home

extrememediaplayer_marimedia_installer.exe

Denco Limited

The application extrememediaplayer_marimedia_installer.exe by Denco Limited has been detected as a potentially unwanted program by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.extrememediaplayer.com and multiple other hosts.
Publisher:
Denco Limited  (signed and verified)

MD5:
f6ec1a8ee04c611de0fc083f9672667f

SHA-1:
2b557f44192c900e7a38ee0bc1ad4a3bdca0028b

SHA-256:
b6035889854e50121bc1f0dd34e258bfaf564cd10731d529abd7d7bfa9826920

Scanner detections:
7 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallIQ (by InstallX) software bundler that may include toolbars and other browser extensions offers.

Analysis date:
4/19/2024 10:01:07 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.Agent
4.0.3.14717

Dr.Web
Adware.W3i.31
9.0.1.0198

ESET NOD32
Win32/InstallIQ (variant)
8.8944

Fortinet FortiGate
Riskware/DomaIQ.C!tr
7/17/2014

Reason Heuristics
PUP.DencoLimited.g
14.7.17.15

Trend Micro House Call
TROJ_GEN.F47V0418
7.2.198

VIPRE Antivirus
InstallIQ Installer
22592

File size:
1.1 MB (1,128,552 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\extrememediaplayer_marimedia_installer.exe

Digital Signature
Signed by:
Denco Limited

Authority:
VeriSign, Inc.

Valid from:
7/8/2012 7:00:00 PM

Valid to:
10/11/2013 6:59:59 PM

Subject:
CN=Denco Limited, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Denco Limited, L=Hong Kong, S=Hong Kong, C=HK

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
0B69332C2E6A6194B9F6342422CA05DC

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:41 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:bmX2UuwkeNWChl2Mctvll3VHAMLalye9KE2wd1Hkdgy1AXphrC:VS1aMctv/tAX8E2wddk2rplC

Entry address:
0x30CB

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 3F, 42, 00, E8, F1, 2B, 00, 00, A3, 84, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 36, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.8731

Packer / compiler:
Nullsoft install system v2.x

Code size:
22.5 KB (23,040 bytes)

The file extrememediaplayer_marimedia_installer.exe has been seen being distributed by the following 15 URLs.

http://www.extrememediaplayer.com/.../direct.php?subid3=10&subid1=mari&subid2=RwQAAKHUPABbYzMBAAAAAA2UTAAAAAAAAAAEAKcBAAAAAA0AAQAFEH8rWQAAAAAAKwxjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADk-hYAAAAAAAIAAgAAgD8AX-e5Qj4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,eJwLKLf09gwLzcpzz81PTfRK88xPdI-0iCpIqcj08NULTgYAuQoLKg==

http://ad.improvemedianetwork.com/clk?3,eJydTkFugzAQfA03irANxAj14BRQU2FaIqoquTn2JtBAiICUNq-vgVS5d2WNdmZnd4xI4FDAiAqgPlDlOCpABJQiPl4IMO0gCLCNsLNYeJiY-Dpso0Ty7PD0kob2kk21ke.sVoeJz.0bHfE5SvJom80SzZz-5vRYLdn.K0zs9d.-irFBR4eUXcqNS3JnebdV5baOvnm--kk-OEqvvOd5XPESlTznSH9tSD-Zvanj-jXPML8HPJpm0fdngzADx.pJdZJCFvAgLHEUtSgLZZ2g15OuExqR649GEl-bE5TKICGiyB5FT0700un2PE8IcTVpYQ8ttFqYkrBL9CEX7ycYhsES3dGSTT1z2I37lXaLXfMF491Ckw5EK4tf8VWCfg==,

https://ad.yieldmanager.com/clk?3,eJydjV1rgzAUhn9N70SMiRoJuzhO6z6qa4alrXdpiEanuE3Brr9-YXXbfR8OnIf3HHgRZoJWwquokh4RmAjBEFahh6V0qW85jDEUOBTh0KXUarf8DM9dv53vaxFnEfzwtSvgl4gDDIsTgBoeEpmWB35NdHAWy.EjTjO4ncg-abn4I8BsqmIKrkxoV5Do7y1NSBnvvGNbO5v9k84vcsqKdZc1SL.sX5tNwS.HNm-ylJO8L5vyv-DOsvQ0vY8rDCt3bWaeZ7sSUp2G4c2WQ2-iXo2jqNVodJi0-jQbOQYS-D4JAx-hb.05ZOs=,

http://ad.yieldmanager.com/clk?3,eJytjWFrg0AMhn-N36RcLlZvyD7c1TkElQoO0S-lPZ2e1ir2Bqu.fkpL-wf2koQ8bxIC6J6A0opaiBIQt5S4gJWDJamsEzOJ67p06wBhCOCYu8b-.IDjZc-FU8-54KviG0sTflfNJecP2LO1Cn6RYVbfrdH3O.4v2uVM5I8-WP.y2mNc.aSJnC3xXPOCOW5FW7SiCbMA4uxLR6l.jhSouA1ImEqrSMsuynIovA7y5Hn5bpqN1qOB3KD-Eu1109.U5XvQw6iOGzn0izmtWZVqqqTeNLo.G-hLVRroAUXq4JtB7fLFFln4quZqMSyb.dorz52S49TrCbf24lN6uI8O5A-R4nSH,

