» player_setup.exe
Overview
Analysis
File Details
Downloads (1)

player_setup.exe

Tuguu SL

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application player_setup.exe by Tuguu SL has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.

File name:

player_setup.exe

Publisher:

Tuguu SL (signed and verified)

MD5:

7cb51291cf93326d22379b16261c6be7

SHA-1:

25a2c9ea66ab592a0274b5256374cc493ecb95d0

SHA-256:

b388e7b8d6bdf8015651138d2bc865fec7754c771038657a78dae5efce7d60f8

Scanner detections:

23 / 68

Status:

Adware

Explanation:

May bundle additional potentially unwanted software such as adware during setup.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/20/2024 2:41:18 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.DomaIQ

7.1.1

AhnLab V3 Security

PUP/Win32.DomaIQ

14.04.25

Avira AntiVirus

APPL/DomaIQ.Gen

7.11.137.146

avast!

Win32:DomaIQ-BF [PUP]

2014.9-140425

AVG

Skodna.Bundle_r.Y

2015.0.3494

Comodo Security

Application.Win32.DomaIQ.URT

17948

Dr.Web

Trojan.DownLoader9.21779

9.0.1.0115

ESET NOD32

Win32/DomaIQ.AZ (variant)

8.9556

F-Prot

W32/DomaIQ.D.gen

v6.4.7.1.166

G Data

Win32.Application.DomalQ

14.4.24

herdProtect (fuzzy)

variant of setup.exe (Adware)

2014.4.25.1

IKARUS anti.virus

AdWare.DomaIQ

t3scan.2.2.29

K7 AntiVirus

Trojan

13.176.11482

Kaspersky

not-a-virus:AdWare.MSIL.DomaIQ

14.0.0.3965

Malwarebytes

PUP.Optional.BundleInstaller.A

v2014.04.25.01

McAfee

Adware-DomaIQ!87EAB94F6E66

5600.7150

NANO AntiVirus

Trojan.Win32.DomaIQ.ctadmg

0.28.0.58491

Panda Antivirus

PUP/MultiToolbar.A

14.04.25.01

Qihoo 360 Security

HEUR/Malware.QVM06.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.TuguuSL.M

14.8.7.18

Sophos

Generic PUA CK

4.98

Vba32 AntiVirus

BScope.Downware.DomaIQ

3.12.24.3

VIPRE Antivirus

DomaIQ

27502

File size:

310.7 KB (318,176 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup

Common path:

C:\users\{user}\downloads\player_setup.exe

Digital Signature

Signed by:

Tuguu SL

Authority:

COMODO CA Limited

Valid from:

3/20/2013 1:00:00 AM

Valid to:

3/21/2014 12:59:59 AM

Subject:

CN=Tuguu SL, O=Tuguu SL, STREET=Avd Barranco de las Torres N10 Oficina 4A, L=Adeje, S=S/C de Tenerife, PostalCode=38670, C=ES

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00F1F4478174C3E164CE93F4AB63CBA287

File PE Metadata

Compilation timestamp:

2/6/2014 1:50:03 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:xV24jwnTGLyoE2fsAu6i6xgB1A/QXoCPk96zmUYp:xV2mwnTyyoE2fsz6xgBu1C0

Entry address:

0x1573

Entry point:

E8, BF, 26, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, D8, CF, 40, 00, 89, 0D, D4, CF, 40, 00, 89, 15, D0, CF, 40, 00, 89, 1D, CC, CF, 40, 00, 89, 35, C8, CF, 40, 00, 89, 3D, C4, CF, 40, 00, 66, 8C, 15, F0, CF, 40, 00, 66, 8C, 0D, E4, CF, 40, 00, 66, 8C, 1D, C0, CF, 40, 00, 66, 8C, 05, BC, CF, 40, 00, 66, 8C, 25, B8, CF, 40, 00, 66, 8C, 2D, B4, CF, 40, 00, 9C, 8F, 05, E8, CF, 40, 00, 8B, 45, 00, A3, DC, CF, 40, 00, 8B, 45, 04, A3, E0, CF, 40, 00, 8D, 45, 08, A3, EC, CF, 40... 
[+]

Code size:

30.5 KB (31,232 bytes)

The file player_setup.exe has been seen being distributed by the following URL.

http://www.lpcloudbox300.com/.../Player_Setup.exe

Remove player_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.