home

mplayer_d7384024.exe

InstallIQ Installation Utility

InstallX, LLC

The InstallIQ (InstallX) installation program is a co-bundle stub that devlivers software monetization offers during installation. These offers include web browser toolbars and extensions. The application mplayer_d7384024.exe by InstallX has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the InstallIQ Installation Manager installer. The file has been seen being downloaded from s.m2pub.com and multiple other hosts.
Publisher:
InstallX, LLC  (signed and verified)

Product:
InstallIQ Installation Utility

Version:
2.136.3.0

MD5:
8487a097abe1dbf6ac9c4cda71addddc

SHA-1:
d4e80184d2aec7452d2ac559334c4cf9f74303e1

SHA-256:
3644592366e48ae98962758463a3781560cadb041059dcd264e40130226390ec

Scanner detections:
12 / 68

Status:
Adware

Explanation:
InstallIQ is a bundled offer download and install manager that is designed to show sponsored offers during installation that typically includes adware type toolbars, browser extensions and plugin or other potentially unwanted software along with the promised application.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 6:36:10 PM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/InstallIQ.Gen5
7.11.113.136

Comodo Security
Application.Win32.InstallIQ.B
17273

Dr.Web
Adware.W3i.32
9.0.1.0359

ESET NOD32
Win32/InstallIQ (variant)
7.9050

herdProtect (fuzzy)
variant of 7zip_bimo.exe (Adware)
2014.1.2.12

K7 AntiVirus
Unwanted-Program
13.174.10263

Malwarebytes
PUP.Optional.InstallIQ
v2013.12.25.11

McAfee
Artemis!553CD710BF51
5600.7262

Reason Heuristics
PUP.Installer.InstallX.Q
14.9.30.13

Sophos
InstallQ
4.94

Trend Micro House Call
TROJ_GEN.F47V1111
7.2.359

VIPRE Antivirus
InstallIQ Installer
23380

File size:
1.8 MB (1,917,008 bytes)

Product version:
2.136.3.0

Copyright:
Copyright ©2013 InstallX, LLC. All rights reserved.

Original file name:
InstallIQ.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallIQ Installation Manager

Language:
English (United States)

Common path:
C:\users\{user}\downloads\mplayer_d7384024.exe

Digital Signature
Signed by:
InstallX, LLC

Authority:
DigiCert Inc

Valid from:
3/21/2013 7:00:00 PM

Valid to:
3/26/2014 7:00:00 AM

Subject:
CN="InstallX, LLC", O="InstallX, LLC", L=Sartell, S=Minnesota, C=US

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
030985B5A39F75A13A497DAB8BF611F7

File PE Metadata
Compilation timestamp:
11/6/2013 10:48:07 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
24576:iHo31C4PUaZ3/wtYsCOu56Z8vrvBFzvs+1w9i8Th1JarZpYgmnStoGrTjeGCu6r/:iHsxiS7w9i8ErMgicoGrTqu6r2KH

Entry address:
0xEEE9

Entry point:
E8, B5, 88, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, F0, 86, 57, 00, E8, F1, 47, 00, 00, E8, B9, 6A, 00, 00, 0F, B7, F0, 6A, 02, E8, 48, 88, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, D5, 64, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Entropy:
6.6913

Code size:
1.2 MB (1,262,592 bytes)

The file mplayer_d7384024.exe has been seen being distributed by the following 39 URLs.

http://s.m2pub.com/event/click/0/OjtPeeXPEkFa5Zrq2r-HvP3gjc6lfhbPRo8JncyX9u2KvckAQ2bBeskQQaphMLD54FLm_v9EBWQieiWOelwPK3BPuXwBHkolYlEb3OqFZFHdrM70mfH_kQnZokOIpQw8gpsTAowqrMlWE8DXbg-DEFGzNWw50XoMZ4oBajuuJ-AAWzStBHjAEYoz4O-7WfV-d6IbeczziIwBXfouxJ9-D_Q9uUCPoGLCGUjGaZil9VoybQoMhpLKmuplg403rkH_roxDKX7NnDuvHm6f8mv1ePfzgTnmMtXkPVkHc3eZkTn4nf0s9sbc3eOZaWQpgsG_XtSZAN3hITvqEwzuRiaJ-3T1y3wCBXUSyZSctAdQuqBfwRWzPwqluCs-4hE__J6lpUvfYEWN2VTUEmI/.../

