home

vafplayer.exe

tuguu sl

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application vafplayer.exe by tuguu sl has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. According to AVG, this software downloads additional adware offers during setup.
Publisher:
tuguu sl  (signed and verified)

MD5:
c0a92148ecee9b84b549c0508b0990f8

SHA-1:
5f1d849c9a308172ed922821051aa29983174c5b

SHA-256:
f342574e855078148d0dde3d727c483d9abbfe113dae9f78d9b31beb7cf52b17

Scanner detections:
22 / 68

Status:
Adware

Explanation:
Uses the DomainIQ download manager to bundle additional potentially unwanted software without adequate consent.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/26/2024 3:30:11 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.DomaIQ.M
927

Agnitum Outpost
PUA.DomaIQ
7.1.1

AhnLab V3 Security
PUP/Win32.DomaIQ
2014.07.23

Avira AntiVirus
APPL/DomaIQ.Gen
7.11.163.102

avast!
Win32:Installer-U [PUP]
140617-1

AVG
Trojan horse Downloader.Generic13.CLLF.dropper
2014.0.3986

Bitdefender
Application.Bundler.DomaIQ.M
1.0.20.1015

Bkav FE
HW32.CDB
1.3.0.4959

ESET NOD32
Win32/DomaIQ.BB potentially unwanted application
7.0.302.0

F-Secure
Application.Bundler.DomaIQ
11.2014-22-07_3

G Data
Application.Bundler.DomaIQ
14.7.24

IKARUS anti.virus
PUA.Tuguu
t3scan.1.6.1.0

Kaspersky
not-a-virus:HEUR:AdWare.MSIL.DomaIQ
14.0.0.3522

Malwarebytes
PUP.Optional.Dropper.BL
v2014.07.22.02

McAfee
CryptDomaIQ
5600.7061

Microsoft Security Essentials
Threat.Undefined
1.179.723.0

MicroWorld eScan
Application.Bundler.DomaIQ.M
15.0.0.609

Panda Antivirus
PUP/MultiToolbar.A
14.07.22.02

Reason Heuristics
PUP.tuguusl.J
14.8.7.18

Sophos
DomainIQ pay-per install
4.98

SUPERAntiSpyware
Trojan.Agent/Gen-Tugspay
10468

VIPRE Antivirus
Threat.4150696
31208

File size:
182.3 KB (186,704 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\vafplayer.exe

Digital Signature
Signed by:
tuguu sl

Authority:
GoDaddy.com, Inc.

Valid from:
6/13/2013 9:06:55 AM

Valid to:
6/13/2014 9:06:55 AM

Subject:
CN=tuguu sl, O=tuguu sl, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2B632A0CF95E4D

File PE Metadata
Compilation timestamp:
7/14/2014 4:02:09 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
3072:/vstUKlvJ2+usOKDUcJaCcBBoKxiAga+4WvNc+xiz8TnYvclg6JFa9EGyLQEXmsK:/0tU7bsJ6RBoL4T18bPlLJFbLQI1LKY8

Entry address:
0x3B7E

Entry point:
B8, 4C, 25, 47, 00, 50, 64, FF, 35, 00, 00, 00, 00, 64, 89, 25, 00, 00, 00, 00, 33, C0, 89, 08, 50, 45, 43, 6F, 6D, 70, 61, 63, 74, 32, 00, E0, 82, 38, 0C, 62, 3C, 4D, 3D, E3, 3C, 5E, 97, 42, 73, AD, CC, CB, 05, E2, 2D, 5A, 9C, 64, CE, 0B, 5E, A4, 28, AD, F9, 0F, 49, E7, FF, F0, 0B, 05, FE, BB, 64, 50, 8C, D3, 48, C9, 1E, 1D, 65, 0F, C5, 52, 8E, A7, 3E, 6F, 6B, 2A, B5, 69, 91, 27, 0E, C5, 82, D3, AD, 56, 54, DA, F6, D9, 13, 32, 2A, DF, 44, BC, 56, 30, ED, 22, 85, F3, 44, 38, F9, B4, 10, 81, 60, 7A, EF, C4...
 
[+]

Packer / compiler:
PECompact v2

Code size:
112.5 KB (115,200 bytes)

Remove vafplayer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.