home

videodownloader.exe

Bundlore Limited

This is the Bundlore download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application videodownloader.exe, “Video Downloader Setup ” by Bundlore Limited has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the Bundlore Downloader installer. The file has been seen being downloaded from www.vgrabber.com.
Publisher:
Video Downloader   (signed by Bundlore Limited)

Product:
Video Downloader

Description:
Video Downloader Setup

Version:
1.8.1.20

MD5:
b1c74aee9e807324700e53c9c8410813

SHA-1:
bde33919aaadfcc66b46ff865b791317bb4e9a44

SHA-256:
2dcb0fce1b39b8232773891db4c3ff281d7d37f2e3a166908cd9637712e2cbde

Scanner detections:
7 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/23/2024 5:30:36 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Bundlo
2015.0.3387

Dr.Web
Adware.Downware.1897
9.0.1.0221

herdProtect (fuzzy)
variant of setup.exe (Adware)
2014.10.10.21

IKARUS anti.virus
PUA.Bundlore
t3scan.1.6.1.0

McAfee
Artemis!B1C74AEE9E80
5600.7043

Reason Heuristics
PUP.Installer.BundloreLimited.P
14.8.9.17

VIPRE Antivirus
Bundlore
29886

File size:
748.5 KB (766,424 bytes)

Product version:
1.8.1.20

Copyright:
Copyright © (VideoDownloader_1.8.1_consider_)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Bundlore Downloader

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\videodownloader.exe

Digital Signature
Signed by:
Bundlore Limited

Authority:
Thawte, Inc.

Valid from:
9/12/2013 4:30:00 AM

Valid to:
9/13/2014 4:29:59 AM

Subject:
CN=Bundlore Limited, O=Bundlore Limited, L=Tel Aviv, S=Israel, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
232CE5297F2941A352148152A936FB93

File PE Metadata
Compilation timestamp:
2/4/2013 9:54:57 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:dSxG0vzX/d4BL8+iDUkpV6viA8m7u8sGIeQ3PAk0bdJI0iTdVvBrzVxNQahwS5ob:wxGgzA8VpVxA8UgIkqdHiJXWahbw

Entry address:
0x113BC

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 2C, 00, 41, 00, E8, E8, 51, FF, FF, 33, C0, 55, 68, 9E, 1A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 5A, 1A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, 5B, 41, 00, E8, 16, D8, FF, FF, E8, 65, D3, FF, FF, 80, 3D, DC, 2A, 41, 00, 00, 74, 0C, E8, 2B, D9, FF, FF, 33, C0, E8, 80, 32, FF, FF, 8D, 55, EC, 33, C0, E8, E2, A3, FF, FF, 8B, 55, EC, B8, 50, 86...
 
[+]

Entropy:
7.9235

Developed / compiled with:
Microsoft Visual C++

Code size:
63.5 KB (65,024 bytes)

The file videodownloader.exe has been seen being distributed by the following URL.

http://www.vgrabber.com/VideoDownloader.exe

Remove videodownloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.