http://s.m2pub.com/event/click/0/d_nDKp62HD00K0JiLFPvWr6xhR0QADWjjx14SaVp2YaedVuz6D9AvaLdw4B9HbLtPzUldZdA7Rd_zzNHh0kVqbHaL7B-wcrLXcMEFO7g3f11lgaTN8g1NkFAGbRWkHVWTc4bYceUvt9g2snUqttVTswUIo-mvvuPhhxyxrjHwy1SSiJ2XvcWqE9T0mrOYbW9AOE4mVelEmgOnpGtFOqtSlC4K35NZwWC435Xul_hquAlTUsmHB7NS5pntkffWdxjtEkaOoIZhzD3brtb0uyFweLh5a-YkKC_UYansA-r7Cdt088q2GLIQ4vdeuGvRm20pYpIizrprDBVUPsXQ9nXgCqeK6NYkApgod9OQt4bxmIWGzyuED_N2-LnfYTARa-EYNOwydo/.../

http://ads.adk2.com/event/click/0/jRA6lBNwxbRNOSUl7oSwj_JcJ4ts_U4FMrAjnRw1UP3HtFBeYT03-tEjOhwuQcZlkjcyJsdubvJF0E_UOanWoDsPt8yYs20IbpTU0dQft1DGY-Bnd2-lais9RT8vmIF6oOGYf_sAU-NOLMyn1c3N5RcPzzfu5vKQ7LaZAVApC9BfTQ8MInLYG2RySpT8Mxmo-LOx3tK-zgqtMUIMcQLcrWdCUKC6GOZdsq0_nyDhYXXpGwKIbfxn7s2xnNsMASrJ9jf5htvdwa8xUoMEYXYp_t-24pf5zo2m_lDPSEMuPfBcYFdWwQXu_2XJS0Mij-OZK07ifnXZMCh4e_8OT8IGsOQagkQQt4Sxqjyi61s58Yp-yIP-tO_OLucz_raXo409N2Ap09Wx8ox7Qt5OuIM3hSpXbEu8lo4FcQ/.../

http://ads.adk2.com/event/click/0/Q0kThVKjKZw--E1xBWPZFoYqJtEGK_5mysKcZ6DXgHHQ8spq51TNUzJtb-10l1fFBYLG3Llww9v10TCIz3AJEbwG7plxzbx9aQfYZELsxELBM1mzDyhOIWNGK14gcYZV-Q8hKf9rNkzE2eBGrmB18OOAsJyszxHuS1UXqqQgvN_RQsSAvp3Yu5tJKQcqIpVpNwz5W6iTVZdoWPrsh4ULvSQlkmeFjIRmcwLcmoIuz45uv1tr2Mv3a3_uA_kRZw1Nd8c-aJWB5mZudg4PRD4DOBOaFuIApwCvZf8KHOJ2vFMcjVuziRxP8Frd8d-riKjckakE8t9k8boUBPKUZb5divRdenDDOdo5YFtT-ilfUkJcztu0UuuIRHrrtWbSZUN6yWKzRJV5FWxbWCy0ex2254tqinsH9cE/.../

http://s.m2pub.com/event/click/0/_M4lBVMdHPSvgDPYpXVte58emfW-AKModIFguZQTmEvPkGDanHBaceMA_dvkK0OG1T5TMaDc3rkikwD4ifUVNgY-YjiFlb66eSAH25UMkxiexenuoNKK3qVfIf5n3vRdu_5a0BaLJlnYMB49TTqueGHNQt2FGs3jJDmX5g9PfzldqH6uVzxiRLHZ9uEsyeF5BQPbtv-vDTUtAp_Bn7ve9v7Gq251vrIQI9eDk1vEsDZXv4NQXSxmcWx9bbgtlf1ceZVfO3XUv3oWA8dmZbN7DD8XipuJY2xYsaJeXrVLFB4AMwIW-VySMrRpQymoLlRV3C8iOKCtRJ_wz5PUfDEgXR8TwDo34R8ViI911c2Q34AEBq9c1hWMbbddFzg/.../

