home

vdownloader_setup.exe

Hoc

FlashDelivery (New Media Holdings Ltd)

The application vdownloader_setup.exe, “Hoc Setup ” by FlashDelivery (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.vaultbytehead.com and multiple other hosts.
Publisher:
FlashDelivery (New Media Holdings Ltd)  (signed and verified)

Product:
Hoc

Description:
Hoc Setup

Version:
5.7.3.5

MD5:
8e535c41804cf43f15190db6c6d6679f

SHA-1:
eb8530452478552e4f9b8778ca7fc7cc6fcecaa8

SHA-256:
0ecd48978475e8e4eacc87516edc358d5bc9fe4280fc2a93994db33d374487fa

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/5/2024 2:34:42 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.6.6.13

File size:
1.2 MB (1,264,360 bytes)

Product version:
1.5.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Digital Signature
Signed by:
FlashDelivery (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
3/15/2016 1:14:48 PM

Valid to:
6/26/2017 11:47:33 AM

Subject:
CN=FlashDelivery (New Media Holdings Ltd), O=FlashDelivery (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112107BDB832CA5BF7FCACBF752B12BBB5B7

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:0olb2sAg7GJiL06Z37+CTS9oQIe94cNC7kPxkV14vv:0kCEG80/87+1xmE

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file vdownloader_setup.exe has been seen being distributed by the following 28 URLs.

http://www.vaultbytehead.com/c?x=fujW B3yFu9LoCOpyXt8/9FP5Xp73ZGEXVGGUqrUPoI=&c=kE0EimD0nEq/UJGQbPotDFANnYVs234Gjcz7LvBghP2QZ9bEkwSjr475STyEe SxONe3zk/TBCsiHgDMu6osO5t/kvLyRTyhEnNRSAjX3NLgBsh2/2EVwMMS/m5gEe58ks0yJY5ibm82plgoX6dcLdAPKjJX tGisbeHikMXVQY=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=iiNteiCyLTDtnglsyZGib 4gTDIXXh/N3AiKQtP47bg=&c=0s8QQMV2kBsEynXmF77JUguFuufXfQmbkEGX0iPxjaC44byNfxNiba/fzk8hjPaaQ5UcJcTbF7bFsgLs01Y9HbD7K9efkj/wmG2Dkue3VYDPE mhrRMiWzzVfee 9 yzXSK60fCTBl7PLE0J3dxE5w==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=TRDv66jjsOv0JzRJ qYL67O5fdGFKFnqUJpA3kCX O8=&c=IlYxUgKPulrOkNZrKQvQ9qIQkPdv54hqwjI0tsXUFXHnflcW4Ey7YLoKxrInYeUnzZn47a9TzIbEQOpFfGXZJs8jieEaLrHMK7wfoJcKm2zEiUYuLCYiUG0itu7dBd 7r/KltoqIME cQuBMYmxGag==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=VeWbOV7IcEkE1T7ayl1SSUwTnUW3WKrSOE8ISz2JxhI=&c=aeVaJUE3T2IVtOaK mOw/.../huqMmmD4zcFk3rbsshett1EwrFOnHknfSi74mbhejLYA0FMMEyNc8qwADobuDTXzY5ueeyW6A=&e=0

