» media_player_classic.exe
Overview
Analysis
File Details
Downloads (1)

media_player_classic.exe

Symbolicom Holdings Limited

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application media_player_classic.exe by Symbolicom Holdings Limited has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from safe.download.downloadastro.com.

File name:

Publisher:

Symbolicom Holdings Limited (signed and verified)

MD5:

e8eb7d894add5b68c4a92ea88182ddc3

SHA-1:

d7d62c327c19af29a0abafa055f42b808af3699b

SHA-256:

8b96a29290f115dd4a2350482c6233aac128f09505ad7b010d8ee4065b3fab39

Scanner detections:

7 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/16/2024 2:35:48 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.181.56

AVG

Generic

2015.0.3310

Dr.Web

Trojan.InstallCore.10

9.0.1.05190

ESET NOD32

Win32/InstallCore.QD potentially unwanted application

7.0.302.0

Reason Heuristics

PUP.SymbolicomHoldingsLimited.U

14.10.25.17

Vba32 AntiVirus

Malware-Cryptor.InstallCore.gen

3.12.26.3

VIPRE Antivirus

Threat.4150696

34232

File size:

767 KB (785,456 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\media_player_classic.exe

Digital Signature

Signed by:

Symbolicom Holdings Limited

Authority:

GlobalSign nv-sa

Valid from:

6/10/2014 1:06:04 PM

Valid to:

6/11/2015 1:06:04 PM

Subject:

CN=Symbolicom Holdings Limited, O=Symbolicom Holdings Limited, L=Tortola, C=VG

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121202947393588614ECB9CFD4B1531494C

File PE Metadata

Compilation timestamp:

6/20/1992 1:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:jelFaTLffRZJQJSQ9u6W6KTynnXRzK09+nnBRvoGwK1H8DPAc3IPCHSwY0dXfA9/:jelF6fng9bWNTynXMoUB9XwK1cDPVtyr

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file media_player_classic.exe has been seen being distributed by the following URL.

http://safe.download.downloadastro.com/?ic_user_id=646

Remove media_player_classic.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.