http://s.m2pub.com/event/click/0/oDwdTC-WySsltZfsnzxIo2qSyaNf2_6jHoTrn8IniyVP8za39HzPrWPvAb1-u8dZKIzBKg6-XYw3fNfXzHGd1tsuxqnWL_r34wxoVSnBp5WTg5pv_6eb1wGHR8LXSCm5QkZUu393DNYvO_BiZHgB9Em6HuUO8znUYKIyftqufQGlLRFhHyXX69Y6XEM46O8IG1pp8weqHDG1TuA01lWzmx1Vo43-h7Fq028YvO09Y_SpMuvUouf-wphkV1iYjtIq0Gln1lyOlTOyGqq3gyBv09aEMIQzGXZok91d4FY1TOetW1LI3lXWmA12IZnmGyyVZBkXJpZ9EX050zSeHtgdbLrkXAARw-Y7qxX6zOfem_NHOOhNBOuaY-IKD1LXsyoyGneRZvHiAO5y4NY/.../

http://s.m2pub.com/event/click/0/PUf8Elfh_j3ZTuRZS5mUFyDLNIcsFL95W_cJkvjG3jAT3MOm9zi_WPkYUlc4iWi--N2FA2Ct1bPC0VG23iOMNDGnzLDmQ1uWK64S-YNQYbgh3Z35ugAqtrjQP8gcjVEufeFY39WqoQFZoyMuFo9P422F2br75l2hwlAI7QsZ2RNCxfM_fOzGUG-rFiXHMH-jWsa_nhIhsN_4IPMigcIAWg6evAx-HbRt4t_mRB8Xk82olIkralSsAR_Jv5CrkyPkKxxOv0gjBxMkUK9wuQy5-_9ZLEV1UUYbmuWmOkb1isxxzD1jPy4ULL4E4gmVf5278Kq5QmvMm5rBBn4l-PgDt0fhYPGRnwpHNZV-T0uo4epcA5-vn1L6BYCkn6FyUkyhefIrPTmv/.../

http://dl2.iq9download.com/dynamic/.../mplayer_d7426865.exe

http://dl.installiq.com/.../getdynamicpath.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q273dziI7Cy4N1g6IfF1vGrJx000.&VersionId=-1&key=standarddefault

http://dl.installiq.com/.../downloadpop.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q273dziI7Cy4N1g6IfF1vGrJx000.

http://www.media970.com/.../jWRummHKf5aNaWzEXsp6w4xicpZknqmVkWNqxF-egZSLkGudX6F9?dp=-Yp464aT8gg2CBfmisc3yN6q2C8_svJ0CDaYhCuPzHgdPq5EpWNRruZxXWPtsVYn7E3A5nAkcxA1PkMS_lJZDN4PagDQ9dg_6Vs3Yf2jO5MStzdh3No0EBw68-W2aTmCcMov1HwgSmpWlIeCcOokGjvZxuh4jtPoYELrCOFk03UXZO14c-awzxYffRr-z9zLsZcKBKxlohrubwqaqwma92ISapd_WHvnNTvCdXDxZa-dDSbSKPwVeNBa6LHJehn00uKh4yhVtGKWS2ndiYLmXA1GThppv-ZxE72Fhj8UT7vt1wEaSo1Ujzwbkr5ZZ9o22wtUzxZSQjvhi4N_L0t16aqUivBId2M1hGrLrRxIvGBX0RfbPw0V7s7BG0c

http://s.m2pub.com/event/click/0/-Yp464aT8gg2CBfmisc3yN6q2C8_svJ0CDaYhCuPzHgdPq5EpWNRruZxXWPtsVYn7E3A5nAkcxA1PkMS_lJZDN4PagDQ9dg_6Vs3Yf2jO5MStzdh3No0EBw68-W2aTmCcMov1HwgSmpWlIeCcOokGjvZxuh4jtPoYELrCOFk03UXZO14c-awzxYffRr-z9zLsZcKBKxlohrubwqaqwma92ISapd_WHvnNTvCdXDxZa-dDSbSKPwVeNBa6LHJehn00uKh4yhVtGKWS2ndiYLmXA1GThppv-ZxE72Fhj8UT7vt1wEaSo1Ujzwbkr5ZZ9o22wtUzxZSQjvhi4N_L0t16aqUivBId2M1hGrLrRxIvGBX0RfbPw0V7s7BG0c/.../

