home

gom player 2.2.62.5207 [filesick].exe

Unitech LLC

The application gom player 2.2.62.5207 [filesick].exe by Unitech has been detected as a potentially unwanted program by 14 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from amazingthingz.net and multiple other hosts.
Publisher:
Unitech LLC  (signed and verified)

MD5:
e79c1a0feadcfa6a7d7d29500219370a

SHA-1:
d6f87ebf778cf55ca29577fa9aab93749ed20fdc

SHA-256:
05a7bab2d92cfed02ecfa58fa4f10e16cb55c394b1fd990b68bc0fada048e11e

Scanner detections:
14 / 68

Status:
Potentially unwanted

Analysis date:
4/27/2024 1:39:35 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
TR/Dropper.Gen
7.11.166.104

avast!
Win32:Malware-gen
2014.9-140924

AVG
Skodna.Bundle.3d5
2015.0.3424

Baidu Antivirus
Trojan.Win32.Agent
4.0.3.14924

Bitdefender
Trojan.GenericKD.1800295
1.0.20.1335

Dr.Web
Trojan.DownLoader11.19511
9.0.1.0185

Emsisoft Anti-Malware
Trojan.GenericKD.1800295
8.14.09.24.09

G Data
Trojan.GenericKD.1800295
14.9.24

Kaspersky
Trojan.Win32.Agent
14.0.0.3203

McAfee
Artemis!E79C1A0FEADC
5600.7080

Reason Heuristics
PUP.Unitech.EE
14.7.4.6

Trend Micro House Call
Suspicious_GEN.F47V0701
7.2.185

VIPRE Antivirus
Ividi
30928

ViRobot
Trojan.Win32.A.Agent.1283072
2011.4.7.4223

File size:
1.2 MB (1,245,152 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\gom player 2.2.62.5207 [filesick].exe

Digital Signature
Signed by:
Unitech LLC

Authority:
COMODO CA Limited

Valid from:
6/13/2013 2:00:00 AM

Valid to:
6/13/2016 1:59:59 AM

Subject:
CN=Unitech LLC, O=Unitech LLC, STREET="Kashirskoe sh. 9, bld. 1", STREET="premises IV, room 1", L=Moscow, S=Moscow area, PostalCode=115230, C=RU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
008422F9D83C113BC0C58A45C1B790465B

File PE Metadata
Compilation timestamp:
7/1/2014 12:23:20 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.22

CTPH (ssdeep):
24576:oDuFmjcDuFmpYo2n14mBFgcma4QorNzdE4op:74L4pYo614RA4QorHE4op

Entry address:
0x12A0

Entry point:
83, EC, 1C, C7, 04, 24, 02, 00, 00, 00, FF, 15, 60, 61, 40, 00, E8, 4B, FD, FF, FF, 8D, 74, 26, 00, 8D, BC, 27, 00, 00, 00, 00, A1, 80, 61, 40, 00, FF, E0, 89, F6, 8D, BC, 27, 00, 00, 00, 00, A1, 6C, 61, 40, 00, FF, E0, 90, 90, 90, 90, 90, 90, 90, 90, 90, 8B, 0D, 0C, 20, 40, 00, 85, C9, 74, 38, 55, 89, E5, 83, EC, 18, C7, 04, 24, 00, 30, 40, 00, E8, FC, 09, 00, 00, 52, 85, C0, 74, 23, C7, 44, 24, 04, 0E, 30, 40, 00, 89, 04, 24, E8, EF, 09, 00, 00, 83, EC, 08, 85, C0, 74, 09, C7, 04, 24, 0C, 20, 40, 00, FF...
 
[+]

Code size:
4 KB (4,096 bytes)

The file gom player 2.2.62.5207 [filesick].exe has been seen being distributed by the following 50 URLs.

http://amazingthingz.net/.../get.php?channel=7348&rk=96599263

http://amazingthingz.net/.../get.php?channel=7348&rk=25343645

http://amazingthingz.net/.../get.php?channel=7334&rk=72524737

http://amazingthingz.net/.../get.php?channel=7334&rk=23285534

http://amazingthingz.net/.../get.php?channel=7348&rk=42086374

http://amazingthingz.net/.../get.php?channel=7348&rk=59445322

http://amazingthingz.net/.../get.php?channel=7334&rk=58022816

http://amazingthingz.net/.../get.php?channel=7348&rk=10011293

http://amazingthingz.net/.../get.php?channel=7334&rk=52017064

http://amazingthingz.net/.../get.php?channel=7348&rk=88770805

http://amazingthingz.net/index.php/.../ULEJQ?&rk=54961256&channel=7352

http://amazingthingz.net/index.php/.../AcmJK?&rk=6196404&channel=7352

http://amazingthingz.net/.../get.php?channel=7348&rk=23358270

http://amazingthingz.net/.../get.php?channel=7348&rk=27055061

http://amazingthingz.net/.../get.php?channel=7334&rk=84449297

http://amazingthingz.net/.../get.php?channel=7334&rk=90982930

http://amazingthingz.net/.../get.php?channel=7348&rk=75039494

http://amazingthingz.net/.../get.php?channel=7334&rk=85331918

http://amazingthingz.net/.../get.php?channel=7348&rk=26382836

http://amazingthingz.net/index.php/.../AGZZZ?&rk=6238517&channel=7350

http://amazingthingz.net/.../get.php?channel=7348&rk=12235858

http://amazingthingz.net/.../get.php?channel=7348&rk=77990127

http://amazingthingz.net/index.php/.../KYXzW?&rk=8024887&channel=7350

http://amazingthingz.net/.../get.php?channel=7348&rk=96288968

http://amazingthingz.net/.../get.php?channel=7334&rk=9916071

http://amazingthingz.net/.../get.php?channel=7348&rk=28317363

http://amazingthingz.net/index.php/.../wRlnk?&rk=71333404&channel=7353

http://amazingthingz.net/.../get.php?channel=7348&rk=95661558

http://amazingthingz.net/.../get.php?channel=7348&rk=21734057

http://amazingthingz.net/.../get.php?channel=7334&rk=20859807

Latest 30 of 126 download URLs

Remove gom player 2.2.62.5207 [filesick].exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.