» windows media player.exe
Overview
Analysis
File Details
Downloads (1)
Network (2)

windows media player.exe

Bechiro.Installer

Bechiro S.L.

This belongs to a Solimba product that may be bundled with additional PUPs or may be part of an ad-supported software program. The application windows media player.exe by Bechiro S.L has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.exfilesdelivery.com. While running, it connects to the Internet address cdn.solimba.com on port 80 using the HTTP protocol.

File name:

Publisher:

Bechiro S.L. (signed and verified)

Product:

Bechiro.Installer

Description:

Bechiro Manager

Version:

3.1.20.0

MD5:

2129c2ebc5e1358c6fdd2fd614df3c1a

SHA-1:

57315379783fd23abe9a59b3e45493b7c3926be0

SHA-256:

11ce8983a86430398e3e33d68e1aa51e9783b47358490f523aaf457d7da467ab

Scanner detections:

33 / 68

Status:

Adware

Explanation:

Uses the Solimba installer to bundle adware offers.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/4/2024 6:28:58 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Generic.1002535

6416540

Agnitum Outpost

PUA.Firseria

7.1.1

AhnLab V3 Security

PUP/Win32.101Alemi

2014.07.30

Avira AntiVirus

APPL/FirseriaS.A.1

7.11.164.128

avast!

MSIL:Solimba-V [PUP]

150129-1

AVG

Adware BundleApp.GN

2014.0.4257

Baidu Antivirus

Adware.Win32.FirseriaInstaller

4.0.3.15210

Bitdefender

Application.Generic.692267

1.0.20.205

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Adware.Firseria-10

0.98/19944

Comodo Security

Application.Win32.Firseria.MAP

19026

Dr.Web

Trojan.MulDrop5.34677

9.0.1.041

Emsisoft Anti-Malware

Adware.Generic.1002535

9.0.0.4799

ESET NOD32

Win32/FirseriaInstaller.S potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/Generic.AC.3413

2/10/2015

F-Prot

W32/A-a2151e6a

v6.4.7.1.166

F-Secure

Adware.Generic.1002535

5.13.68

G Data

Win32.Application.Morstar

15.2.24

IKARUS anti.virus

AdWare.BundleApp

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.182.12911

Kaspersky

not-a-virus:AdWare.Win32.Fiseria

15.0.0.543

Malwarebytes

PUP.Optional.Bechiro

v2015.02.10.02

MicroWorld eScan

Application.Generic.692267

16.0.0.123

NANO AntiVirus

Trojan.Win32.MulDrop5.dcygsx

0.28.2.61148

Norman

Adware.Generic.1002535

02.01.2015 13:58:24

nProtect

Trojan-Clicker/W32.Fiseria.521408

14.08.31.01

Panda Antivirus

Adware/Firseria

15.02.10.02

Quick Heal

Adware.Firseria.A5

2.15.14.00

Reason Heuristics

PUP.Installer.Solimba

15.2.10.2

Sophos

PUA 'Solimba Installer'

5.10

Vba32 AntiVirus

Downware.Morstar

3.12.26.3

VIPRE Antivirus

Threat.4782980

31208

Zillya! Antivirus

Adware.Fiseria.Win32.944

2.0.0.1907

File size:

509.2 KB (521,408 bytes)

Product version:

3.1.21

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\windows media player.exe

Digital Signature

Signed by:

Bechiro S.L.

Authority:

Thawte, Inc.

Valid from:

7/24/2014 9:00:00 PM

Valid to:

7/24/2016 8:59:59 PM

Subject:

CN=Bechiro S.L., O=Bechiro S.L., L=Barcelona, S=Barcelona, C=ES

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

0DE376129471B42CE6BCA90326047A34

File PE Metadata

Compilation timestamp:

7/28/2014 12:19:03 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

12288:eB+IjTW3biPEe8qSesh0UdNzx6zbZj4T9nF4:eB+QWmPEehSesh0+x6zblInF4

Entry address:

0xDFE8

Entry point:

E8, 5E, 6D, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 55, 08, 56, 57, 85, D2, 74, 07, 8B, 7D, 0C, 85, FF, 75, 13, E8, 5F, 2C, 00, 00, 6A, 16, 5E, 89, 30, E8, 03, 2C, 00, 00, 8B, C6, EB, 33, 8B, 45, 10, 85, C0, 75, 04, 88, 02, EB, E2, 8B, F2, 2B, F0, 8A, 08, 88, 0C, 06, 40, 84, C9, 74, 03, 4F, 75, F3, 85, FF, 75, 11, C6, 02, 00, E8, 29, 2C, 00, 00, 6A, 22, 59, 89, 08, 8B, F1, EB, C6, 33, C0, 5F, 5E, 5D, C3, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, F7, C1, 03, 00... 
[+]

Code size:

116.5 KB (119,296 bytes)

The file windows media player.exe has been seen being distributed by the following URL.

http://dl.exfilesdelivery.com/n/3.1.20/.../Windows Media Player.exe

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to cdn.solimba.com (95.211.6.35:80)

TCP (HTTP):

Connects to api.downloadmr.com (95.211.39.161:80)

http://api.downloadmr.com/installer/52417230/launch

Remove windows media player.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.