http://dl5.iq9download.com/dynamic/.../mplayer_d7437967.exe

http://dl.installiq.com/.../getdynamicpath.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q270BfdDW3rvC1OcUXj1vGsGJ000.&VersionId=-1&key=standarddefault

http://dl.installiq.com/.../downloadpop.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q270BfdDW3rvC1OcUXj1vGsGJ000.

http://www.media970.com/.../jWRummHKf5aNaWzEXsp6w4xicpZknqmVkWNqxF-egZSLkGudX6F9?dp=KdK2TWYHTHS5D6iV7pVimGLO3tR5I2p_iYxSGNgoaORkEVm0my1tYEhgIZxQCC34ijmWYPUbwA4Yb5hx97d3uC5bB8ENNZw0Sp2CX9oUndsd4JBD-_2x0pb3VagomfaVs1V0LCl_jHCQLiTuUrpzYCc-O_4FiVZ1Qo7lZdqTET1s8BxMKohrjNhEl1eE3W4QGF9DE4aAddLnoAfv7b0yx3wtm0OVDyqV7l8D1yGnjs9oEgjNIu2rX3RLVz6EJBbxhnIqtq26mfYiGwKEi66EXfC-CvEnMawkFjl7VA47Ij15dgnvOgIOhzPfb3VxOOjGOfZ_tVVlTKVaWojEbRHSgcZWEZGW4pfbAjXwoSuuvkb49i335B8FE2CfaA

http://s.m2pub.com/event/click/0/KdK2TWYHTHS5D6iV7pVimGLO3tR5I2p_iYxSGNgoaORkEVm0my1tYEhgIZxQCC34ijmWYPUbwA4Yb5hx97d3uC5bB8ENNZw0Sp2CX9oUndsd4JBD-_2x0pb3VagomfaVs1V0LCl_jHCQLiTuUrpzYCc-O_4FiVZ1Qo7lZdqTET1s8BxMKohrjNhEl1eE3W4QGF9DE4aAddLnoAfv7b0yx3wtm0OVDyqV7l8D1yGnjs9oEgjNIu2rX3RLVz6EJBbxhnIqtq26mfYiGwKEi66EXfC-CvEnMawkFjl7VA47Ij15dgnvOgIOhzPfb3VxOOjGOfZ_tVVlTKVaWojEbRHSgcZWEZGW4pfbAjXwoSuuvkb49i335B8FE2CfaA/.../

http://dl5.iq9download.com/dynamic/.../mplayer_d7433484.exe

http://dl.installiq.com/.../getdynamicpath.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q274QBKGtK5pY2wvKNq1vGsiv000.&VersionId=-1&key=standarddefault

http://dl.installiq.com/.../downloadpop.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q274QBKGtK5pY2wvKNq1vGsiv000.

http://www.media970.com/.../jWRummHKf5aNaWzEXsp6w4xicpZknqmVkWNqxF-egZSLkGudX6F9?dp=KNj5oRvrS8c7XhDYAuLrTQGYqICwrSozHcYnvLadcoI6AVudlj3qcUnhUNjnfFZ35T0opbDwecvaPAXPZB3jSBsB3k2fkXEJPcX2pYAplMOYfFYNjHo6Bed9AW6_nhknCrlRtsxSzmG7Y7m7lXJVCkenIX2zSXefDYcnzagYAM5JCKu4pdyBDIiZybTwutSTtSEerV-4DtKkmyMKYwtlh8ydW8I-0hwNgSF8dVAu5krbCnydyZHAvveBlCmtDl2TwPgMe-3uoi58ldrX13iigjulQ1nyu-eug6PlrSHHMpaIb1zZy635qLsR1JoE1jk4maEv_7fPfDHZAkJV134_fGmCPD03Gx4Lt_pbjvIqrIDhcnZk-NFZktHURaJOq7Ri20ll1dUxa-rmupg

