home

mediaplayerclassicinstaller.exe

The application mediaplayerclassicinstaller.exe has been detected as a potentially unwanted program by 30 anti-malware scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from inst.qualitysw.net.
Version:
1.0.0.19

MD5:
9cb5d6c653a0732af611c623339fda9d

SHA-1:
e5f34211b3c91b770e075249bb8c7e3e12379732

SHA-256:
2afc04a74103c95f9b15b872abd50e0a34545bbfcd55d471527993c3546380bc

Scanner detections:
30 / 68

Status:
Potentially unwanted

Analysis date:
5/4/2025 8:52:39 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.12186129
6750265

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Generic
2015.03.09

avast!
Win32:Malware-gen
2014.9-150614

AVG
Generic
2016.0.3078

Baidu Antivirus
PUA.Win32.Verti
4.0.3.1538

Bitdefender
Trojan.Generic.12186129
1.0.20.335

Comodo Security
Application.Win32.Verti.JBT
21336

Dr.Web
Adware.Downware.9414
9.0.1.05190

Emsisoft Anti-Malware
Trojan.Generic.12186129
9.0.0.4799

ESET NOD32
Win32/Verti (variant)
9.10652

F-Prot
W32/S-9f54ae95
v6.4.7.1.166

F-Secure
Trojan.Generic.12186129
5.13.68

G Data
Win32.Application.Nextup
15.3.24

herdProtect (fuzzy)
variant of 7zipinstaller.exe (Adware)
2015.6.14.17

IKARUS anti.virus
PUA.Verti
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.200.15196

McAfee
Artemis!26C2D7DD3951
5600.6734

MicroWorld eScan
Trojan.Generic.12186129
16.0.0.201

NANO AntiVirus
Trojan.Win32.Verti.didber
0.30.0.296

Norman
Trojan.Generic.12186129
03.12.2014 13:20:04

nProtect
Trojan.Generic.12186129
15.03.06.01

Panda Antivirus
Trj/Genetic.gen
15.03.08.11

Reason Heuristics
Threat.Win.Reputation.IMP
15.3.8.10

Sophos
NextUp
4.98

Trend Micro House Call
Suspicious_GEN.F47V0906
7.2.165

Vba32 AntiVirus
AdWare.Verti
3.12.26.3

VIPRE Antivirus
Rocketfuel Installer
34410

Zillya! Antivirus
Adware.Verti.Win32.3
2.0.0.2090

File size:
351.6 KB (360,070 bytes)

Product version:
1.0.0.19

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\mediaplayerclassicinstaller.exe

File PE Metadata
Compilation timestamp:
10/30/2014 3:30:55 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:zJaW0HdNwQx/i0Bzng3PHIfTPPfzk1xo1A1+B/9AyrVoCvAdQ7wfU2boH:zJDOwQxc36PPfzuxoS1w/9JrLIxfU2bU

Entry address:
0x169440

Entry point:
60, BE, 00, A0, 51, 00, 8D, BE, 00, 70, EE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
320 KB (327,680 bytes)

The file mediaplayerclassicinstaller.exe has been seen being distributed by the following URL.

http://inst.qualitysw.net/dl/42/33236/6073/.../

Remove mediaplayerclassicinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.