home

kmplayer_v3.8.0.117.exe

KMPlayer

Sevas-S LLC

The application kmplayer_v3.8.0.117.exe by Sevas-S has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from kmplayer.downloadable.co and multiple other hosts.
Publisher:
Sevas-S LLC  (signed and verified)

Product:
KMPlayer

Version:
1.0.0.0

MD5:
fbbb2401916e0d725d3ace3eb32e944c

SHA-1:
6b1a56ea77e60eb41856b7a80b31be0486786668

Scanner detections:
9 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
8/6/2025 8:58:17 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3383

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14814

ESET NOD32
Win32/JoyDownloader
8.10161

Malwarebytes
PUP.Optional.OpenCandy
v2014.08.14.10

McAfee
Artemis!FBBB2401916E
5600.7039

Reason Heuristics
PUP.SevasS.Q
14.8.14.10

Sophos
Generic PUA GL
4.98

Trend Micro House Call
Suspicious_GEN.F47V0721
7.2.226

VIPRE Antivirus
Sevas-S Installer
31670

File size:
489.7 KB (501,408 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\Documents and Settings\{user}\My documents\downloads\kmplayer_v3.8.0.117.exe

Digital Signature
Signed by:
Sevas-S LLC

Authority:
VeriSign, Inc.

Valid from:
2/23/2014 3:00:00 AM

Valid to:
3/26/2015 2:59:59 AM

Subject:
CN=Sevas-S LLC, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Sevas-S LLC, L=Kyiv, S=Kyivska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4B35AC223F4DB03D3B4C5368983A4B53

File PE Metadata
Compilation timestamp:
5/20/2013 2:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:ZKcp964LBC4CLabntnSfht6Ic9ebnZJ6Se:PpgoBMabn05AIieLZJ6Se

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8276

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file kmplayer_v3.8.0.117.exe has been seen being distributed by the following 13 URLs.

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXBwj sXP7oQkEsnl0kPj6vGBD1cteQv U8/zOh/jwnickFbk3kYqn9OnCuyxdSMWmeQrDzCr50ybtq1seaFQfS9S3yHhm0qnD8gfLbvJ6BzzcU5tYiiBZIVny1Tnpnn4Aj/yHoW3GSA7ZawtW0f3deKuwgJEEFMqv3Xnh6ec3MJhBhhqXuAHB8JNDg2q4/DGqwoCGy/KM9Tcf/.../4O h1vyfOkswz6tWsVc7cz4SXjpuYPEw29gO cKAMZhK3RguuqtD0E8zkrhnogGASeiDA75sdq9kx0ufXjBsngT39HSN2CjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXBwj qXP7oQkEsnV0kODqvGR/ga5/ZtukkrjyqsGMrwdoNJgTtbrHuajv8mRYNIGjVEeijGLI xrplw8OWRAaQ/yXqWB 0 CfuwrCT8svT0mlDq4dr3hUeBT/ySCx 18kt9DmsAz/MUrcfwsXiPSV8FdluflFaccCxVWR3Zs7QJxolkvSsRzQuO4/x2/9sVz2ouRnFnvV BZWve4GkbHtOmZjpD JnlRsf/.../rAAfh9cW4k1pnLHmHsmkez9jWM2CjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR3xcteQv E8/yG6sGMxwdoEP0b1Y/j2PHmugw0MIGjVEeikE/Y9xbNykY7dXk7E7SShBkfzuHO/iPDQqN/T0mlIq4d22gFQXzWtDDRnlcUh/iP9SGjaSr5W2piiJTxEYr44PV9WbfuoETltc43EJREwzPiwAC1mcoD4w o3Bmi9oFGMlvtmFsTkLJe8ZDJW3cK3D5JZ/0FEpN2/4h77cKJrlzKnAshDu4/uUXKquZKaiHV5M6RIBo4/M20it/.../4jvhAUtNGCf5SpIjJCGcmCjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXBwj qXP7oQkEsnV0kODqvGR/ga5/Zs kkuC2 yon2dBXJ0bjaLP8PHq7xV1TcWmOEfvjXKc8gLNhztScFQfS9SzyHgCu7Gm0yP/XpMvZl2tLqZIiiBZIV3y1SWchhshw9Cr5USCTQbxW2pO4dHdbOfB3bUQdOOz9XnBtI5OOekpr2eP2GWUve4/giLRhHGL5uFjFjv5rFpn esSkfScDg5XoX/sv3BcW55r8iFvqZel/.../bky9V0Sm4fWixBEtIHLauWsTw4ybZWCjCA==

