home

gomplayerensetup_2.26.exe

GOM Player

Innovative Systems LLC

The application gomplayerensetup_2.26.exe by Innovative Systems has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from gom-player.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
GOM Player

Version:
1.0.0.0

MD5:
bdc601fa37489ec4c7d28e8c578d41b9

SHA-1:
98c2dd8925b53ca81673eb36b12868bee0f88f48

SHA-256:
13dd8d6378c8f047d1f150bd646f4bd3c2fbf238de0c3d41407e1abb5504b04f

Scanner detections:
11 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
5/18/2024 2:18:38 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.OpenCandy
2014.10.27

Avira AntiVirus
APPL/Downloader.Gen
7.11.181.132

AVG
OpenCandy
2015.0.3307

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.141028

Clam AntiVirus
Win.Trojan.Agent-803351
0.98/21411

Dr.Web
Adware.OpenCandy.55
9.0.1.0301

ESET NOD32
Win32/JoyDownloader
8.10623

Malwarebytes
PUP.Optional.OpenCandy
v2014.10.28.04

McAfee
Artemis!BDC601FA3748
5600.6963

Reason Heuristics
PUP.Installer.InnovativeSystems.U
14.10.28.16

File size:
496.2 KB (508,112 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\programs\gomplayerensetup_2.26.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
Thawte, Inc.

Valid from:
9/19/2014 3:00:00 AM

Valid to:
9/20/2015 2:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
09A91C40EAE34E72CD975B0B218AE4BA

File PE Metadata
Compilation timestamp:
5/20/2013 2:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:/QrReeeeseeeeQeeeIeeeZqCH/erSRec7vxq02DfP0BqQCr4Rl5gvB:YrCLH/KSRbJP2QB724Rl5gJ

Entry address:
0x331F

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 08, A3, D8, 7A, 7A, 00, E8, A8, 2E, 00, 00, A3, 24, 7A, 7A, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, D0, EE, 79, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 20, 6A, 7A, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 20, 7B, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.9052

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

The file gomplayerensetup_2.26.exe has been seen being distributed by the following 10 URLs.

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXGwj 8XPavWwllklUzNSrwR0WyPI2a4KFjsyar5i0ypNkQL0H5PfOpLXj/ylZSIDzPCeLkErI90f45mpLCQE D9GzyD0zl/iLrmf6SpN/Sg2FJoJ03i0dJF3ymCjRnwJpqvnerEybbHK5Xi83gNz0VP ZvMlhTYuaiFGh0O8TNLAlh1fX2GX8veY6x2 8/HC3 oFGMlv5mFpOve4GkbHtOn5jpD JnlR8f/4D/.../hXr5X5sIrNWwAHPruYORnD4rJLxFT5ZocT968re1FkNrjxKx099MES7jDgawqZnu1VZ8amDP 2AW18vRNGCjCA==

http://gom-player.joydownload.es/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv I253eq ysyl4pHaAW7erC/NXK8ykYPbT6RW7X2UeB10bIjzsWXFU/Iqz3zVUz2szi1jf/.../h0r5aLh 1CaiCd0Lt5vuUXKquZOVkD53OOsDGdV0bD127qHyWV8h4RSu1dtaRmS0FAawqZnu1U98amDP 2AW18vbMmCjCA==

http://cristianls.ro/.../?wpfb_dl=24

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXBwj pXP7oQlssmVx1NTqtCkexcteQv Q8/yKn/DwtjJgcJgTtbrHuajv8mRYNIGjVEeijGbA1xb5pw8KWRAaV9T2uVRqiqnD8gffUpMuPzj4L/cR51hcXCjXyTns1 8E3/C3kDyvMUrcfwsTrJW5ePKs5bBINOb31Umh0O8TNLAlk1fX2GWUvfo/.../hqNnuxQU3ejbWsyke3NPBMWCjCA==

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymHRrzZtnWsOh152b0sCsrn8kFdE3mY/j2PHmugA0MIGjPEeutCr010bIjzsWXFUrIqz3zT0zxsmm9ifTZqdHKmiBBoJU6kQEbFzb7W3cw1p879WjwW2OTUusDldqha2ZOPfsgJFsFN6XlACMjLdzFZREgiav2RXl4ONmjmLh3Wzf55x6K3JBuGpC7bpfmOmNXnMu/F/tg2w8eroL8h0r5fKE2nSqsEZkCspPuAWvi8JuSkD4hYaRIBo4/.../CsXhBmhAT3joMQTGuiFAawqZnu1VZ8amDP 2AW18vRNGCjCA==

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXBwj qXP7oQkEsml0kNzq1E1v4ZNbB47pquHf14WJwztEcehi6KOetdib lQobZyfJW4alBrcx3ewokdSWRAaX9T2tRAau i6tgKzbr93ZlWNLoJc1hl4BXnStGGE2hshq9CzwSCTAHugDj4TzPHQNbrMgeUdTZ/q1RHE8cszENBoknqqnGCUvasOrhf8 TWO8uEjNnv5kA5qve4GkbHtOhpjpD JnlR8f/4r5n1O7ZKh/hWjiEcQe5MaxUXj7uNKamSYyJO8XV49kM34o8 imHRBz2k/.../44JDlxwU3aS2ZpSpIjJCGcmCjCA==

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPTqmEB/.../zyn9np5iNEMJ1XlbKn3fHm ykYHcXGHWOOgEqdwmuc0m4HeFQfS9S3yHgKzqnD8gfTbvNjKmiBBp58i1QoeACPlGDU2nsEj7Cr8SGjaSr9W2oS4YyUMMbMzJFsFN6XlACMjLdzFZREgiav2RXl4ONmjmLh3Wzf55x6K3JBuGpC7bpfmOmNXnMu8HeM2y0RWrdSsxB26Mrh 1CanA8VPuZjmXjm14tjF2D4rJLxAT5Z9YCsxu6GtHxBzhhSi3J5OFSbzU0Wz tix1QR8NHPAuW4c3NvVNHOjCA==

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXAwj 1RrjxCgghkkVxZmbzR1 xcteQv U8/zOh/jwnickFbk3lYqn9OWG3g15bOHHMQr21E/Y9wbNyzMSPDE b/CXqSh jqnD8gfPbvNvakGtMqYc7wF9BXmT U2pnn4Aj/CHoWGeLS/9WzM3zYW5bPas5bBINNqXlASUiOJKfb05g2f nR2JgOOrwz 8zEDzy50jE3/VtBJivJJvtLy0NloT/.../VNXOjCA==

http://jdcdnnet.blob.core.windows.net/fas/wi/1/24/1/.../gomplayerensetup_2.26.exe

http://gom-player.joydownload.com/get_azure_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYNbB4rxr8CWi8yEnickFbk3hYqmpdzPlggFKOTqGGu2mHLcxw75jwM3eDQ b7WmhWFT8 3G5gefTrNjQlmtZqtY6hV9QAin7Xms3hshq9CnwSGKfUrcfwsTrJXdePKs5bBINOb3/VGh0O8TMLAlmyLPvUSwkcpfzw Z2BGuwoAWMjvQvDpW3YoX3MSUDmIKvFqoumxcHu9Gh2ErzLaB3kia0VJAArpvqCiyr5s/.../rBAfhoZ72zEwvPXjW zNAz9KKOnOjCA==

Remove gomplayerensetup_2.26.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.