http://www.vaultbytehead.com/c?x=M15xvpn7RwFXl/4XBsSe3MFMco0yARkrwJlTK5nBMyg=&c=4D6foz9NT2pfOQ9IuM9BlAszQHhpq57ZO4hw4PPhjv9b806htjcMHsNei7SkSC89Hao/F9AN5mq5ykRtS6S4KTnj4QLKd1bXiDcCq0fN6HkLqDfvegQEjGvmC AnuTnqM5Bjc2mOGPGAHhgo7ydlNKz5oUuNp/l1oA7Gjbt53zw=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=HQ/EYbvoXwfqYeW sfNdcQHZpgGvVsKHw8Gj0FdjUps=&c=AQA64juyxotmG/PaOGeq4h4tO8Nn39vnlKrhcMmABIwKj7V42AZ6khnwimLKeSNt8ep0Nt xxFFE8b/5K5bIeXhs57xsxPVP1dfKWmusqR3Jz6ImlxvnL2Kk5f6gMcqek5v5 Gpi3SFWXkDAdFPDLJEv7ftnk6EUJle RmWBusQ=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQVWxyVGs1alJ6ZzRaR3hhTUhBbE1rSXpRMGxuUkRKMFJXNXRXWHBxVmxwbFJVbEtlVlkzTW1OWlZXeDFieVV6UkNaalBXZEdUblZ6V1hSbmNESTFVMDk1TlZNelZpVXlSbFU1UWtOeGNIRXlXbFo2YzBjbE1rWlRlbXMxWjI5Q1pHdEViVEpCT1dWMFNVdzFWVXBGZWpWVUpUSkNjVGczWlhKU1NsaE5KVEpHWlhZNWIyTkZhekk1VUVjeVIyZzBKVEpDTjJwc1RVVm1RMWg0SlRKR2RsRWxNa1p2ZUd4RFIwUjZlRVJySlRKQ2NUaGFaamxTZURoVmVVYzVaMWRsTjBGRU0xVmFVM0ppTWxWblUwbDVlSFUyVUZFNFFqaG1iRUVsTTBRbE0wUW1aVDB3