http://ad.yieldmanager.com/clk?3,eJytjc1ugzAQhJ8mNxQZLwYsqweDIUIC8lOrCN-oIZAmUJRwAJ4-P1R5gn5a7Y5GM1oTGBypU2L67bpgFRSbzIRKa9sB29YGYoxhgqllIhscIyZj6pc.p10tgk9x9vgT39.Imi-8brTonfvcgUdJ-7VfrG4OL.xf8CBr9J-OXn9r4fJcHrpZWN47Js6TynKsRILjLJmUjIZEhpfkhIja7EmcqXYr9JjjYE6lHtP63fwwjGYY-hXwFQ4fcyw6Pd2Ga1W1t7X-bR9WUQJCIyZo3Tf9HdhwXX8=,

http://ad.yieldmanager.com/clk?3,eJydjlFrgzAUhX-Nb1I00cYQ9nA1sQwqQ6a4-JbGTCdt3Zhd1F-.dkj7vo.7cO6558D1McMKKb2lkd8cmuZ9S5mPjfaoMVGAXY8xhkKKCPXwdeXi1SaNInmbJO0iY.jjixQ5rNysYdUlQA4JfO.qt.XekUmtOVqge-k.7EisV.kMYAFaHoEyxlgexPcUL2fZx0dZCLuvsikr5JgV6TH78MK6F8G-ErjmZSiX0r5UYq4fLz25bjeOnw4GB6XXsdZu5uEyXg5mo4fTzVGj7hyc.jiYn2l3Ok-oX-z8C4MbYoU=,

http://ad.globaltakeoff.net/clk?3,eJydjVFPgzAUhX.N3oDQlkIN8aET0CksYtCtT6aMzpWUdWoDk19vkSV79-Tm3nO.e5MDUIz3GNc3DRARiBAIcAyQCCzjgiDHj-MYABxgREISOa-69mn.KZ7KuyNPiiWdlOus-qCz.uZq9s9k6g.3qfZW5Yy8rX6ZXdLozQX-SwnbUv.ibd5goxNCg.D8Vo3B8vqWwmJ8bFm1-8k3WcdgaYoqU4UEct3Sc16lg50-61KwhgwX14BbxzkYc1oguoCZrWEYvFp8nxQ3R7mXqtO99Go52lOjO76T7gTt1vMv1cpeu0oY7YbE7WUj9DsMawAjSIR3MJ36BaJUbi8=,

http://ad.yieldmanager.com/clk?3,eJyVjU1Pg0AQhn8NN9KwH7KQjYcBCjHp0hDXItzoQqAgUpOtC.56q2I9-2QOT96ZN4MId5uauhi7tU8Z85HDEWkURa6iVNkO5xz7dz5h2PWwHW0fTZjlVQZh2H4UAXzzxmQGvwwA06oFQAvh1kvK53Xfsbn6scCX-K.0fwJ07NTqDwDm-iryoBcinyMa3M6StC.6eizzYtnlYt7nmRYyfhEn1O2jp3knFS1lPQh5GNMkHUV7a97bdqf12SJg4fg6xpjNMl305dhs1DR-JZVWnUXid4tEyzBNp1dnODPvE5MqYes=,

https://s3.amazonaws.com/.../ExtremeMediaPlayer_MariMedia_Installer.exe

http://www.extrememediaplayer.com/.../direct.php?subid3=10&subid1=mari&subid2=RwQAAKHUPABbYzMBAAAAAA2UTAAAAAAAAAAEAKcBAAAAAAoABQACF38rWQAAAAAAKwxjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADk-hYAAAAAAAIAAgAAgD8AgnjQED4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,eJxz1jOwDLIIzM3LzUsMKnJOc6l0zEoOzs.013Ny9AzOzvd31NUFANdSC5A=

http://s3.amazonaws.com/.../ExtremeMediaPlayer_MariMedia_Installer.exe

http://www.extrememediaplayer.com/.../direct.php?subid3=10&subid1=mari&subid2=RwQAAKHUPABbYzMBAAAAAA2UTAAAAAAAAAAIAKcBAAAAAAcAAwAGCn8rWQAAAAAAKwxjAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADk-hYAAAAAAAIAAgAAgD8AWz6ORj4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,eJxzSvcPzjf3TM-OMCm1KAxLyzFPdwsriwz0tDTzzcrN8zcs19UFAN.GC9Q=

http://www.extrememediaplayer.com/ExtremeMediaPlayer_MariMedia_Installer.exe

http://www.extrememediaplayer.com/.../direct.php?subid1=mari&ymid=DESwCRHOQQCCgzYBAAAAAAq7TQAAAAAAAAB0AAoAAAAAAAcAAgABEMGZXQAAAAAAbP5nAAAAAAB9T2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAyBcAAAAAAAIAAwAAgD8ATygV4z4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,eJzTS4vyC84rzs3LzQtLd6m0SPf0TSuLj3BPd.Nwy6x0qfQPiDRIT9fVBQAl2A3a&subid3=10

http://ad.yieldmanager.com/clk?3,eJydjlFPgzAUhX8Nb2RpKYw2jQ-3dOiSFQdWJ7wBYxtuiJpiM379piHz3S.n4eTec3MuJpxWJUOM-Swo52VFEcekaQja7kKKXcQ5ZyGhmJB56MrFk42yh8c0jaL9mAv45TPUKUwIBNBPvgbYg1io--J12lfr4H3KMe3djv6BgLOoJ78EsNcqSWG9yxN.9MUtJnNU6HRMNtlptVFeomujdHxSLW4L-fK20llXdLmv9BIp75kkfy.due7BmA-HgOPFV1lrZ-d-MEPVzOq--5mUpj44JP52iNx-maE5Bkc6tBcAimCi,

Remove extrememediaplayer_marimedia_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.