home

vertitechsetupx30010.exe

altonav

This is part of the Sendori web browser toolbar and extension that will modify the browser's default search provider, DNS, and home page functions. The application vertitechsetupx30010.exe by altonav has been detected as adware by 27 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. According to AVG, this software downloads additional adware offers during setup. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from i.versscom.net.
Publisher:
RadPlayer  (signed by altonav)

Product:
RadPlayer

Version:
4.0.1.0

MD5:
9142349d15f7ead5bdc3bdd2dc0ad144

SHA-1:
8fe379e050a0f6e0716c46c431ede1e49fa06ea5

SHA-256:
61eb36d7735c1382937d3b6c4c9e59142b23709b8249110fcc64a69c9ea4a8ec

Scanner detections:
27 / 68

Status:
Adware

Analysis date:
11/30/2024 8:22:23 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Kazy.552993
602

Agnitum Outpost
PUA.Sendori
7.1.1

Avira AntiVirus
ADWARE/Sendori.3350384
8.3.1.6

avast!
Win32:Adware-gen [Adw]
2014.9-150613

AVG
Downloader
2016.0.3080

Baidu Antivirus
Adware.MSIL.Sendori
4.0.3.15613

Bitdefender
Gen:Variant.Kazy.552993
1.0.20.820

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
ApplicUnwnt
22215

Dr.Web
Adware.Plugin.222
9.0.1.0164

Emsisoft Anti-Malware
Gen:Variant.Kazy.552993
8.15.06.13.03

ESET NOD32
MSIL/Adware.Sendori (variant)
9.11671

F-Secure
Gen:Variant.Kazy.552993
11.2015-13-06_7

G Data
Gen:Variant.Kazy.552993
15.6.25

IKARUS anti.virus
AdWare.MSIL.Sendori
t3scan.1.8.9.0

K7 AntiVirus
Adware
13.204.16003

McAfee
Artemis!9142349D15F7
5600.6736

MicroWorld eScan
Gen:Variant.Kazy.552993
16.0.0.492

NANO AntiVirus
Riskware.Win32.Plugin.dnxnco
0.30.24.1636

Panda Antivirus
Trj/CI.A
15.06.13.03

Qihoo 360 Security
HEUR/QVM42.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Sendori.Installer
15.6.12.23

Sophos
Generic PUA IP
4.98

Trend Micro House Call
TROJ_GEN.R0EBC0OBQ15
7.2.164

Trend Micro
TROJ_GEN.R0EBC0OBQ15
10.465.13

VIPRE Antivirus
Sendori
40472

Zillya! Antivirus
Adware.Sendori.Win32.8
2.0.0.2187

File size:
3.2 MB (3,350,384 bytes)

Copyright:
© RadPlayer All rights reserved.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\vertitechsetupx30010.exe

Digital Signature
Signed by:
altonav

Authority:
VeriSign, Inc.

Valid from:
8/17/2014 7:00:00 PM

Valid to:
8/17/2017 6:59:59 PM

Subject:
CN=altonav, O=altonav, L=San Leandro, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
10E276E0F710E2E93163C74E8E2FD691

File PE Metadata
Compilation timestamp:
12/5/2009 4:53:24 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
98304:RssR5UAea1Op/YTaY7pZlFyhtFUXl4yUQZ+qix:asbrv+/IaEpZyhtFoUo+q+

Entry address:
0x355E

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, B8, A7, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 80, 40, 00, 53, FF, 15, 88, 82, 40, 00, 6A, 08, A3, 98, 10, 43, 00, E8, D6, 2E, 00, 00, A3, E4, 0F, 43, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, E8, A7, 42, 00, FF, 15, 58, 81, 40, 00, 68, AC, A7, 40, 00, 68, E0, 07, 43, 00, E8, DC, 29, 00, 00, FF, 15, AC, 80, 40, 00, BF, 00, 70, 43, 00, 50, 57, E8, CA, 29, 00, 00...
 
[+]

Entropy:
7.9920

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file vertitechsetupx30010.exe has been seen being distributed by the following URL.

http://i.versscom.net/inst/software/1D5EACCE-B2D3-4AC2-9EFA-ABE0960C39EB/.../VertitechSetupx30010.exe

Remove vertitechsetupx30010.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.