http://s.m2pub.com/event/click/0/KNj5oRvrS8c7XhDYAuLrTQGYqICwrSozHcYnvLadcoI6AVudlj3qcUnhUNjnfFZ35T0opbDwecvaPAXPZB3jSBsB3k2fkXEJPcX2pYAplMOYfFYNjHo6Bed9AW6_nhknCrlRtsxSzmG7Y7m7lXJVCkenIX2zSXefDYcnzagYAM5JCKu4pdyBDIiZybTwutSTtSEerV-4DtKkmyMKYwtlh8ydW8I-0hwNgSF8dVAu5krbCnydyZHAvveBlCmtDl2TwPgMe-3uoi58ldrX13iigjulQ1nyu-eug6PlrSHHMpaIb1zZy635qLsR1JoE1jk4maEv_7fPfDHZAkJV134_fGmCPD03Gx4Lt_pbjvIqrIDhcnZk-NFZktHURaJOq7Ri20ll1dUxa-rmupg/.../

http://dl5.iq9download.com/dynamic/.../mplayer_d7501296.exe

http://dl.installiq.com/.../getdynamicpath.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q2713xJRYD3BV3XjrCd1vGEwf000.&VersionId=-1&key=standarddefault

http://dl.installiq.com/.../downloadpop.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q2713xJRYD3BV3XjrCd1vGEwf000.

http://dl5.iq9download.com/dynamic/.../mplayer_d7501280.exe

http://dl.installiq.com/.../getdynamicpath.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q2713xJRYD3BV3XjrCd1vGEw6000.&VersionId=-1&key=standarddefault

http://dl.installiq.com/.../downloadpop.aspx?shortname=mplayer&a=13935&f=adperio_mplayer&partnercode=201q2713xJRYD3BV3XjrCd1vGEw6000.

http://www.media970.com/.../jWRummHKf5aNaWzEXsp6w4xicpZknqmVkWNqxF-egZSLkGudX6F9?dp=x7iwvub143Djc8t0OlzBNKl5ZOHhtXIQ0Oiwj4e-oOD5F24sVvSpOs5hGaQ_zAILUhvSSI2x89sbLNHgDQ5GHP1gQlvY7xRhjN1OdcWTWEPZkiFHBXyVW0ZZdAbjiW0kDFsp32pBe8KlC25DrIipYruWgreNfgQkeUunJ1ZDRBhNYt95-8BZ8sbTCZKUqrssUNrJPrFQRyN3BteQ_G_L7WIvh6iLm1-SrBZSnbfftCkN57yRf1p1BKrDzEa2A1MBWON0eraZJ-Jnmso8nbbFr5vKcFORU-Tso4khF4Ss9NsP6JUYlHv1tTxiT78jOxAuHPL55nOMzaeMyE92OWpubWFaAOUToJ3wOfiweBrUxnOTjGZe3hlqmQWOo5QRpDKunCnYsE8ZEu4c4wg

http://ads.adk2.com/event/click/0/x7iwvub143Djc8t0OlzBNKl5ZOHhtXIQ0Oiwj4e-oOD5F24sVvSpOs5hGaQ_zAILUhvSSI2x89sbLNHgDQ5GHP1gQlvY7xRhjN1OdcWTWEPZkiFHBXyVW0ZZdAbjiW0kDFsp32pBe8KlC25DrIipYruWgreNfgQkeUunJ1ZDRBhNYt95-8BZ8sbTCZKUqrssUNrJPrFQRyN3BteQ_G_L7WIvh6iLm1-SrBZSnbfftCkN57yRf1p1BKrDzEa2A1MBWON0eraZJ-Jnmso8nbbFr5vKcFORU-Tso4khF4Ss9NsP6JUYlHv1tTxiT78jOxAuHPL55nOMzaeMyE92OWpubWFaAOUToJ3wOfiweBrUxnOTjGZe3hlqmQWOo5QRpDKunCnYsE8ZEu4c4wg/.../

Latest 30 of 39 download URLs

Remove mplayer_d7384024.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.