home

webplayer_remote.exe

Webplayer Remote

Kreapixel Network

The application webplayer_remote.exe, “Webplayer Remote Setup ” by Kreapixel Network has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from secureclientdownload.com.
Publisher:
Kreapixel Network  (signed and verified)

Product:
Webplayer Remote

Description:
Webplayer Remote Setup

MD5:
ad66d82d02bcc83e7063447b0256d6c3

SHA-1:
4d4b4d61dc6cf828cd02d624aaaa20e94e224f26

SHA-256:
59be2219db88eb7f69e00f0da1889fc604df2b1106501e0d6436724f9f138770

Scanner detections:
18 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/23/2024 5:43:55 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.PKQ
537

Agnitum Outpost
PUA.WinuSecu
7.1.1

Avira AntiVirus
PUA/InstallCore.Gen7
8.3.1.6

avast!
Win32:Adware-CKQ [Adw]
2014.9-150817

AVG
Generic
2016.0.3015

Bitdefender
Adware.Agent.PKQ
1.0.20.1145

Dr.Web
Adware.Pirrit.11
9.0.1.0229

Emsisoft Anti-Malware
Adware.Agent.PKQ
8.15.08.17.10

ESET NOD32
MSIL/Adware.WinuSecu (variant)
9.11715

F-Secure
Adware.Agent.PKQ
11.2015-17-08_2

G Data
Adware.Agent.PKQ
15.8.25

Malwarebytes
PUP.Optional.KreapixelNetwork.SID
v2015.08.17.10

MicroWorld eScan
Adware.Agent.PKQ
16.0.0.687

NANO AntiVirus
Riskware.Win32.Pirrit.doolof
0.30.24.1636

nProtect
Adware.Agent.PKQ
15.05.29.01

Reason Heuristics
PUP.Kreapixel.KreapixelNetwork.Installer (M)
15.8.17.10

Sophos
Generic PUA DK
4.98

VIPRE Antivirus
Kreapixel Network
40740

File size:
324.8 KB (332,640 bytes)

Product version:
1.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\webplayer_remote.exe

Digital Signature
Signed by:
Kreapixel Network

Authority:
Thawte, Inc.

Valid from:
6/27/2014 3:00:00 AM

Valid to:
6/27/2015 2:59:59 AM

Subject:
CN=Kreapixel Network, OU=24, O=Kreapixel Network, L=Bergerac, S=Dordogne, C=FR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
08C337D1809F41539363BCF60D881AB2

File PE Metadata
Compilation timestamp:
6/20/1992 1:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:w/QiQPquzx65pmckOQ/UBTlakaBdGOzGfnXpiQCsoazZPElpMQgqoVJbYtD+PNt:YQiGquz4V+MBTlPadSfXioRcpMXVJok

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8836

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file webplayer_remote.exe has been seen being distributed by the following URL.

http://secureclientdownload.com/4/.../webplayer_remote.exe

Remove webplayer_remote.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.