http://kmplayer.pt.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4YdzZp7dvriWi8yE3iYccJgTtYLHuZC78nAURZyGeEKqtHL8lleA8kdSWRAaT/CXqdzuX5Cr23re 6NrGmX1Lv5QxhEsXHCO1AX1/lsk7oWjoUSCTR7ZOj56/Y2hAK6s5bBIMOb2xDy5tc43EIBEwjafsEi4iao6x2 8/HC3 oFGMlv5mFpOve4GkbHtOnJjpD J9lRwW5sv3i1LqO I1zm7zEcQE5Ma/.../rAAfh9cW4k1pnLHmHsmkez9jWM2CjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhr4coOQp h152L0sC8rlY9RagT1Y/j2PnO20gABcSPQSqDiWuklyPpqzMyPXFHRo36xWQTlszi1iP/D94CMg2gIq5c6kVRFRn3kADp/hpVwon7oUSCTQr9W2rycV2tWIexwQF4MLafpVmR ecnQc1N3nqqnGCUvasarhf8 V2O7sVGMlvlmFsTiLJb7LWNXnMu F/slmh4H5sv3jlLqLvMhhSflCcpX/.../TNXWjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPj 1E1v4ZtbB47xquTC8sGMxwdgEP0bia6n3fHm4ykYOaz/ZCeLkErc0yasbuabBVkXEvUC D1j/pnuhivTWsIyQxHFA4p8xg19QAC/kSmIk3YZrojnxGWmRSq4HlYe9Zn5SKqs5bBIMOb23Dy5tc43EIxEwi6PsEyE3c8b40 cnUSqouRnFm/V Q8vjJJ3pLGNXnMu7F/.../rBwfhoojvhAUmNGCH4T4G1oDZMXGjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjynERryYdTStuh152f0sCw22dBNJ0bterruNDC2xl5KZDzQT7zlCr50ybpq1seYBB6avCX7BlS04S tgKzbr9rT0mlIq4dw2gFQXzWtDzRnk8Eh/yzoUSCTQ7ZOkZ61JTxEYrs4PRkIIaS0XH51apiXek4wh LuECUvav6PsbFkRzz43RzMgvdyBIy8ccWwOjkJzcr F gklQ9BtMu90QmxK gphSflCcdX/.../rBQfh5cOw1QRmNHTOqmsS1dnbN2CjCA==

http://kmplayer.downloadable.co/get_file/wUia6yjQOMzI2muzUbjxCgggkkU3OTCnEB/ga5/ZtukkrjyqsGMrwdoNJgTtbrHuajv8mRYNIGjVEeijGLA wrtozc6WRAaQ/yXqWB 0 CfuwrCT8svT0mlDq4dr3hUeBT/ySCx 18kv9DmsBT/NFf5Ow4TrND0VabwxPRNMOaz9RCMmLNzFZREghrPlFTQuO4/w2/.../Mz4SXvquYPr50x8Nv8WB t7OmErruK5HBtmkEP4gs9PXg==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GR3xcteQv A8/yan9np5ktEPLkykYr/2LSXlnAFKOSCGGeqtCs5Ko UxjZPfaEqS4SfmDFj2uXyh3r2EvNKbm2BBs8xp10dJF3ylACx0k9EivSH8UHHMCPwFipLzPG4Nab0yJxEJMKvyVXE8cs3ENF172LPvUSwjcpfz1 U1Bm6ouRnFnvV W9Gve4GkaHtOmJjjSbZj3A8eroL h0q4N/5nnG sBsVP6cWzQn77uNKamCYyI/.../4jvhAUtNGCf5SpIjJCGcmCjCA==

http://kmplayer.13-72817-168087.53f870da3ef83.dablecdn.com/get_file/KGtE9FbQHsqTJEknRFmPJg/1408794346/13/17/1/.../KMPlayer_v3.8.0.117.exe

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL6as6I6KNqvCyr4Hp5iNENJ1WhMe/uNDC2xl5KM2WEG GgCr50ybpq1p/EUx6avCX6BlT2v2m0yP/XpMuOzj8f9NciiBZIV3y1Czt2hshq9C/wSDXAHOlOw4TrNTQNesJPT0Reevq1OTx8ZsbQJgUjjab6R25wao6x2 8/.../Lbh 1CalCd0et5OpSCDjspKb2SYmbaQWDcRkeyoxu7utHB5hhhG5095AFyeiDA75sdq9kx0ufXjBsngT39HSN2CjCA==

http://kmplayer.downloadable.co/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxL6as6I6KNqvCyr4Hp5iNEMJ1WjLKn3fHm9ykZZIGjPEeqtCuxul6trh8yfDR6Q D3zT0z0smn50qHDpZrSl2lZoJM4g11FRn3kADh/hpZhvnK4D3GSGbZdzMfmPjACYb80JFsFMKXlFiMrasWNLB4onqbmGiciao6x2 k/HD/j7g/dl7xmBpG3YrnTDy0NlpT/cq8ngRUL7Zb8jF/mO IghSflCclX/JHkHy288YOb2SYjbaRCQIcvMjwps i1XkM1nB3p3dxHGG/rBAfh/.../zNKiYaUc2CjCA==

Remove kmplayer_v3.8.0.117.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.