» player_setup.exe
Overview
Analysis
File Details
Downloads (1)

player_setup.exe

Digital Plugin SL

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application player_setup.exe by Digital Plugin SL has been detected as adware by 27 anti-malware scanners. The program is a setup application that uses the Softpulse SoftwareBundler installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from www.lpmxp2014.com.

File name:

player_setup.exe

Publisher:

Digital Plugin SL (signed and verified)

MD5:

502ff4145280e654e144ff9b2cefd842

SHA-1:

bb32b2857c5db22403683722a1341ad66c3bdb21

SHA-256:

1e610ac0c2d6860e5cbd32e97d1cd5d42bdfab5c4bf6173514c2e05d90594df3

Scanner detections:

27 / 68

Status:

Adware

Explanation:

May bundle additional potentially unwanted software such as adware during setup.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

4/25/2024 5:52:32 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.Agent.C

905

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.BundleInstaller

2014.08.15

Avira AntiVirus

APPL/Downloader.Gen8

7.11.167.76

avast!

Win32:SoftPulse-C [PUP]

2014.9-140814

AVG

Generic

2015.0.3383

Bitdefender

Application.Bundler.Agent.C

1.0.20.1130

Clam AntiVirus

Win.Trojan.Agent-748009

0.98/19279

Dr.Web

Trojan.Packed.27985

9.0.1.05190

Emsisoft Anti-Malware

Application.Bundler.Agent

9.0.0.4157

ESET NOD32

Win32/SoftPulse.E potentially unwanted application

8.7.0.302.0

F-Prot

W32/A-b3d654c0

v6.4.7.1.166

F-Secure

Application.Bundler.Agent

11.2014-14-08_5

G Data

Application.Bundler.Agent

14.8.24

herdProtect (fuzzy)

variant of setup(2).exe (Adware)

2014.10.29.2

IKARUS anti.virus

PUA.DigiPlug

t3scan.1.6.1.0

K7 AntiVirus

Unwanted-Program

13.180.12498

Kaspersky

not-a-virus:Downloader.Win32.Agent

14.0.0.3408

Malwarebytes

PUP.Optional.Downloader

v2014.08.14.10

McAfee

CryptDomaIQ

5600.7039

MicroWorld eScan

Application.Bundler.Agent.C

15.0.0.678

NANO AntiVirus

Trojan.Win32.Inject.dbmyct

0.28.2.61519

Panda Antivirus

Trj/Genetic.gen

14.08.14.10

Reason Heuristics

PUP.Installer.DigitalPluginSL.M

14.8.14.7

Sophos

SoftPulse

4.98

Vba32 AntiVirus

Downloader.Agent

3.12.26.3

VIPRE Antivirus

Threat.4150696

29708

File size:

1.3 MB (1,391,976 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Softpulse SoftwareBundler

Common path:

C:\users\{user}\downloads\player_setup.exe

Digital Signature

Signed by:

Digital Plugin SL

Authority:

VeriSign, Inc.

Valid from:

5/26/2014 1:00:00 AM

Valid to:

5/27/2015 12:59:59 AM

Subject:

CN=Digital Plugin SL, O=Digital Plugin SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

6B59702469CAA1B8F0FE3A86D94D6266

File PE Metadata

Compilation timestamp:

6/20/2014 5:52:32 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

24576:kt2/JJJJJJJJJJJJJ7JJJJJOnOnOnOn3xwwncncnJEGBAFPJ8SJmU/2FYYak+F0J:2YFFYYQ0gPY43/fTE

Entry address:

0x22DC

Entry point:

E8, AE, 40, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 56, 57, 33, F6, BF, 08, 8F, 42, 00, 83, 3C, F5, 3C, 80, 42, 00, 01, 75, 1E, 8D, 04, F5, 38, 80, 42, 00, 89, 38, 68, A0, 0F, 00, 00, FF, 30, 83, C7, 18, E8, 21, 41, 00, 00, 59, 59, 85, C0, 74, 0C, 46, 83, FE, 24, 7C, D2, 33, C0, 40, 5F, 5E, C3, 83, 24, F5, 38, 80, 42, 00, 00, 33, C0, EB, F1, 8B, FF, 53, 8B, 1D, 9C, A0, 41, 00, 56, BE, 38, 80, 42, 00, 57, 8B, 3E, 85, FF, 74, 13, 83, 7E, 04, 01, 74, 0D, 57, FF, D3, 57, E8, 3E, 41, 00, 00, 83, 26, 00, 59, 83, C6... 
[+]

Entropy:

7.4724

Code size:

97 KB (99,328 bytes)

The file player_setup.exe has been seen being distributed by the following URL.

http://www.lpmxp2014.com/.../Player_Setup.exe

Remove player_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.