home

vipbox_download.exe

Kantida Chanudrum

The application vipbox_download.exe by Kantida Chanudrum has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from download.vipboxsportapp.com.
Publisher:
Kantida Chanudrum  (signed and verified)

MD5:
c04f07f499799769a04b0ee9736efe1e

SHA-1:
52a27ab5c9bf3650605108e5f0286fbbfa846cb5

SHA-256:
8d4aa2b673083022173cecab47f4896e25458ac4d903c41eacc27a8719d3b44a

Scanner detections:
15 / 68

Status:
Adware

Explanation:
The installer bundles additional adware-type offers (ad-supported) that are displayed to the user during setup and typically installed by default. These include web browser ad-injectors.

Analysis date:
4/19/2024 1:10:54 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Application.Bundler.DefaultTab.1
935

AVG
Generic
2015.0.3413

Bitdefender
Gen:Application.Bundler.DefaultTab.1
1.0.20.975

Dr.Web
Adware.Downware.5516
9.0.1.05190

F-Secure
Gen:Application.Bundler.DefaultTab
11.2014-14-07_2

G Data
Gen:Application.Bundler.DefaultTab
14.7.24

IKARUS anti.virus
PUA.AppBundler
t3scan.1.6.1.0

Malwarebytes
PUP.Optional.OneClickDownloader.A
v2014.07.14.09

McAfee
Adware-SweetIM
5600.7069

MicroWorld eScan
Gen:Application.Bundler.DefaultTab.1
15.0.0.585

NANO AntiVirus
Riskware.Nsis.Downware.czyjkl
0.28.2.60881

Qihoo 360 Security
Win32/Virus.Adware.47b
1.0.0.1015

Reason Heuristics
PUP.KantidaChanudrum.P
14.7.14.20

Sophos
Install Core
4.98

VIPRE Antivirus
Threat.4791953
31208

File size:
504.3 KB (516,352 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\vipbox_download.exe

Digital Signature
Signed by:
Kantida Chanudrum

Authority:
Thawte, Inc.

Valid from:
4/14/2014 6:00:00 PM

Valid to:
4/15/2015 5:59:59 PM

Subject:
CN=Kantida Chanudrum, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
12C00C2179570252969AF80D723272A8

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:5sA7FXORKSyXpM44TnFmKgXk5FykFtPiYpnHlPnjwwU0v7hGaug3ceyLOzpKJImQ:vFN56BFnyqTt9P94g3mOznmJVdQWwaM

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.9254

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file vipbox_download.exe has been seen being distributed by the following URL.

http://download.vipboxsportapp.com/.../vipbox_download.exe

Remove vipbox_download.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.