home

media player.exe

Verified Software SNB

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application media player.exe by Verified Software SNB has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from getm.0117d.info and multiple other hosts.
Publisher:
Verified Software SNB  (signed and verified)

MD5:
3267e2367e5e77c84266db5d7d4f9c3d

SHA-1:
2fd4b7ede089198c188423b89bc2505a8a3f1786

SHA-256:
58a3b34be500e12777da36c2e378edddc345fa96ea7c1007d08e9c1bea4bf419

Scanner detections:
12 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/17/2024 12:42:10 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.OutBrowse
7.1.1

Avira AntiVirus
PUA/Outbrowse.Gen
7.11.211.248

avast!
Malware-gen
150129-1

AVG
Downloader
2016.0.3191

Dr.Web
infected with Trojan.OutBrowse.96
9.0.1.05190

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
2/22/2015

K7 AntiVirus
Trojan
13.197.15043

Kaspersky
not-a-virus:Downloader.NSIS.OutBrowse
15.0.0.543

McAfee
Program.Adware-OutBrowse.e
16.8.708.2

Trend Micro House Call
Suspici.43C49BDD
7.2.53

VIPRE Antivirus
Threat.204214
36694

File size:
599 KB (613,336 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou (using Nullsoft Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\media player.exe

Digital Signature
Signed by:
Verified Software SNB

Authority:
thawte, Inc.

Valid from:
2/11/2015 6:00:00 PM

Valid to:
1/27/2016 5:59:59 PM

Subject:
CN=Verified Software SNB, O=Verified Software SNB, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
6CB1F281915C83420E5A5EF45A1BE6A0

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:/9mxCDchvU6pRxKz9noh4iN2PgWm+4b5eFcruZncjDCehF:/9UCDuvU6pHh1Mm+HFcunc3Ce7

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9452

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file media player.exe has been seen being distributed by the following 4 URLs.

http://getm.0117d.info/.../1424202586/get63?73560847864aTosMzEsLR9cNy4uLzIqJmQ5KywuLysjaTcxHmxrZ15xXHFpW21dOUZdXmVaKEtmYXFhax5gZWViaVttXTlGXV5lWihLZmFxYWsebnVub2c3aGxwaR0tXR4vYR8yXjMvKG0qbF5hX3NZYl5maXMnYGpnJSpiHitgbyoiLl5UUUweKjBvKyIuXnhxdmxnYHBtdmsgY2RlXGNjYDZ0S04zR1IpKENRQ0UyPDdBLClOLkwtQ0IgaVtrZzUv

http://get.seepage1000.info/DownloadManager/Get?p=19141&d=25270&l=24432&n=1&productname=Media Player&filename=Media Player&tyurl=http://.../?s1=TYP&s2=xyzsofttyp&clickid=wPT3OV00IUJH7B7I00V4P4FG

http://yz0fi.voluumtrk.com/0ae93eff-03a1-4762-86c4-8e61d27df22d?tyurl=http://760s.safesafenow.com/?s1=TYP&s2=xyzsofttyp&cid= 43fVX2RLR 28XOKDGff5i9pav6GyokJ33xnX7QRPwLic gXmOqjFvnv0jwOn6SyHcOZCNyM6go3BvI bjkvgtn8Fa1bHHiN5zaZLCsD9D 2eTqpybOpH 3GX6BJ 1YkNzUhZYiC0WITM5hNNhPkTWSsyboCodEc5kB2JuvBWFqMgfG2DiBY3L5Jr0p1dDyFHTBhiYP8eP/Rq6u1erLbfSFcMogK/yNX3tZDOzs3M3/JOSl7lom//ZXYgPlvOS2AIvSkJbSJ4CBQTZtdaTo/Dyy0N2bnYRUfOQGGhirhBUQixVEaoWjVQ aLl0MXnR7/.../oRbRqTs8CN1YBJUagHxHIJmWKhj5grYs1MCST3oc8bOLBSCB6oU4hvB23XrdDFTQf0e1leCC9PVFxFmfNldgoLAdszG4 3EkNWgD8k6eFw==

http://secure.pn-installer9.com/o/.../Setup.exe

Remove media player.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.