mediaplayerclassic_rocketfuelinstaller.exe

Verti Technology Group, Inc.

This is the Verti bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application mediaplayerclassic_rocketfuelinstaller.exe by Verti Technology Group has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the Verti Setup installer. The file has been seen being downloaded from inst.great-free-apps.net and multiple other hosts.
Publisher:
Verti Technology Group, Inc.  (signed and verified)

Version:
1.0.147.0

MD5:
a937e57c4258d42dbeeec8d0035535fe

SHA-1:
a1fa43d9d3c98c592b1e69a786466c47e8d77b46

SHA-256:
60ddaf4371bee3b82fb04810a939b7df86173fc72d9656d2a0befe95cdf1e87c

Scanner detections:
5 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 2:55:48 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Adware-BGF [PUP]
2014.9-140111

ESET NOD32
Win32/Verti (variant)
8.9276

herdProtect (fuzzy)
2014.1.26.16

Reason Heuristics
PUP.VertiTechnologyGroup.g
14.2.21.12

VIPRE Antivirus
Rocketfuel Installer
25298

File size:
465.5 KB (476,688 bytes)

Product version:
1.0.147.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Verti Setup

Language:
English (United States)

Common path:
C:\users\{user}\downloads\mediaplayerclassic_rocketfuelinstaller.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
11/14/2013 2:00:00 AM

Valid to:
12/15/2015 1:59:59 AM

Subject:
CN="Verti Technology Group, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Verti Technology Group, Inc.", L=Bellevue, S=Washington, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2F53536EA4011E81FBFFD28C4B0BEB6F

File PE Metadata
Compilation timestamp:
1/10/2014 6:56:53 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:m8jvAlj/SGW2QGZLD4UxqeYqjA5p6mP71PzBoL/xsTkKFYwG36nuZq5F/IES:1vs7W2QyLDbxYqjA5p6mP71PzBoL/xsW

Entry address:
0x2832F

Entry point:
E8, AD, A8, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 38, C1, 45, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 3C, C1, 45, 00, 5D, C3, 05, 44, FF, FF, FF, 6A, 0E, 59, 3B, C8, 1B, C0, 23, C1, 83, C0, 08, 5D, C3, E8, E7, 10, 00, 00, 85, C0, 75, 06, B8, A0, C2, 45, 00, C3, 83, C0, 08, C3, E8, D4, 10, 00, 00, 85, C0, 75, 06, B8, A4, C2, 45, 00, C3, 83, C0, 0C, C3, 8B, FF, 55, 8B, EC, 56, E8, E2, FF, FF, FF, 8B, 4D, 08...
 
[+]

Code size:
254 KB (260,096 bytes)

The file mediaplayerclassic_rocketfuelinstaller.exe has been seen being distributed by the following 50 URLs.

http://inst.great-free-apps.net/dl/42/21113/2449/.../

http://inst.great-free-apps.net/dl/42/14404/42/.../?s1=16160

http://inst.vertitechnologygroup.com/dl/42/12864/42/.../?s1=10991

http://inst.vertitechnologygroup.com/dl/42/21113/2449/.../

http://inst.great-free-apps.net/dl/42/21113/2449/.../

http://inst.vertitechnologygroup.com/dl/42/14413/398/.../

http://inst.great-free-apps.net/dl/42/20078/42/.../?s1=9055

http://inst.vertitechnologygroup.com/dl/42/14404/1183/.../

http://inst.great-free-apps.net/dl/42/21113/2449/.../

Latest 30 of 110 download URLs

Remove mediaplayerclassic_rocketfuelinstaller.exe - Powered by Reason Core Security