» hdvidcodec.exe
Overview
Analysis
File Details
Downloads (27)

hdvidcodec.exe

VASSANA KONGSOONGNERN

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application hdvidcodec.exe by VASSANA KONGSOONGNERN has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. The file has been seen being downloaded from hd-plugin.com and multiple other hosts.

File name:

hdvidcodec.exe

Publisher:

VASSANA KONGSOONGNERN (signed and verified)

MD5:

1009b0450e65b59befebf4e7c60fe3b9

SHA-1:

b4a1633eb14523596976601429c7dba53a52787e

SHA-256:

3f8859e34191664c122efa4df0721786c986303e2fb2d207a2f92d417bce4681

Scanner detections:

13 / 68

Status:

Adware

Explanation:

Bundles a number of adware programs in the installer.

Analysis date:

4/24/2024 3:31:16 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

Adware/Yontoo.71608

7.11.184.22

AVG

Generic

2015.0.3293

Comodo Security

UnclassifiedMalware

20051

Dr.Web

Adware.Downware.8319

9.0.1.0315

ESET NOD32

NSIS/TrojanDownloader.Adload.AC

8.10704

G Data

Win32.Application.Agent.3LIORS

14.11.24

K7 AntiVirus

Adware

13.185.13965

Kaspersky

not-a-virus:AdWare.NSIS.Yontoo

14.0.0.2961

McAfee

Artemis!1009B0450E65

5600.6949

Panda Antivirus

Trj/Chgt.K

14.11.11.06

Reason Heuristics

PUP.VASSANAKONGSOONGNERN.K

14.12.16.10

Sophos

Generic PUA LE

4.98

VIPRE Antivirus

CoolMirage Ltd

34702

File size:

69.9 KB (71,608 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\hdvidcodec.exe

Digital Signature

Signed by:

VASSANA KONGSOONGNERN

Authority:

Thawte, Inc.

Valid from:

10/6/2014 3:00:00 AM

Valid to:

10/7/2015 2:59:59 AM

Subject:

CN=VASSANA KONGSOONGNERN, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

7E630B1125BFC2AAB3F8750B7348F18B

File PE Metadata

Compilation timestamp:

12/6/2009 12:50:46 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

768:81cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJLfQ24SwA25WennruTCl48YU794fbN:aQpQ5EP0ijnRTXJLE/4ASc5qA2qiRxZ

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file hdvidcodec.exe has been seen being distributed by the following 27 URLs.

http://hd-plugin.com/.../topdown2.php?name=&ftft=topvideotv--1x

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=puqt7hdueush

http://hd-plugin.com/.../loaderall.php?pub=dmpft|5411c8076d47cd40b2000004

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=jpc30utkeasp

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=8vnufdpg4g4e

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=606kw5hwle09

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=8fzklz9b28lr

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=2cafgvisa6jw

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=6fra9tgy1y2n

http://hd-plugin.com/.../loaderall.php?pub=royalvids--iframe

http://hd-plugin.com/.../loaderall.php?pub=mooshare--iframesmall--old

http://hd-plugin.com/.../loaderall2.php?build=nf&pub=lsha--5

https://www.hdvidcodecs.com/.../loaderall2.php?build=nf&pub=lsha--5

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=qxn7og1hdtfa

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=wo6xz8qed23t

http://hd-plugin.com/.../loaderallsb.php?pub=seriesbang&name=Your_Download

http://hd-plugin.com/.../loaderall_noad.php?pub=mooshare--iframesmall--new

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=1p94llpts0j1

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=tqtm2bu6xef4

http://hd-plugin.com/.../loaderall.php?pub=dmpft|5411c7fe6d47cdf9e7000003

http://www.hd-plugins.com/.../loaderall_noad.php?pub=mooshare--iframesmall--new

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=z9iv8auz558l

http://stockdl.blob.core.windows.net/.../HDVidCodec.exe

http://hd-plugin.com/.../loaderall2.php?build=nf&pub=premier

http://hd-plugin.com/.../loaderall.php?pub=mooshare--iframe

http://hd-plugin.com/.../loaderallmod.php?pub=modovideo&sn=y&name=7ps51vrsgetx

http://www.hd-plugins.com/.../loaderall.php?pub=mooshare--iframesmall--old

Remove hdvidcodec.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.