http://www.vaultbytehead.com/c?x=OK3vvMgMdwksmc1OLeM0zbHxFbe0kHB7WLRxjP2xxgk=&c=c33FLJ9tqGWjyN kAh56a1DmBW0LLvUtBlYVq6t26Ov8Aeq W6lI6DZq/dCTU2qzZnLl2OUirq5P1TZEvdOgbWchTqeAEd4sU8k642z188gl12g5 BF5D59d5RuOhlV9VGiKEk5g25/J/9IGClJO6Q==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=MwJqLby8eEQAPQi8x6DqUZu1Rka2Rpmb0bAQ2Jxdooc=&c=SRGM7iJkJ/nuRJ27LQSfDf5nbrNazZplSWjeLu36MJg11GxRYViG5xYPmgWm9pnldpwReWK2czulrx22MIOqaomWFH8uiTuhOkHPAtLnPo8plKPzhxOdxJlh6ZrmvRi AjNVSJF9CH2Vx24OXqgURFhUwuGSDfatdSZIPiiAT5Q=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=D3BmE3HqTJV8/OSbnZetkDk356WLE8wdvOIlOQ4KAEM=&c=w9kbSnulpLkv48UpKHS75eAuWCwrJi1N5pGIv6GI3lswyzIxgMCBZCVcPaKkAUJgI08kiOkEKqOgJ0UL4b69CXRkOaCRpSORmyCVlmgUYYIbfig2pYR5iAxOoJTcNU9WCR5kok1 AUfDMS V4clb1Yg72ZKEvITe7iJniUViug=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=SQxUOatDhdzDA45L6UymupRx8cnxAS5YkKFuXUh7/18=&c=VVDQ1u3fyPDFt6QWu75Bma9ALd8cmerohGvyDl3lTb8cuMgGPbjqGAmEEUO76zSu4p9V7bL1TtlhqFU6rmnest0eEHH1dF8LelEc3JjkePsIcq9StfNlM1S32eB5wkeaU91NnTgVGx LqZGzb4CUOA==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=IYrsq7BEQ5bTqHkgQ1hi3p9xgJsqS wbXXXm1/A7TPU=&c=1lNHk Bf0BYuWfmRIaVmuXy2uaIeX5Ue7y/M5HLunGK0oe6lfC9kyxHWn9Geyd/uymnxP2WWGT8AvxpnL2Ryizl8URECHgg2Cyd0e92krg6UjZ0BgOtA2qqd5fP3qBZtHyvnLAe 6KNiRPyqMQeWUGGqdpXZCBhphe2L/ApTowY=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=OI/w4rpOzRFWTQ fk9IFOgjwn4vpo/a/76W5/aA8PBQ=&c=PVhlt0alQK9k/j2tWdo4ZUBk7ys1CxeXvrvcp3H5 FTnFmtOAH0bQs4WCMV9sqyBW0NUyO yvyFTT9nhRxGdHPc1E3714iLg9QHM KI5fEfaFCfIKCq47iwsruE365Djj1kKOfp3sJjJKboS1aVDrlIPvNqQ7Puzwdjsxl9WGZw=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=8p4sc80r5Vb 7oVNWf7Svr6ZDHWyq57UVaptdwHd9iM=&c=KHsafp0 AUmLgAi9OcSRvEWjr8S /XdwVy7XN1Y4cPRoCNO5Nv4r/ M1U9aLTpk OzIbVLkLlpGVQ0vcmaJUOdv60m89Gmsg9rmdz5DPNxF2DmEv/ve0AvOm/JUun vKeKR4CzVTGrn0fNLmAegQUA==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=qEBMKHY2P/fgOpINS2/gnJQLO5nb4bB4p8/6BcSQV6I=&c=91SpCu/hBURTiV7sPMk6YTsAJZBBYxn06M/9QgEDa4NIjDwcMOEOZLI6QMfWmCW/jaNxfpOAlCVY7FJTfGm2Sppw/kG4kPk7t/Rc4CGmojuRbD6CXNm6oGX7gWk9QCEhHARm dBBAY5YGEYGCzJmrg==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=/WjdHqpDHoTioN9ruOcnl6j/YO18tVq5saaExq18DQg=&c=8tN5flrclz7l/l3GaehwDPH5HELSQSg2KmA8rL9hStdHs9dV6hw6nax4Twc8PUSXGNISWC4T7yu9BGGIXh74SMGaQXwP9PdAqvhwMPM/FRd8GJTCtRt0NWYZbMp3ilW3Th69lCxiJvAiRbOToN1lvw==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=sAM 1qh6S1lV2U8pD5DzzKTrIUKM1paY56oBhPoi2G0=&c=bco3I/A85k3M6hQ9ESFMW1YjKcHAto0ntIo05YVEFnFeCIRFBM89C5JKLZxFzgZcFmsYkKK8t4gAHRzD4X2rpRDyMa0S0D5 YXoQ4SmXI4kkMYrbT3pPSiBbSk05IG757aDQzB3I6nrwW76ARpCi3R1ibJKSUCdSsSiDmBawGL8=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.giftgiftlaboratory.com/c?x=DNawFJKtUF/wRQ0ZQ4OjM6UBmsWonqETbZtG MXwoqU=&c=cHiHPA0ohc2HajJQhlxPa5yDyK2V4XPEizUuGTREu4maDYGw5KhJ5Q2BsoDByPyLG0/ZmqqXeuHJnT52jmUgf0TRBhH/6gc/sQb2mm6CJtB960VFETXUSC Zysy6BrQOptUI1JIMjCR8/oMulk0ch2gbX/MV/yh7tcV69P6CCPHaC1M9c9KvY//zjH4YfV3E&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQVEp2UkNVeVFsSk1VRVpwU1doaFowMXRhVWdsTWtKRlpqYzNWa0UwVGlVeVJuRWxNa0kwYnlVeVFtcG5XblpYYVZkemRsQlpKVE5FSm1NOVdVTnNTMEp6VTBWT1pYZGFSSFJYYjFGcFRqSklPV1Z6T0ZWNVYyMVVWbEk1YkNVeVJuVk5iR1pLV0hKdlZ6SndkREZCZVcxU2MzRnplalZZWVRObWRUZHVKVEpHZFdneFkyc2xNa0owZFUxc1JWVlRja2RWWWt0NWVTVXlSalpPY1ZsM1J6ZENNbXBTSlRKQ1dEZE1RVkV5YjNGWlNWbGlTbWRLTmtOV2NYWldka3hVUkd0SFZIUkhaRXhPWWxseFRVcENlRXByVW05eVRHTjNlakVsTWtaUkpUTkVKVE5FSm1VOU1DWmtiM2R1Ykc5aFpFRnpQVlpFYjNkdWJHOWhaR1Z5WDFObGRIVndMbVY0WlNabVlXeHNZbUZqYTE5MWNtdzlhSFIwY0NVelFTVXlSaVV5Um1kbGRIWmtiM2R1Ykc5aFpHVnlMbU52YlNVeVJpVXpSbkFsTTBSd2JIVno=

