» vlc-player.exe
Overview
Analysis
File Details
Downloads (2)

vlc-player.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The application vlc-player.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the VideoLAN VLC media player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

vlc-player.exe

Publisher:

Quality Install (Alpha Criteria Ltd.) (signed and verified)

Product:

Rubira

Description:

Rubira Setup

Version:

3.6.4.5

MD5:

328c58cf9be74cfe67a9fdc7c275424a

SHA-1:

3d57ba7c8a9210a00ea1f4f0da2e6d8591232ba1

SHA-256:

131f167e7aca38e7621cdc865275a9e0fa98e517da4ecd0cd117dec090979e96

Scanner detections:

1 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/28/2024 4:47:43 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallCore.AC.Installer (M)

16.7.13.14

File size:

1011 KB (1,035,280 bytes)

Product version:

1.6

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\vlc-player.exe

Digital Signature

Signed by:

Quality Install (Alpha Criteria Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

1/6/2016 6:14:15 AM

Valid to:

8/4/2016 8:59:05 AM

Subject:

CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata

Compilation timestamp:

6/19/1992 4:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:mifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:3pZWcjz/90UWGpf

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9246

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file vlc-player.exe has been seen being distributed by the following 2 URLs.

http://www.appsworlddelivery.com/74DGpFs_ON5PKnRxUJPNUILGaFybdErpAbSQFFw8sq9ZBq7kZ4n2oofJNGlBAWs8gmwkpqUcN171nmFAKNTRABfBV31R4eDXIpOUCBJTqJ3RPVOXrarvWa6 M1lVMwS9KKewogGLErfxT8oFeStDVb7oE_84yVxVMSIVCQsEH2yhPSG vHKAkDAKe1KuxHu_rUMQqc_b4T72onDJ fIE 5085EvwSTXX56jq9Wr1LqscCObov3Wlw1kaQZPBo2USwwbOu3Qf0F QFSwE_n8822ZnAtZCBVmgF65nX3vKrDUownZJI3Xyv4kvk7sKMX9fxxXwFVlD87CYI2LoXOKahlzeRmzSqoPWLCu1KcoyF1xaPxdmByhgLeUu5 KIrqK6TK7tCC8emX_ztiaAxKj3hk5c6PbwI5dF3bfmXO86WypX3mmnKy03t wGnhcRuLsUF9HtL_GnlU3XxsKB3f4 4OtXtAr3Bq4brusZ 0FP3fMZOGXDwuUuetL1oxdXOu71RIP Z19TrG8WUVdgl7w3XuqDfGstaNAd1H2Lt2HqX7bAeGWrLHkn6iPAwfjlfbRwEb3SpuITlEjc4XkRTSKAY5ziiLUOBg==-GzQAAOSbnhcK5ydKicPaBg454ANqW0mgVLAxNq5TECK_sQYUWTWI1TFx6JYBIw 8bGH07w==

http://www.appsworlddelivery.com/sxppH0bAdyAez1YWjIcRK3iAhDiHF0FP2XLyEB7S1bm0pE3A5oLnPOm9uTh9RI5iuEAR0MuTCkrdnD0Z7HjmksxD3QR7aSUwDY4SJAUM7asdlcZnC5AMODSsGz9Ry FHhZ9n1XNB1QafoOerRRH8fuYVobASCR_z2OvP2pYHXbekk_8mYSMb6vn6DAGhYfCnEQObOiWNqCXhAtZ4VticgjfzsF5T5eQipXS4LwORVeihE3XZEKBNuRCHxKGL34L97B1Ft_sMkusbhsiNVRxCoLcuYVjvlET ZLnDrEZwmcJ3PgSzSqnyoL2l5i6ugkAFNZqf1 xHf6wg 43SXenirE4q147uMI R2nUQIp6Q1Poqv4euVyPIYu5K9b1iudTLW_k25PeUHvtwShMnffNpESelQG1JMLWoefeSJK1cxKzvOTr50YZoXCBkTrrEeTvQi5o6urob6zNNk2dWQW9Nh_8J1M6aOXAIILRmuOv 06pEVE5iXwmBdLUtpprv0xP2pnpjJK3MoOBYMr _6xqQ1NrnhHXSyLeaXhv9ncGQhUcX829OYVadPq8GboahwlP9Xm08rQ8dPmntEfWm1plwgBnI6j3N2g==-GzQAAOSbnhcK5ydKicPaBg454ANqW0mgVLAxNq5TECK_sQYUWTWI1TFx6JYBIw 8bGH07w==

Remove vlc-player.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.