home

installer.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from getfplayer.com and multiple other hosts.
MD5:
15f8d0cf2bcf33845a77537b1c7e3181

SHA-1:
3a60fee669fc24af09a02839162385dcd0225cf0

SHA-256:
ffd21938362246fe6d91adbf6b77f4f87419eb3f1452733e05453557acbba35b

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
4/20/2024 2:23:33 PM UTC  (today)

Scan engine
Detection
Engine version

SUPERAntiSpyware
Trojan.Agent/Gen-Downloader
9606

Trend Micro House Call
Suspicious_GEN.F47V1029
7.2.269

File size:
175.7 KB (179,866 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\installer.exe

File PE Metadata
Compilation timestamp:
12/6/2009 4:50:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:YgXdZt9P6D3XJ8MHC0Xdsnr3yW/OK4UjeTv//XzlQFkFFu/HrJ6iXYgW3P5/2zB7:Ye34/i0XqriW2KET/XCKb4vXnmPRG

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installer.exe has been seen being distributed by the following 4 URLs.

http://getfplayer.com/get.php?c=ZnJvbT10ZWVudHViZW1vdnMuY29tO2xmcm9tPXRlZW50dWJlbW92cy5jb207aWRjaGVjaz0xNDEyOTQ2Nzk5O3ZzPXRlZW50dWJlbW92cy5jb218O2luZGV4X3BhZ2U9MTtyb3RfaW49MTtIc3RDZmEyMDM4ODgwPTE0MTI5NDY4MDYyNjA7SHN0Q2xhMjAzODg4MD0xNDEyOTQ2ODA2MjYwO0hzdENtdTIwMzg4ODA9MTQxMjk0NjgwNjI2MDtIc3RQbjIwMzg4ODA9MTtIc3RQdDIwMzg4ODA9MTtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO2NfcmVmXzIwMzg4ODA9aHR0cDovL3d3dy50ZWVudHViZW1vdnMuY29tLztfX2F0dXZjPTF8NDE7cG9wcD0xOw==&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1hbnR0dWJlcy5jb207bGZyb209YW50dHViZXMuY29tO2lkY2hlY2s9MTQxMzQzODc0MjtpbmRleF9wYWdlPTE7SHN0Q2ZhMjAzODg4MD0xNDEzNDM4NzQxMjg1O0hzdENtdTIwMzg4ODA9MTQxMzQzODc0MTI4NTtjX3JlZl8yMDM4ODgwPWh0dHA6Ly93d3cuYW50dHViZXMuY29tLztsYXN0X3VybD1jb250ZW50O0hzdENsYTIwMzg4ODA9MTQxMzQzODc1NzQ3MDtIc3RQbjIwMzg4ODA9MjtIc3RQdDIwMzg4ODA9MjtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO3JvdF9pbj0xO3RvPXx1cmx8dGVlbnNhcmVhLmNvbTt2cz10ZWVuc2FyZWEuY29tfGFudHR1YmVzLmNvbXw7&id=2&exv=

http://getfplayer.com/get.php?c=SHN0Q2ZhMjAzODg4MD0xNDA5NjE2MjQ0Mzg0O0hzdENmYTI1OTg5Mzg9MTQwOTYxNjU0MjMzNjtIc3RDbXUyNTk4OTM4PTE0MDk2MTY1NDIzMzY7SHN0Q2xhMjU5ODkzOD0xNDA5NjE3MTcwNjE5O0hzdFBuMjU5ODkzOD0yO0hzdFB0MjU5ODkzOD0yO0hzdENudjI1OTg5Mzg9MTtIc3RDbnMyNTk4OTM4PTI7ZnJvbT14bGJvb3R5LmNvbTtsZnJvbT14bGJvb3R5LmNvbTtpZGNoZWNrPTE0MTI5MDAxOTU7aW5kZXhfcGFnZT0xO0hzdENtdTIwMzg4ODA9MTQxMjkwMDE5NDEyOTtjX3JlZl8yMDM4ODgwPWh0dHA6Ly93d3cueGxib290eS5jb20vO2xhc3RfdXJsPWNvbnRlbnQ7cm90X2luPTE7SHN0Q2xhMjAzODg4MD0xNDEyOTAwMjQ0MjMyO0hzdFBuMjAzODg4MD0yO0hzdFB0MjAzODg4MD0yO0hzdENudjIwMzg4ODA9MTtIc3RDbnMyMDM4ODgwPTE7dG89fHVybHxiZWF1dHlzZXgubmV0O3ZzPWJlYXV0eXNleC5uZXR8eGxib290eS5jb218Ow==&id=2&exv=

http://getfplayer.com/get.php?c=ZnJvbT1kYW5nZXJibGFja2dheXMuY29tO2xmcm9tPWRhbmdlcmJsYWNrZ2F5cy5jb207aWRjaGVjaz0xNDEyOTc1OTgyO3ZzPWRhbmdlcmJsYWNrZ2F5cy5jb218O2luZGV4X3BhZ2U9MTtIc3RDZmEyMDM4ODgwPTE0MTI5NzU5NzEyMzI7SHN0Q2xhMjAzODg4MD0xNDEyOTc1OTcxMjMyO0hzdENtdTIwMzg4ODA9MTQxMjk3NTk3MTIzMjtIc3RQbjIwMzg4ODA9MTtIc3RQdDIwMzg4ODA9MTtIc3RDbnYyMDM4ODgwPTE7SHN0Q25zMjAzODg4MD0xO2NfcmVmXzIwMzg4ODA9aHR0cDovL2RhbmdlcmJsYWNrZ2F5cy5jb20vdGFnL2JsYWNrLztyb3RfaW49MTs=&id=2&exv=

Scan installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.