home

VlcMediaPlayer_SoftangoDownloader.exe

R2D2 Tech Software LLC

This is the Performersoft setup installer. The application VlcMediaPlayer_SoftangoDownloader.exe by R2D2 Tech Software has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the InstallBrain installer. The setup program bundles additional offers, mostly adware, using the InstallBrain installer, a pay-per-install monetization download manager. InstallBrain will also install a background updater service that will update any installed browser add-ons and plug-ins. The installer is marketed through download protals and search ads as the VideoLAN VLC media player but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
R2D2 Tech Software LLC  (signed and verified)

Version:
14.4.10.23

MD5:
d140f892a31c9589411091baedd15b39

SHA-1:
4eca25161cf83a32ed36103e0c45393dd11f0d87

SHA-256:
256eff0131ee0ccdb75d25d03b35dc84b12a95fb7de10b4d8eb11fd166429bec

Scanner detections:
5 / 68

Status:
Adware

Explanation:
Uses the InstallBrain monetization platform from iBario to deliver bundled adware both search toolbars and PC optimizers from Performersoft.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 2:01:06 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
MalSign.InstallC
2015.0.3508

Dr.Web
Adware.Downware.2543
9.0.1.0101

ESET NOD32
Win32/InstallBrain.BW (variant)
8.9663

Reason Heuristics
PUP.R2D2TechSoftware.b
14.8.8.0

VIPRE Antivirus
InstallBrain
28194

File size:
1.2 MB (1,244,520 bytes)

Product version:
14.4.10.23

Copyright:
Copyright 2014

Original file name:
VlcMediaPlayer_SoftangoDownloader.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
InstallBrain

Language:
English (United States)

Common path:
C:\users\{user}\downloads\vlcmediaplayer_softangodownloader.exe

Digital Signature
Signed by:
R2D2 Tech Software LLC

Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2013 4:13:12 PM

Valid to:
12/18/2016 4:13:12 PM

Subject:
CN=R2D2 Tech Software LLC, O=R2D2 Tech Software LLC, L=Beaverton, S=Oregon, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
7287089BC80B

File PE Metadata
Compilation timestamp:
4/10/2014 4:02:46 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
24576:WAhOqqEQT4EI+/vBOKV/gBh5iSfu4zkM+YkYWEahtYDz+ah3hf4K0OAJpo:MtEQT4EtHwAgBhRu4RbkdTo7BtKOAJe

Entry address:
0xF809

Entry point:
E8, 55, 4E, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 94, FC, 42, 00, 00, 75, 18, E8, A0, 46, 00, 00, 6A, 1E, E8, EA, 44, 00, 00, 68, FF, 00, 00, 00, E8, E3, 16, 00, 00, 59, 59, 85, DB, 74, 04, 8B, C3, EB, 03, 33, C0, 40, 50, 6A, 00, FF, 35, 94, FC, 42, 00, FF, 15, 8C, 30, 42, 00, 8B, F8, 85, FF, 75, 26, 6A, 0C, 5E, 39, 05, 98, FC, 42, 00, 74, 0D, 53, E8, 79, 1B, 00, 00, 59, 85, C0, 75, A9, EB, 07, E8, 71, 1D, 00, 00, 89, 30, E8, 6A, 1D, 00, 00, 89...
 
[+]

Entropy:
7.7830  (probably packed)

Code size:
134 KB (137,216 bytes)

The file VlcMediaPlayer_SoftangoDownloader.exe has been seen being distributed by the following URL.

http://www.softologic.com/.../gk99q?exename=VlcMediaPlayer_SoftangoDownloader&cid=4144&soft_id=63213

Remove VlcMediaPlayer_SoftangoDownloader.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.