home

kmplayer_4.0.7.1.exe

The application kmplayer_4.0.7.1.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from f.sync.hamicloud.net and multiple other hosts.
MD5:
cce435428060654326693aca2edacf66

SHA-1:
ce4a4356d88bd1366813b45519d36167cfe53691

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/25/2024 11:42:57 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bundler.Meta (M)
16.4.23.16

File size:
42.4 MB (44,466,540 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\kmplayer_4.0.7.1.exe

File PE Metadata
Compilation timestamp:
2/4/2016 3:38:25 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
786432:QPC83kIlnNzFzvRQZwD3ES1Fs+Htf+v00anMJ6zcQVlDpH+d0+0Bkx:QPb35QZI17Nf+v00anrzcKk0+0s

Entry address:
0x1E64B

Entry point:
E8, DF, 65, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8D, 45, 08, 50, 8B, F1, E8, 82, FC, FF, FF, C7, 06, 94, C8, 42, 00, 8B, C6, 5E, 5D, C2, 04, 00, C7, 01, 94, C8, 42, 00, E9, 37, FD, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, F1, C7, 06, 94, C8, 42, 00, E8, 24, FD, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, 6A, CA, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 56, 57, 8B, 7D, 08, 8B, 47, 04, 85, C0, 74, 47, 8D, 50, 08, 80, 3A, 00, 74, 3F, 8B, 75, 0C, 8B, 4E, 04, 3B, C1, 74, 14, 83, C1, 08...
 
[+]

Entropy:
7.9995  (probably packed)

Code size:
166 KB (169,984 bytes)

The file kmplayer_4.0.7.1.exe has been seen being distributed by the following 17 URLs.

http://f.sync.hamicloud.net/.../@download?6d324fcbfc4646e50295f167abff4cd3&34d89697a97d06c94da96546c9e12379

http://f.sync.hamicloud.net/.../@download?3735f0805302525f139efb3491928b00&7c83c2d2c81a5ea0a70b682eb5f659b2

https://d1zjcuqflbd5k.cloudfront.net/files/.../JkjM?response-content-disposition=attachment; filename=KMPlayer_4.0.7.1.exe&Expires=1466076426&Signature=EFODvtfVBnO60WZENQGdw0outl8Vyw7l1mMjCN-MdqW1W4K39oriGFb3fgNbxcPNpZpdfQfoDs0EMeUhiUXS9VyQN6OuOG1AoDQ808Gh29KF9aWG6XkgRHl7URAqanMZLLniHeyvmIY66dnot3woCLwS79j2v4gJ5ppNWdCH8ZY_&Key-Pair-Id=APKAJTEIOJM3LSMN33SA

https://fs08n5.sendspace.com/dl/cfb6673bd49ce76cb8c5c97cf8d843d1/577783fe1dffa65e/.../KMPlayer_4.0.7.1.exe

http://f.sync.hamicloud.net/.../@download?779e25a30bc571d22f0ad59efc5ccab6&2cd40f9e264e5017af3df513090f1b63

http://f.sync.hamicloud.net/.../@download?18176c0986b49a8fb27e2aaa21740b32&3b988b96025a2348aa68543a702fae8b

http://f.sync.hamicloud.net/.../@download?0bd74824a285032d81913049d9dce14d&ed2e5eeac3b38c0190bd84989473d255

http://f.sync.hamicloud.net/.../@download?dce3a452ade0ae4ec80b404adbcf3eb2&0eba330797a04209083fb3be774a8ab1

http://f.sync.hamicloud.net/.../@download?9f0a53a609be2b8d44c3460eac8a1fd2&8983ecc51c80350a1f55ef3c8af0d92b

http://f.sync.hamicloud.net/.../@download?b57a8fea9db11065b515f5cfe48f7855&03f707b2ceaff7dfd5ad324ded9aa5a0

http://f.sync.hamicloud.net/.../@download?02058ec5e71e4d3491e913228fa3bdf1&0ae2e805189580a81196f7ba6b24c612

http://f.sync.hamicloud.net/.../@download?59fbaa4a3625cae56c06ab28adc57fe2&c84d63f42fbe1fef7aec5f57fe119fde

http://f.sync.hamicloud.net/.../@download?362ad92f0f776e371523f6ecbbbb5abf&37049a5877e3c05611c8058f630f2aee

http://f.sync.hamicloud.net/.../@download?f82f26fa624d98b5e850c5acd1e3a66e&73927f725274d788b1cf127eeaed77fb

http://f.sync.hamicloud.net/.../@download?178a087fe995039b76ed71f06db1c5f9&4e25e8225a198bd17a475c460134be8c

https://www.dropbox.com/s/.../KMPlayer_4.0.7.1.exe

http://f.sync.hamicloud.net/.../@download?8896953a877d53eb958e3da1eae7142d&9b4c346a9f4597197e45ae86a6785d88

Remove kmplayer_4.0.7.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.