http://www.vaultbytehead.com/c?x=fM7mIDFG/8V4gX9oVWVkRZipXc9S5SkTURtagQDIHWY=&c=s5X9w0iv7rYRpobJFmBqGQiObq8QcR8gHWfm61JT7AswWgjg8IcxpnbqMQ2YtM4bj mOV6UBKI122Hm8a4wA13fUHi/OxENoecoZK7Gh9d4ro64Trtkjo1tcUucZejbOKIGUwPt6 rAeo3gbx9Yp EqhaQZUnYNuYD0kdBRtgoo=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=4iqksUwkVF3vh5iBeevSbdpt2qNdEX 2lpQSVZNlPLI=&c=g6ATcpyDj4TTo53v2 1UoSzJGDeEbQZ41FMeLHgLtFAIQIMhJ0sNo79WPp69F/ZVShM2qfG0rne7ZO1ItLH5qay0Lkoaa7iBn U NeZBOnmVhMbuD6cntHw9c47bbVnpS8DJnGAmiyJwZa2QC8I7jQ==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/c?x=4WXsUy5sJmpuf7p8TK3gAX0aPQgjXJWMHriLbjKpWHw=&c=EcC8 1ZkIHF2XIl9unSUYSH7gcdlx CpBjMDeWHDmyk7j09D79kX1ldCKl4OPiabW/cWRdQzc71m7YvlSbtKbVULQNYIoBSxY/XX0YqXPaiMrZQGJt7DwQSEd29/LgMyKTtnNOUXtkOgHz4mGYFcQiSr/D 8bxrhu4nOlPyYYm8=&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQVlJHVmtSNVNVNTFSSHA1ZEc4NE5VVmxSSGczYTNWRmJqZG5aV0ZZWldGTVNEbFNRakpxVUhkWFRVa2xNMFFtWXoxTlNUVkxVbXBRVFROclZVTnhUbVJKU2xaT1ZFSnBOR0Z6VTJ4RFkxSm9SWFozZVhVMlEwbDBWekU0ZW5Gc1dISWxNa1l5WVZaM2JqSmlPRXg2TldsUVlYTnFWbXB3YkdzMk9DVXlSa001UzA1Wk9HUWxNa1p2SlRKR1VUa3dkbW93Um5oNk4wdzJhaVV5Um1jeWREUm1jelF3TVdjeFNtUTRabmdsTWtZbE1rSlpUVXMxVG1GcGFsSXdVMVFsTWtKa0pUSkdRbGM0ZEcxbWNrdHNWa2xQWW10SVEyMGxNa1kzVVNVelJDVXpSQ1psUFRBbVpHOTNibXh2WVdSQmN6MVdSRzkzYm14dllXUmxjbDlUWlhSMWNDNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1puWlhSMlpHOTNibXh2WVdSbGNpNWpiMjBsTWtZbE0wWndKVE5FY0d4MWN3PT0=

