» flv_media_player.exe
Overview
Analysis
File Details
Downloads (1)

flv_media_player.exe

RAPIDDOWN

This belongs to a Solimba product that may be bundled with additional PUPs or may be part of an ad-supported software program. The application flv_media_player.exe by RAPIDDOWN has been detected as adware by 28 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. It uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The file has been seen being downloaded from dl.softohqimjjedf0jq.net.

File name:

Publisher:

Frser¡a s·l· (signed by RAPIDDOWN)

Description:

DownloaddMger

Version:

1.0.0.26

MD5:

2553bc3e8efec8b96794c820642bd6a5

SHA-1:

01245c5fe78c329e908a067263967fb21f3b8d5d

SHA-256:

0e78258219ca506ae64a416fd661a1c7209cfe0359757bfc7b6e643bd4e3c6c0

Scanner detections:

28 / 68

Status:

Adware

Explanation:

This will bundle various adware such as the Whitesmoke Toolbar and Iminent Toolbar. "These offers will be displayed depending on the user's location as well as the configuration of his/her PC, considered normal to display 2-3 offers. Additionally, the download manager offers the optional installation of a toolbar."

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/27/2024 1:25:02 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Application.Bundler.Firseria.1

1001

Agnitum Outpost

PUA.Downloader

7.1.1

AhnLab V3 Security

PUP/Win32.FirseriaInstaller

14.05.09

Avira AntiVirus

TR/Dropper.Gen

7.11.148.214

avast!

Win32:Rapiddown-A [PUP]

2014.9-140509

AVG

BundleApp.J

2015.0.3479

Bitdefender

Gen:Application.Bundler.Firseria.1

1.0.20.645

Comodo Security

Application.Win32.FirseriaInstaller.AB

18245

Dr.Web

Trojan.DownLoader11.3085

9.0.1.0129

ESET NOD32

Win32/FirseriaInstaller (variant)

8.9780

Fortinet FortiGate

Adware/Sality.MO

5/9/2014

F-Secure

Gen:Application.Bundler.Firseria

11.2014-09-05_6

G Data

Gen:Application.Bundler.Firseria

14.5.24

IKARUS anti.virus

not-a-virus:Downloader.Win32.Morstar

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.177.12041

Kaspersky

not-a-virus:Downloader.Win32.Morstar

14.0.0.3891

Malwarebytes

PUP.Optional.Firseria

v2014.05.09.09

MicroWorld eScan

Gen:Application.Bundler.Firseria.1

15.0.0.387

NANO AntiVirus

Trojan.Win32.Morstar.creklv

0.28.0.59608

Panda Antivirus

PUP/Fiseria

14.05.09.09

Qihoo 360 Security

Malware.QVM11.Gen

1.0.0.1015

Quick Heal

Trojandownloader.Morstar.O5

5.14.14.00

Reason Heuristics

PUP.RAPIDDOWN.Q

14.8.15.17

Rising Antivirus

PE:PUF.FirseriaInstaller@CV!1.9C54

23.00.65.14507

Sophos

Solimba Installer

4.98

Vba32 AntiVirus

Downware.Morstar

3.12.26.0

VIPRE Antivirus

Trojan.Win32.Generic

29036

Zillya! Antivirus

Downloader.Morstar.Win32.14

2.0.0.1783

File size:

190.4 KB (194,920 bytes)

Product version:

3.0.26

Original file name:

¡nstal·exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Solimba DownloadMR

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\flv_media_player.exe

Digital Signature

Signed by:

RAPIDDOWN

Authority:

DigiCert Inc

Valid from:

11/26/2013 7:00:00 PM

Valid to:

12/1/2014 7:00:00 AM

Subject:

CN=RAPIDDOWN, O=RAPIDDOWN, L=Badalona, S=Barcelona, C=ES

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

02E94F6B0DC7BF53B8B6341C02DE4104

File PE Metadata

Compilation timestamp:

12/12/2013 11:58:19 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

3072:5mproPrY4DivfRsG25ArTL7shLWZtezEh6LtxcPykJ1H8m5Lqa1RSqTnayOPaTiW:5mpWY42X85A0hL4tezlLXcqIcKLrRSqb

Entry address:

0x62A40

Entry point:

60, BE, 00, A0, 43, 00, 8D, BE, 00, 70, FC, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.8038

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

164 KB (167,936 bytes)

The file flv_media_player.exe has been seen being distributed by the following URL.

http://dl.softohqimjjedf0jq.net/n/3.0.26/.../FLV_Media_Player.exe

Remove flv_media_player.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.