home

vlc_x86_setup_web.exe

INSTALL DOT EXE

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application vlc_x86_setup_web.exe, “Premium Installer ” by INSTALL DOT EXE has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. The installer is marketed through download protals and search ads as the VideoLAN VLC media player but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Premium Installer   (signed by INSTALL DOT EXE)

Product:
Premium Installer

Description:
Premium Installer

Version:
2.4.8.1

MD5:
1cb633070a7f6dab3af7533e6052057e

SHA-1:
b423d468c1b455d1c1e6595f174a514fa2cdae59

SHA-256:
56bfc2adc2ba39ac06c6639fa57bc7f01679f8e0a8c05fdd1026202dc3e7faf9

Scanner detections:
14 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/25/2024 9:56:33 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Skodna.Generic
2016.0.3224

Comodo Security
Application.Win32.iBryte.R
17776

Dr.Web
Trojan.Packed.25441
9.0.1.019

ESET NOD32
Win32/AdWare.iBryte (variant)
9.9416

Fortinet FortiGate
Riskware/IBryte
1/19/2015

Malwarebytes
PUP.Optional.OptimumInstaller.A
v2015.01.19.04

McAfee
Artemis!1CB633070A7F
5600.6880

Qihoo 360 Security
HEUR/Malware.QVM10.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.Adknowledge
15.1.19.16

Rising Antivirus
PE:PUF.PremiumInstaller!1.9F73
23.00.65.15117

Sophos
iBryte Optimum Installer
4.97

Trend Micro House Call
TROJ_GEN.F47V0211
7.2.19

Vba32 AntiVirus
SScope.Malware-Cryptor.iBryte
3.12.24.3

VIPRE Antivirus
Optimum Installer
26414

File size:
1.7 MB (1,741,608 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) 2013 Premium Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\Music yo\vlc_x86_setup_web.exe

Digital Signature
Signed by:
INSTALL DOT EXE

Authority:
VeriSign, Inc.

Valid from:
10/4/2013 1:00:00 AM

Valid to:
9/21/2014 12:59:59 AM

Subject:
CN=INSTALL DOT EXE, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=INSTALL DOT EXE, L=Kansas City, S=Missouri, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
4C8303B332693FCF64E1E7DFD7841493

File PE Metadata
Compilation timestamp:
2/10/2014 5:03:53 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:8/KRpAoEaNmfr0chSGck/4e8ZluppSTQYAXRdnV37xc4DrNeeatSuyqRN:UKRpAoHUoU9wequppSQXNxaeySzqH

Entry address:
0x38D55

Entry point:
E8, 5A, 8E, 00, 00, E9, 78, FE, FF, FF, 6A, 0C, 68, E0, 7C, 47, 00, E8, C1, 35, 00, 00, 83, 65, E4, 00, 8B, 75, 08, 3B, 35, D8, 32, 5A, 00, 77, 22, 6A, 04, E8, 5D, 90, 00, 00, 59, 83, 65, FC, 00, 56, E8, BF, 9D, 00, 00, 59, 89, 45, E4, C7, 45, FC, FE, FF, FF, FF, E8, 09, 00, 00, 00, 8B, 45, E4, E8, CD, 35, 00, 00, C3, 6A, 04, E8, 40, 8F, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 83, 3D, 14, 1F, 5A, 00, 00, 75, 18, E8, 95, 83, 00, 00, 6A, 1E, E8, BD, 81, 00, 00, 68, FF, 00, 00, 00, E8, D7, 4C, 00, 00, 59, 59, A1...
 
[+]

Entropy:
7.1219

Code size:
404 KB (413,696 bytes)

The file vlc_x86_setup_web.exe has been seen being distributed by the following URL.

http://www.vid95.com/.../VLC_x86_Setup_Web.exe

Remove vlc_x86_setup_web.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.