windows-media-player-12.exe

Cagolig

Destiny Dream S.A.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application windows-media-player-12.exe, “Cagolig Setup ” by Destiny Dream S.A has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from www.bulkstockbundle.com and multiple other hosts.
Publisher:
Huful   (signed by Destiny Dream S.A.)

Product:
Cagolig

Description:
Cagolig Setup

Version:
3.6.3.0

MD5:
bcff70670d83bc5fc6d7f151e4319a49

SHA-1:
9e9a5bdb2c9f3d9bfe22af9c96bbec9a5bf2e7a0

SHA-256:
82ca7bbd2ff3a44bac47120a8e33d8c633a6021d8d1d38305694375cdf38b4d2

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/27/2024 5:44:00 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DestinyD.Installer (M)
16.4.10.17

File size:
989.7 KB (1,013,448 bytes)

Product version:
2.0

Copyright:
program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\windows-media-player-12.exe

Digital Signature
Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:55:11 PM

Valid to:
10/2/2016 3:36:18 PM

Subject:
CN=Destiny Dream S.A., O=Destiny Dream S.A., L=Clarens, S=Vaud, C=CH

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217A75EB912AE2167326222C18D9E2357F

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ao9v/Sb8ISdMPNf/kLkfz8HF2+7jDBVCyP39KvlDVJx:a6SkaPNXkQfziF2sjL8l/x

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file windows-media-player-12.exe has been seen being distributed by the following 36 URLs.

http://www.bulkstockbundle.com/c?x=OlGIuReuYmX zkEV3mjTzc0WV35NJfEhOhbtG2oZva4=&c=npbLO5wNtlyL4ooXhEKu9rkvJ6HKCeAJOw/OzWw92LgKpWYfd/HpRnU8mwa9utY UIL476Daw8p0vizvBThxQPBOn/DVMRR/TUYQAE6f5RB1DSa9rcGt KG1T6P3kmVRmvf3Pv3Zgkt59hciz9/8krtpWe8J0gJC EeNiE/bNQ2u1ZXhyxlk4wvJoHKs9v/P&e=0&downloadAs=windows-media-player-12.exe&fallback_url=http://windows.microsoft.com/en-us/.../download-windows-media-player

http://www.giftpresentbundle.com/c?x=kG6wODL4l17jWkNxHio1CLFQW wvrvr5mu9Nkckn9NA=&c=opznBNo4wv1 SCXQpkqhnaDncvqizMnaodw6Mpt1XTvOQBZkZosEpA Q0DRxMzDTXn2Hi5x64kyIRq8mcNtT40z8ydu2QRRXHMjjq49Wrh0IsACoUZPKNSZu1Cgw1mJ410qPmDf4G8d5HWCnjLbBb0V7pa9PmK/u3N3hePRoeh0=&e=0&downloadAs=windows-media-player-12.exe&fallback_url=http://windows.microsoft.com/en-us/.../download-windows-media-player

http://www.contentsoftwarepackage.com/WVl6OTRQVFZWYW1acVZrczNkbll4U2s5aFNtNUxNMHRDVlVWemVrcHRaekpaYldSaFQwTnhVbVkwZVRSNFJUUWxNMFFtWXoxR01YQkJTbTltVDNkNFdYcGlaV050VEhkMFJFWktXR2QzUWpaeVRUUWxNa1o2VHpaWmFubHhhMWxKTUd0UmFETndKVEpHVUd0VFJsTlhaMFZvWkRSaGRFRlpabG96UmpoWGVEaEVUSEZDZWpsb1dqa2xNa1p1UTNKcVdqaFZVVkpxYW10bVpXZEtURk5PY0NVeVJuazNObGxIT0RFeU5HRlZSSEU1T0RnbE1rWjFOMlIxZG0xNFUzcGFKVEpDTXpaYVlURXpUVFEwZDNFbE1rSmFaVzh5TjBWd1FTVXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejEzYVc1a2IzZHpMVzFsWkdsaExYQnNZWGxsY2kweE1pNWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozYVc1a2IzZHpMbTFwWTNKdmMyOW1kQzVqYjIwbE1rWmxiaTExY3lVeVJuZHBibVJ2ZDNNbE1rWmtiM2R1Ykc5aFpDMTNhVzVrYjNkekxXMWxaR2xoTFhCc1lYbGxjZz09

Latest 30 of 36 download URLs

Remove windows-media-player-12.exe - Powered by Reason Core Security