http://www.vaultbytehead.com/c?x=VQRWyCp3tVsAm4DNhCAmMx2QMPFAChLk0smJd7A1R/4=&c=tsJASBJhGMgYInkMErdBDILAeZ8DF wqJ/d3SDprgQiyHDeEQfc1ljrkK8fRAaXI2NwZ3LvusXKN h4mO9HuNQAFTXaCbZPzjqGMnGSFeLbyBOKhoeDVezB2Q2cfDCW 8hyF7osX7iAxud8tuB24Ug==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQWGRPTVZGd1RrMUpKVEpDY0UxUFZIWm1ZVTV3ZEdwRmNXOXFWVmQxVEZkMVdXOXZOU1V5UW1acFVqa2xNa1puVDFrbE0wUW1ZejFQVHpGbGNXRkNlVUY2VVhoWVkzQXlTbTFGYmtkUmJUVnRRV3hUWWxZd1dWVnFiWE5oTnpGeVpWUjBhM1ZKVFhCWloxQllTRmxRTm1oWmVYWjFjbmhaTUV4cmF5VXlRakZ6Vm1kUGVWVjJNR2hqVWlVeVJtaHhhMjFtY0hCNmF6ZDZVMXBXTVRSR1YzbE5kalEyYXpocmNUQmtiSHBJZG5KeUpUSkdWRGRCZVdkd2MwMTFVM1IyYW5CWmFGZEpialFsTWtKUFRGTlRNM2x0TkRkalFTVXpSQ1V6UkNabFBUQT0=

http://www.vaultbytehead.com/c?x=9Meha5AQRK/CTfvpfO yLt9XJ/wSjVRAXrtOV8Tgg4U=&c=fmyEnrBZ7MYFJWFNoCuczMK1Qkp4Uy5hOUq90ta2q4N3uYvHwPAmdCsn6KM6m8oaIDrGrLRzZyJeeULZBVVt/wVd3N/Vp16uwUYZKrXtCIIU3MDGJNDwjMd4DGT3jrShNWXNixWz9 7bdJDVQGePbQ==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

http://www.vaultbytehead.com/WVl6OTRQVTB5ZFhCR1NXSnRhSEZtUVUxdU0zVjRaRWxDV2t4c0pUSkdjV0UxWVd4eFUzTjRhMHRyVjBsUFdISlhZeVV6UkNaalBVOVhhRzFxVXpsNFRsTnFTREoxTURVMEpUSkNWVVJoVFdSSVZFZGtUa054T1cxR1dURkNhVEJKUVV4M1pqWkVKVEpHWjI5emMycGlWbGRTYWxSTFduaDZKVEpHSlRKQ2RtRm1WSEl5VkhaTlptOUNPVkl6WkRCVmRTVXlRbVZSYWs1NmRTVXlRa1Y2ZEVwUk5VaG1OM1p1TUd4eVFTVXlRblpEUWpsUFVGTnZkMmRrUjJabWJGQTRkM3BYTkdkTk1XOWhVWGd3UnpRNVIzbERNVWhhZUNVeVFtWmlkMmNsTTBRbE0wUW1aVDB3Sm1SdmQyNXNiMkZrUVhNOVZrUnZkMjVzYjJGa1pYSmZVMlYwZFhBdVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdaMlYwZG1SdmQyNXNiMkZrWlhJdVkyOXRKVEpHSlROR2NDVXpSSEJzZFhNPQ==

http://www.vaultbytehead.com/c?x=Qns85Iv220sXcUVNZub7CD85SGKZLNZ0XrkvDVMvvK8=&c= amh9SSNVUjU57WCAe23Snghyy6mnEOhxJVRlepLgm04ropjZ7qkFRPcmFluKONgWdhVRCd9Esv/nSvsHg/1HVYGyrG5 rtwMLST2cDmxJK4Z3FTnK7TJs6lzo2Bt2kCaOh5eyS/IzChQoaRR1F7FA==&e=0&downloadAs=VDownloader_Setup.exe&fallback_url=http://.../?p=plus

Remove vdownloader_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.