home

ws0ea42520.dat

Rich Video Converter

Radiocom CJSC

The file ws0ea42520.dat, “Rich Video Converter Offline Installer” by Radiocom CJSC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This file is typically installed with the program Rich Video Converter by Radiocom which is a potentially unwanted software program.
Publisher:
Radiocom  (signed by Radiocom CJSC)

Product:
Rich Video Converter

Description:
Rich Video Converter Offline Installer

Version:
1.0.0.367

MD5:
1d2de460a94c12d2cd7a94dc67e63ea9

SHA-1:
6169433c83a92baa9a923e004c41fabff1e52fa3

SHA-256:
eaec4695b5a5d0bb486b7f9757c9eb6a9019015843d897ad1bbb01822db8df18

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/25/2024 12:25:44 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.RadiocomCJSC.Installer (M)
15.9.5.21

File size:
28.1 MB (29,442,464 bytes)

Product version:
1.0.0.367

Copyright:
Copyright (C) Radiocom

Original file name:
richvideoconverter.exe

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Digital Signature
Signed by:
Radiocom CJSC

Authority:
VeriSign, Inc.

Valid from:
9/17/2012 9:00:00 PM

Valid to:
9/18/2013 8:59:59 PM

Subject:
CN=Radiocom CJSC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Radiocom CJSC, L=Kiev, S=Ukraine, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0E7CA39F8E0D8E0B14958ACC23F8607B

File PE Metadata
Compilation timestamp:
12/5/2009 8:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
786432:O7ZlNR36WfnRjK72P3ojFRrb0xDGbahn7x:E7qW/hk0VGwnF

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file ws0ea42520.dat has been discovered within the following program.

Rich Video Converter  by Radiocom
The software installer and updater will present various offers for potentially unwanted programs (PUPs).
richmediasoft.com
About 68% of users remove it
 
Powered by Should I Remove It?

Remove ws0ea42520.dat - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.