home

vlcmediaplayer-setup.exe

Zoobam

This is the Tightrope WebInstall which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application vlcmediaplayer-setup.exe by Zoobam has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the Tightrope WebInstall installer. The installer is marketed through download protals and search ads as the VideoLAN VLC media player but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Zoobam  (signed and verified)

MD5:
01513115341fee524cb7f9e680684dc3

SHA-1:
f70f259ab93db7daeb1aea688ec5afe0f4b59721

SHA-256:
5438463a8df896c5c1e6613e3497bd1607c44eb584b5c5ef5959d3b5729c2b06

Scanner detections:
21 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/24/2024 11:27:00 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Downware
2014.12.29

Avira AntiVirus
ADWARE/Adware.Gen
7.11.198.70

AVG
Generic
2016.0.3242

Clam AntiVirus
Win.Adware.Downloadadmin
0.98/21511

Comodo Security
ApplicUnwnt
20507

Dr.Web
Adware.Downware.2220
9.0.1.01

ESET NOD32
Win32/DownloadAdmin (variant)
9.10935

Fortinet FortiGate
Riskware/DownloadAdmin
1/1/2015

F-Secure
Adware:W32/WebInstallBundle
11.2015-01-01_5

G Data
Win32.Application.DownloadAdmin
15.1.24

IKARUS anti.virus
Trojan.Dropper
t3scan.1.8.5.0

K7 AntiVirus
Unwanted-Program
13.188.14468

Malwarebytes
PUP.Optional.DownloadAdmin
v2015.01.01.01

McAfee
Artemis!01513115341F
5600.6898

NANO AntiVirus
Riskware.Win32.Downware.djahkt
0.30.0.64448

Sophos
DownloadAdmin
4.98

Trend Micro House Call
TROJ_GEN.F0C2C00LK14
7.2.1

Trend Micro
TROJ_GEN.F0C2C00LK14
10.465.01

Vba32 AntiVirus
Downloader.Agent
3.12.26.3

VIPRE Antivirus
DownloadAdmin
36152

File size:
826 KB (845,824 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Tightrope WebInstall (using Nullsoft Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\vlcmediaplayer-setup.exe

Digital Signature
Signed by:
Zoobam

Authority:
GoDaddy.com, Inc.

Valid from:
10/15/2014 10:27:59 PM

Valid to:
10/15/2017 10:27:59 PM

Subject:
CN=Zoobam, O=Zoobam, L=Kirkland, S=Washington, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4EA9D31E75E043

File PE Metadata
Compilation timestamp:
7/15/2014 12:29:31 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:uxpJfslZtuaVd9lpmhwQbift489IVGD4xJFl6Xqb5Kbmkg8S:ap9sVuaVdvgVbmgGDijyikg5

Entry address:
0x3345

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, B0, 73, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, C0, 70, 40, 00, 53, FF, 15, 88, 72, 40, 00, 6A, 08, A3, B8, 3C, 42, 00, E8, 2E, 25, 00, 00, 53, 68, 60, 01, 00, 00, A3, C0, 3B, 42, 00, 8D, 44, 24, 38, 50, 53, 68, 43, 74, 40, 00, FF, 15, 64, 71, 40, 00, 68, 38, 74, 40, 00, 68, C0, 33, 42, 00, E8, 1F, 24, 00, 00, FF, 15, BC, 70, 40, 00, 50, BF, 00, 90, 42, 00, 57, E8, 0D, 24, 00, 00...
 
[+]

Entropy:
7.4930

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file vlcmediaplayer-setup.exe has been seen being distributed by the following 28 URLs.

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=wolf wall street

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=zaklinac

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=half of a yellow sun

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=Fastball all the pain money can buy

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=car

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=latest bolly wood movies

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=the ugly truth

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=football manager 2015

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=fault in our stars

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=Search Torrents

http://184.173.206.242/wp-content/themes/.../torrent_search.php?query=dawn of the planet of the apes

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=hunger games

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=så mycket bättre

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=asian porn

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=mi nueva vida en nueva york

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=criminal minds

http://files4.file-mirror.info/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=1772010876&zTmp=1

http://files4.file-mirror.info/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=633265718&zTmp=1

http://files4.file-mirror.info/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=-1156327518&zTmp=1

http://files4.file-mirror.info/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=151338782&zTmp=1

http://isohunt.org/wp-content/themes/.../torrent_search.php?query=lasse stefanz

http://files4.file-mirror.info/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=1734847305&zTmp=1

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=btv solo

http://files4.file-mirror.info/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=-484276318&zTmp=1

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=demon in a bottle

http://files4.safemirror2.com/download/.../dl?bc=1084396&pid=piratebay&brand=piratebay.com&country=US&cb=-1612202129&zTmp=1

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=Love, Rosie

http://piratebay.com/wp-content/themes/.../torrent_search.php?query=mockinjay

Remove vlcmediaplayer-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.