» installer_vlc_spanish.exe
Overview
Analysis
File Details
Downloads (2)

installer_vlc_spanish.exe

WorldSetup

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_vlc_spanish.exe by WorldSetup has been detected as adware by 24 anti-malware scanners. The program is a setup application that uses the installCore installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The installer is marketed through download protals and search ads as the VideoLAN VLC media player but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

WorldSetup (signed and verified)

MD5:

770bc4909f26961e33ccaf614662157a

SHA-1:

fd3699eabc34c767368b42d5912450aeef913ba2

SHA-256:

30986e614fb51180cceec688dadf36905b56aa11604e364258e53471e585768d

Scanner detections:

24 / 68

Status:

Adware

Explanation:

May bundle additional potentially unwanted software such as adware during setup.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/19/2024 10:30:52 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.InstallCore

7.1.1

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.134.46

AVG

Trojan horse Ransomer

2016.0.3195

Comodo Security

Application.Win32.Installcore.BB

17868

Dr.Web

Trojan.Packed.24524

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Zusy.68408

8.15.02.18.03

ESET NOD32

Win32/InstallCore.JE.gen potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/InstallCore_JE

2/18/2015

F-Prot

W32/A-dbe1ec51

v6.4.7.1.166

G Data

Win32.Application.InstallCore

15.2.24

IKARUS anti.virus

PUA.OSAppBundler

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.176.11721

Malwarebytes

PUP.Optional.BundleInstaller.A

v2015.02.18.03

McAfee

Artemis!F6314EDD8478

5600.6851

NANO AntiVirus

Riskware.Win32.InstallCore.dcnbpi

0.28.2.60990

Qihoo 360 Security

Win32/Virus.Adware.94c

1.0.0.1015

Reason Heuristics

PUP.ironSource

15.2.18.3

Sophos

PUA 'Install Core'

5.10

SUPERAntiSpyware

PUP.InstallCore/Variant

10047

Trend Micro House Call

TROJ_GEN.F47V0227

7.2.49

Vba32 AntiVirus

Downware.InstallCore

3.12.24.3

VIPRE Antivirus

InstallCore.b

26980

XVirus List

Win32.Detected

2.7.13

Zillya! Antivirus

Trojan.Kryptik.Win32.492870

2.0.0.1790

File size:

662.6 KB (678,552 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\installer_vlc_spanish.exe

Digital Signature

Signed by:

WorldSetup

Authority:

COMODO CA Limited

Valid from:

1/2/2014 7:30:00 PM

Valid to:

1/3/2015 7:29:59 PM

Subject:

CN=WorldSetup, O=WorldSetup, STREET=Lilienblum 28 St., L=Tel-Aviv, S=Tel-Aviv, PostalCode=6513307, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

6EEF11096F7B5CDC42244636F32F2208

File PE Metadata

Compilation timestamp:

6/19/1992 5:52:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:Ovpgxwq2fo9kt1cJK8D42LltN+lrZ9iPZzVXBlqktRx/Y7Hi/qmRMvyVxlZ:OvmKZAWt1CHD42UlWlB8kt3/8H/4Mvu

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_vlc_spanish.exe has been seen being distributed by the following 2 URLs.

http://domsem.com.edgesuite.net/installers/out/002270022800301/ax/descargares/spanish/adcash/chrome/vlc/d/2dd6fd8c2ce75295475716272cde999a/.../installer_vlc_Spanish.exe

http://mediaplayer8.descargar.es/down.php?p=ADCASH&trckid=uc854552f51b4ff8f7682aab691

Remove installer_vlc_spanish.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.