» realplayer_dsetup.exe
Overview
Analysis
File Details
Downloads (1)

realplayer_dsetup.exe

META., JSC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application realplayer_dsetup.exe by META., JSC has been detected as a potentially unwanted program by 23 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as RealPlayer but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

META., JSC (signed and verified)

MD5:

cce10d7602e8b98d895fd742d1bd08af

SHA-1:

92bf1bbcad08ae043f65a74967fecc58b5facce0

SHA-256:

7d97cca47cb9b5d1ce098710d6e36adc6cafe86b7856cef31b3d5977ec9666cd

Scanner detections:

23 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/23/2024 8:19:48 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.Generic.908630

1000

Agnitum Outpost

PUA.InstallCore

7.1.1

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.144.32

avast!

Win32:Malware-gen

2014.9-140510

AVG

MalSign.InstallC

2015.0.3478

Bitdefender

Adware.Generic.908630

1.0.20.650

Bkav FE

W32.Clod2fe.Trojan

1.3.0.4613

Dr.Web

Adware.InstallCore.133

9.0.1.0130

Emsisoft Anti-Malware

Adware.Generic.908630

8.14.05.10.03

ESET NOD32

Win32/InstallCore.DN (variant)

8.9190

F-Prot

W32/InstallCore.R3.gen

v6.4.7.1.166

F-Secure

Adware.Generic.908630

11.2014-10-05_7

G Data

Win32.Trojan.Agent.3Q4VIM

14.5.22

IKARUS anti.virus

Win32.Malware

t3scan.2.2.29

Malwarebytes

PUP.Optional.InstallCore

v2014.05.10.03

McAfee

Artemis!7E1A4DE15F07

5600.7134

MicroWorld eScan

Adware.Generic.908630

15.0.0.390

Qihoo 360 Security

HEUR/Malware.QVM20.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.METAJSC.R

14.5.10.15

Rising Antivirus

PE:Malware.XPACK-LNR/Heur!1.5594

23.00.65.14508

Trend Micro House Call

TROJ_GEN.F47V1215

7.2.130

Vba32 AntiVirus

Downware.InstallCore

3.12.26.0

VIPRE Antivirus

Trojan.Win32.Generic

28346

File size:

615.6 KB (630,408 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\realplayer_dsetup.exe

Digital Signature

Signed by:

META., JSC

Authority:

COMODO CA Limited

Valid from:

11/6/2013 7:00:00 AM

Valid to:

11/6/2016 6:59:59 AM

Subject:

CN="META., JSC", O="META., JSC", STREET="B49, Duy Tan Street, Dich Vong Hau Ward, Cau Giay District", L=Hanoi, S=Hanoi, PostalCode=10000, C=VN

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00D08397D094A2AC46809B3100D8A03A0A

File PE Metadata

Compilation timestamp:

6/20/1992 5:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:cMJfsG4DX6KYsGhRXKzq7aA/pStvQ+sPtGtLxQtyky43vv9O0AVGJy:cMJfsFlPzq7aOkv3sUatykx40w

Entry address:

0x98CC

Entry point:

55, 8B, EC, 83, C4, CC, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, FA, 97, FF, FF, E8, 01, AA, FF, FF, E8, 2C, CC, FF, FF, E8, 73, CC, FF, FF, E8, 0A, F3, FF, FF, E8, 71, F4, FF, FF, 33, C0, 55, 68, 76, 9F, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 2C, 9F, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, B0, 40, 00, E8, 9B, FE, FF, FF, E8, 26, FA, FF, FF, 8D, 55, F0, 33, C0, E8, E0, D0, FF, FF, 8B, 55, F0, B8, D8, BD, 40, 00, E8, AB, 98, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, D8, BD, 40, 00, B2, 01, B8... 
[+]

Entropy:

7.7748

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

36 KB (36,864 bytes)

The file realplayer_dsetup.exe has been seen being distributed by the following URL.

http://files.downloadsmart.net/i/1216/x6500/.../realplayer_dsetup.exe

Remove realplayer_dsetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.