» player_setup.exe
Overview
Analysis
File Details
Downloads (1)

player_setup.exe

TUGUU SL

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application player_setup.exe by TUGUU SL has been detected as adware by 27 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.

File name:

player_setup.exe

Publisher:

TUGUU SL (signed and verified)

MD5:

5ce03333d4ea60c94b0074fe8c7ee5df

SHA-1:

65220374d42378d95fadc0cc44a3f6c1f5fee8d5

Scanner detections:

27 / 68

Status:

Adware

Explanation:

Uses the DomainIQ download manager to bundle additional potentially unwanted software without adequate consent.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 4:31:39 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.DomaIQ.3

1005

Agnitum Outpost

PUA.DomaIQ

7.1.1

AhnLab V3 Security

PUP/Win32.DomaIQ

14.05.05

Avira AntiVirus

APPL/DomaIQ.Gen

7.11.147.170

avast!

Win32:PUP-gen [PUP]

2014.9-140505

AVG

Skodna.Bundle_r.Y

2015.0.3483

Bitdefender

Gen:Variant.Application.Bundler.DomaIQ.3

1.0.20.625

Comodo Security

Application.Win32.DomaIQ.URT

18222

Dr.Web

Trojan.DownLoader9.21779

9.0.1.0125

ESET NOD32

Win32/DomaIQ.AZ (variant)

8.9760

F-Prot

W32/DomaIQ.D.gen

v6.4.7.1.166

F-Secure

Adware:W32/DomaIQ

11.2014-05-05_2

G Data

Gen:Variant.Application.Bundler.DomaIQ

14.5.24

IKARUS anti.virus

AdWare.DomaIQ

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.177.11984

Kaspersky

not-a-virus:AdWare.MSIL.DomaIQ

14.0.0.3912

Malwarebytes

PUP.Optional.BundleInstaller.A

v2014.05.05.03

McAfee

Adware-DomaIQ!87EAB94F6E66

5600.7139

MicroWorld eScan

Gen:Variant.Application.Bundler.DomaIQ.3

15.0.0.375

NANO AntiVirus

Trojan.Win32.DomaIQ.ctadmg

0.28.0.59608

Panda Antivirus

PUP/MultiToolbar.A

14.05.05.03

Quick Heal

AdWare.MSIL.r3 (Not a Virus)

5.14.14.00

Reason Heuristics

PUP.Installer.TUGUUSL.M

14.8.7.18

Sophos

DomainIQ pay-per install

4.98

Vba32 AntiVirus

BScope.Downware.DomaIQ

3.12.26.0

VIPRE Antivirus

Trojan.Win32.Generic

28896

Zillya! Antivirus

Adware.DomaIQ.Win32.132

2.0.0.1779

File size:

313 KB (320,496 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup

Common path:

C:\Documents and Settings\{user}\My documents\downloads\player_setup.exe

Digital Signature

Signed by:

TUGUU SL

Authority:

GoDaddy.com, Inc.

Valid from:

5/3/2013 1:24:02 PM

Valid to:

5/3/2014 1:24:02 PM

Subject:

CN=TUGUU SL, O=TUGUU SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2776B257979F9A

File PE Metadata

Compilation timestamp:

2/6/2014 7:50:03 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:/V24jwnTGLyoE2fsAu6i6xgB1A/QXoCPk96zmfYM:/V2mwnTyyoE2fsz6xgBu1Cm

Entry address:

0x1573

Entry point:

E8, BF, 26, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, D8, CF, 40, 00, 89, 0D, D4, CF, 40, 00, 89, 15, D0, CF, 40, 00, 89, 1D, CC, CF, 40, 00, 89, 35, C8, CF, 40, 00, 89, 3D, C4, CF, 40, 00, 66, 8C, 15, F0, CF, 40, 00, 66, 8C, 0D, E4, CF, 40, 00, 66, 8C, 1D, C0, CF, 40, 00, 66, 8C, 05, BC, CF, 40, 00, 66, 8C, 25, B8, CF, 40, 00, 66, 8C, 2D, B4, CF, 40, 00, 9C, 8F, 05, E8, CF, 40, 00, 8B, 45, 00, A3, DC, CF, 40, 00, 8B, 45, 04, A3, E0, CF, 40, 00, 8D, 45, 08, A3, EC, CF, 40... 
[+]

Entropy:

5.8892

Code size:

30.5 KB (31,232 bytes)

The file player_setup.exe has been seen being distributed by the following URL.

http://www.lpcloudbox327.com/.../Player_Setup.exe

Remove player_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.