player.exe

Payments Interactive SL

This is the Tuguu DomaIQ download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application player.exe by Payments Interactive SL has been detected as adware by 31 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from www.lpcloudbox0122.com.
Publisher:
Payments Interactive SL  (signed and verified)

MD5:
84d900f05c88686a39f0dc64c2726d6e

SHA-1:
6a952071de78af00a66cbd9ce4a87fd311a35a64

SHA-256:
e28e4c67eb0c7538642612aa8e8126018d1709e689c7c81b5d78c312c7d72bc9

Scanner detections:
31 / 68

Status:
Adware

Explanation:
Uses the DomainIQ download manager to bundle additional potentially unwanted software without adequate consent.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/11/2017 12:53:06 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.DomaIQ.AN
1007

Agnitum Outpost
PUA.Lollipop
7.1.1

AhnLab V3 Security
PUP/Win32.DomaIQ
14.05.03

Avira AntiVirus
APPL/DomaIQ.Gen
7.11.147.26

Antiy Labs AVL
GrayWare[AdWare:not-a-virus]/Win32.Lollipop
0.1.0.1

AVG
DomaIQ_r.J
2015.0.3485

Bitdefender
Adware.DomaIQ.AN
1.0.20.615

Comodo Security
Application.Win32.DomaIQ.PUR
18212

Dr.Web
Adware.Downware.2759
9.0.1.0123

Emsisoft Anti-Malware
Adware.DomaIQ.AN
8.14.05.03.06

ESET NOD32
Win32/DomaIQ.BB (variant)
8.9754

F-Secure
Adware.DomaIQ.AN
11.2014-03-05_7

G Data
Adware.DomaIQ.AN
14.5.24

IKARUS anti.virus
AdWare.DomaIQ
t3scan.1.6.1.0

Jiangmin
AdWare/MSIL.alc
KV140503

K7 AntiVirus
Unwanted-Program
13.177.11965

K7 Gateway Antivirus
Unwanted-Program
13.177.11965

Kaspersky
not-a-virus:AdWare.Win32.Lollipop
14.0.0.3921

Kingsoft AntiVirus
Win32.Troj.Lollipop.ag.(kcloud)
331020.49267

Malwarebytes
PUP.Optional.BundleInstaller.A
v2014.05.03.06

McAfee
RDN/Generic PUP.x!c2r
5600.7141

McAfee Web Gateway
Heuristic.BehavesLike.Win32.Suspicious.H
7.7141

MicroWorld eScan
Adware.DomaIQ.AN
15.0.0.369

NANO AntiVirus
Riskware.Win32.Lollipop.cxalla
0.28.0.59608

nProtect
Adware.DomaIQ.AN
14.05.02.01

Panda Antivirus
PUP/MultiToolbar.A
14.05.03.06

Reason Heuristics
PUP.PaymentsInteractiveSL.G
14.8.7.23

Sophos
DomainIQ pay-per install
4.98

Vba32 AntiVirus
AdWare.Lollipop
3.12.26.0

VIPRE Antivirus
DomaIQ
28830

Zillya! Antivirus
Adware.DomaIQ.Win32.229
2.0.0.1776

File size:
439.7 KB (450,240 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Common path:
C:\users\{user}\downloads\player.exe

Digital Signature
Authority:
COMODO CA Limited

Valid from:
11/28/2013 1:00:00 AM

Valid to:
11/29/2014 12:59:59 AM

Subject:
CN=Payments Interactive SL, O=Payments Interactive SL, STREET=Camino las fayeras 1, L=Puntagorda, S=Santa cruz de Tenerife, PostalCode=38789, C=ES

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D9CDF60C136552E24EDA78215D3EE028

File PE Metadata
Compilation timestamp:
4/16/2014 11:37:10 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:O1miLuncbmmkHCUwDgt/ZSwLM2f3a6xAEg8ovT9ploCe1O6pRbYxvfTlYyF:8miGmkHC3s3SwLMAvxAQwjJe7SrDF

Entry address:
0x271A

Entry point:
E8, 27, 2E, 00, 00, E9, 79, FE, FF, FF, 6A, 0C, 68, 20, FA, 41, 00, E8, 0C, 01, 00, 00, 8B, 75, 08, 85, F6, 74, 75, 83, 3D, D8, 57, 42, 00, 03, 75, 43, 6A, 04, E8, 29, 30, 00, 00, 59, 83, 65, FC, 00, 56, E8, 4C, 31, 00, 00, 59, 89, 45, E4, 85, C0, 74, 09, 56, 50, E8, 6D, 31, 00, 00, 59, 59, C7, 45, FC, FE, FF, FF, FF, E8, 0B, 00, 00, 00, 83, 7D, E4, 00, 75, 37, FF, 75, 08, EB, 0A, 6A, 04, E8, FD, 2E, 00, 00, 59, C3, 56, 6A, 00, FF, 35, 4C, 52, 42, 00, FF, 15, 64, C0, 41, 00, 85, C0, 75, 16, E8, E3, 0A, 00...
 
[+]

Code size:
108 KB (110,592 bytes)

The file player.exe has been seen being distributed by the following URL.

Remove player.exe - Powered by Reason Core Security