=onb2BdJwREuiBQPqi5cMyMWjQBRrEOKU6NdElYpGBeM=&c=W6 XbAuQAzfLTFPjIM6qQa4gkpmksAAO0UAkKYPHAXkV4PCaXwfSt0y43X4oBRROwBfjjt8qZFSBi/oZ9nfoY3HrMU9YQ/VZ2clUB6ORw4ZriLvOSaDB1aNq/G5l4g4Jtu8tcMjdp1S0IvQwO4Y1iA==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

Remove vdownloader_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.