home

vlcsetup-win10.exe

Hamonog

FlashSetup (New Media Holdings Ltd)

The application vlcsetup-win10.exe, “Hamonog Setup ” by FlashSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the VideoLAN VLC media player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Piruriponi   (signed by FlashSetup (New Media Holdings Ltd))

Product:
Hamonog

Description:
Hamonog Setup

MD5:
a6bacc3ee084654ca909f0f8a68b4f4f

SHA-1:
81fa482fa92e71a1d25919dc040b4535dbd84574

SHA-256:
4c933a0223a2118b1090cdbf21eace691e2b2b5cfb7bd108ef01dc42116634b3

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/27/2024 8:20:00 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.25.17

File size:
1007.2 KB (1,031,360 bytes)

Product version:
3.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\programs\vlcsetup-win10.exe

Digital Signature
Signed by:
FlashSetup (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 5:31:27 AM

Valid to:
5/26/2016 8:06:50 AM

Subject:
CN=FlashSetup (New Media Holdings Ltd), O=FlashSetup (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FDED645F5771D0B9771141024E9B6BFB

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:jWWp+ArJI68hN70VWgUxYhJ/n3zhKkOZHAlfkV4:jvcAz+J4VUOhJfzhKkrcV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9129

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file vlcsetup-win10.exe has been seen being distributed by the following 4 URLs.

http://www.bodydownloadscontent.com/c?x=g/mmXXAs Z/V48R9d8YYxHXmAPvZ1apCEguBJ90lpbA=&c=eDWnwPic55GtOQLinm zBB86eiJe/zGD6z20Jkh EZNHoCzXVcCJeUBbI5GYRKl0WVInU2kavTHfw6jS/z5JixSwPloyIFj8YgEWQq59FLbMwyZfk2BDEB9nZYO7abXlGAo5vCqxK3HspJX/LotwaVPL7YroZL5VEAnzVB CMH0=&e=0&downloadAs=vlcsetup-win10&fallback_url=http://.../vlc-setup-win10.exe

http://www.presentcapitalquick.com/c?x=X0ZsZVcQUCX/WqWXZ53VLWGmIv/fC8RnZEB4NkzZilg=&c=WJtqtZcm6miEDnK19EyQjv 6Nog5tGyrd GJDgQg4NuY0xsY2KzlxfrMJwOx38VE6eRnx2I5qjJRJvPxFW0Y7L0/BGwsRlEjPT15NGSt1l39WASz3u1xQHMgXMv9aqFFep6LlFD4kiOv7oD7YOCGUmeMlmAXB S5oMnPySNc9CU=&e=0&downloadAs=vlcsetup-win10&fallback_url=http://.../vlc-setup-win10.exe

http://www.presentcapitalquick.com/WVl6OTRQVEI0VFV3MGFrTjFibmtsTWtJM01VaG9WakJCVEZSNVpWSjBOVU5OTjFGR01HcFFhRzFtU1ZwdGRFUkpWU1V6UkNaalBWVmlSWEpWTUNVeVFpVXlRbVZoUmtaa1puZHlia3MzVlZOSFVra2xNa1p3WjFZMFowUWxNa1l5Tm1Ob2NrRlNTWGRrTmlVeVFtTlpiWGR4WTNselJHRlNlak53TkRaM2VuaDFWemRNYTBkUVVuTklOSG9sTWtaclNEZEZSMmwxYm1OWllsZHdWVWR6VEVsbk4wc2xNa0k1WVhCVFYyUnZaekZhV1VKamJHSnVNa0o1Um14b1ZXeHpjR0kyUm1JeWVERjRiRlZPYlZsSlFYRnRhVFJJZWxZNVVVbDNKVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFhac1kzTmxkSFZ3TFhkcGJqRXdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkMmx1Wkc5M2N6RXdkbXhqY0d4aGVXVnlMbU52YlNVeVJuWnNZeTF6WlhSMWNDMTNhVzR4TUM1bGVHVT0=

http://www.presentcapitalquick.com/WVl6OTRQVmRqVTNSMGJtVWxNa0pQV20xV2VUTmFPQ1V5Ums5WVVtaHFOM1UwYzJaSFlUZE5ZMjVzVWxaeGVrbFRTams0SlRORUptTTllbTFpYkVaVGJXazBha05wTVRsNFkwVjFNVzF4V1ZOb1JWRjBNMU5YZVdZd2REUXdkV1ExYjFaSGIwSmlkRGNsTWtZbE1rWTJVSEppUlZaMGVrNWxSMjB6U0VwS1dUaFNVM1JXVUc4d1EwOUlKVEpDYkZWYVQzRkVKVEpDV0ZCWmQzWm5XV1pLV1VzMFFqZzRjV3BsZUZkUlEwMTBaM1VsTWtKak1pVXlRbkYyWkZkWGJVTXlRWEZLYTBscVMzaGtNR1p4YTJGNVZrZFRZbFZrVlZGTmRuZEJKVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFhac1kzTmxkSFZ3TFhkcGJqRXdKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdkMmx1Wkc5M2N6RXdkbXhqY0d4aGVXVnlMbU52YlNVeVJuWnNZeTF6WlhSMWNDMTNhVzR4TUM1bGVHVT0=

Remove vlcsetup-win10.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.