home

vlc_nsetup.exe

Click run software

The application vlc_nsetup.exe by Click run software has been detected as adware by 10 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from media.downloadster.net.
Publisher:
Click run software  (signed and verified)

MD5:
39bcbd357b511fe8991225a9aab1d78d

SHA-1:
3afd52c0a913d5e8a0d0ebfa9e6683ceeaed366d

SHA-256:
49ae7ec132962b21883395ad5e45502b73d5d0a120d98bcf058ef78240eff671

Scanner detections:
10 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 4:03:41 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.InstallCore
2013.07.04

Avira AntiVirus
ADWARE/InstallCore.Gen
7.11.88.184

Comodo Security
Application.Win32.ClickRun.A
16543

Dr.Web
Adware.MediaFinder.2
9.0.1.0180

ESET NOD32
Win32/InstallCore (variant)
8.8525

F-Prot
W32/InstallCore.G.gen
v6.4.7.1.166

K7 AntiVirus
Unwanted-Program
13.170.8954

Reason Heuristics
PUP.Installer.Clickrunsoftware.K
14.8.7.20

Sophos
Install Core Click run software
4.90

VIPRE Antivirus
Click run software
19282

File size:
1015.5 KB (1,039,848 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\vlc_nsetup.exe

Digital Signature
Signed by:
Click run software

Authority:
COMODO CA Limited

Valid from:
4/19/2012 1:00:00 AM

Valid to:
4/20/2013 12:59:59 AM

Subject:
CN=Click run software, O=Click run software, STREET=63 Rotshylid Shderot, L=Tel-Aviv, S=NA, PostalCode=65785, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00A243E49C0DAF69F7C5ACF083EB184161

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:IZWNSZi5PXjBTc3Ws6gtngeVgbMzMKz9RW94I:IZWNSY5PzBg3W14geVgb3KbI

Entry address:
0xC1DD0

Entry point:
55, 8B, EC, 83, C4, F0, B8, F8, DB, 40, 00, E8, 4D, DF, FF, FF, 89, 5A, 04, 5F, 5E, 5B, C3, 8D, 40, 00, 83, 3D, 14, A6, 47, 00, 00, 7E, 40, 83, 3D, 14, A6, 47, 00, 0C, 7D, 0C, C7, 05, C0, A5, 47, 00, 07, 00, 00, 00, EB, 2B, A1, 14, A6, 47, 00, 83, C8, 02, 8B, 15, 18, A6, 47, 00, 89, 02, A1, 18, A6, 47, 00, 83, C0, 04, E8, 99, FD, FF, FF, 33, C0, A3, 18, A6, 47, 00, 33, C0, A3, 14, A6, 47, 00, C3, 8B, C0, 53, 56, 57, 83, C4, F0, 8B, F0, 8D, 3C, 24, A5, A5, 8B, FC, E8, A0, FF, FF, FF, 8D, 4C, 24, 08, 8B, D7...
 
[+]

Entropy:
6.8888

Developed / compiled with:
Microsoft Visual C++

Code size:
788 KB (806,912 bytes)

The file vlc_nsetup.exe has been seen being distributed by the following URL.

http://media.downloadster.net/vlc_nsetup.exe

Remove vlc_nsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.