home

videoplayer-setup.exe

File

saFe insTall OpT

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application videoplayer-setup.exe by saFe insTall OpT has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup.
Publisher:
saFe insTall OpT  (signed and verified)

Product:
File

Version:
1.9.3.0

MD5:
9b6c53659aab0f245a85a8b48701cf79

SHA-1:
7bacb7997513a1baa778377e3015de4dbf3e064b

SHA-256:
406f98aae07e8e0aad42920f2907df5c9f526787dad679da231bcdacc502c498

Scanner detections:
26 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/24/2024 6:20:16 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.Outbrowse.BE
5589701

Agnitum Outpost
PUA.OutBrowse
7.1.1

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.05.31

Avira AntiVirus
PUA/Outbrowse.Gen
8.3.1.6

AVG
Potentially harmful program Downloader.FBF
2014.0.4311

Bitdefender
Application.Bundler.Outbrowse.BE
1.0.20.750

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.OutBrowse.363
9.0.1.05190

Emsisoft Anti-Malware
Application.Bundler.Outbrowse.BE
10.0.0.5366

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
5/30/2015

F-Secure
Riskware.Application.Bundler.Outbrowse
5.14.151

G Data
Application.Bundler.Outbrowse.BE
15.5.25

Malwarebytes
PUP.Optional.Outbrowse.Gen
v2015.05.30.08

McAfee
Adware-OutBrowse.e
5600.6749

MicroWorld eScan
Application.Bundler.Outbrowse.BE
16.0.0.450

NANO AntiVirus
Trojan.Win32.OutBrowse.dpqifl
0.30.24.1636

Norman
Application.Bundler.Outbrowse.BE
03.12.2014 13:20:04

Quick Heal
Adware.NSIS.OutBrowse.A
5.15.14.00

Reason Heuristics
PUP.Installer.saFeinsTallOpT
15.5.30.20

Sophos
Generic PUA GN
4.98

SUPERAntiSpyware
Adware.OutBrowse/Variant
9843

Trend Micro House Call
TROJ_GE.89A3B034
7.2.150

Trend Micro
TROJ_GE.89A3B034
10.465.30

Vba32 AntiVirus
Adware.Outbrowse
3.12.26.4

VIPRE Antivirus
Threat.5085447
40552

File size:
1 MB (1,100,928 bytes)

Product version:
1.9.3.0

Copyright:
File

Original file name:
Ionic.Zip-2015Mar27-043527-cf4c383e-8bb8-4615-bb01-5c05a87af189.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\videoplayer-setup.exe

Digital Signature
Signed by:
saFe insTall OpT

Authority:
thawte, Inc.

Valid from:
3/22/2015 7:00:00 PM

Valid to:
1/27/2016 5:59:59 PM

Subject:
CN=saFe insTall OpT, O=saFe insTall OpT, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
2D154EC2D5B2A57A0C1599905D1CC29D

File PE Metadata
Compilation timestamp:
3/26/2015 11:35:27 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:XMiy4IadS4ms5I6e66fEheKhMsBN0MySCHPFAFFQ6PY+CGNemC+KYb6XKx/BJ/wP:XbSaE4mvt/p0N0HSwR6PbuJXcp1woa

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5477

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

Remove videoplayer-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.