home

webplayer_fr.exe

The executable webplayer_fr.exe has been detected as malware by 26 anti-virus scanners. This is a setup program which is used to install the application. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The file has been seen being downloaded from clic.illyx.com and multiple other hosts.
Description:
Webplayer

Version:
2.7.0.1

MD5:
d01b4da31fa2947223b9e6589918bb3c

SHA-1:
7d50f878b328c69819148a61740d164913d69d1a

SHA-256:
8293f9f1586a6c534d52067520d096027e73ddd2e0504d73d54f8d32adaf10aa

Scanner detections:
26 / 68

Status:
Malware

Analysis date:
4/24/2024 9:05:49 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.V
908

AhnLab V3 Security
Malware/Win32.Generic
2014.07.11

Avira AntiVirus
TR/Dldr.Megone.hrst
7.11.160.46

avast!
Win32:Rootkit-gen [Rtk]
2014.9-140810

Baidu Antivirus
Trojan.Win32.Hacktool.BAutoit
4.0.3.14810

Bitdefender
Application.Bundler.V
1.0.20.1110

Comodo Security
UnclassifiedMalware
18841

Dr.Web
Trojan.DownLoader11.19832
9.0.1.0222

ESET NOD32
Win32/Packed.Autoit
8.10079

Fortinet FortiGate
W32/Genome.HRST!tr.dldr
8/10/2014

G Data
Application.Bundler
14.8.24

K7 AntiVirus
Trojan
13.180.12683

Kaspersky
Trojan-Downloader.Win32.Genome
14.0.0.3427

Malwarebytes
Trojan.Autoit
v2014.08.10.12

McAfee
RDN/Downloader.a!rp
5600.7042

MicroWorld eScan
Application.Bundler.V
15.0.0.666

Norman
Troj_Generic.URXYG
11.20140810

Panda Antivirus
Trj/Chgt.C
14.08.10.12

Qihoo 360 Security
HEUR/Malware.QVM11.Gen
1.0.0.1015

Quick Heal
TrojanDownloader.gen.r3
8.14.14.00

Reason Heuristics
Threat.Win.Reputation.IMP
14.8.10.12

Total Defense
Win32/Tnega.NJKXWeB
37.0.11051

Trend Micro House Call
TROJ_SPNR.15GA14
7.2.222

Trend Micro
TROJ_SPNR.15GA14
10.465.10

VIPRE Antivirus
Trojan.Win32.Generic
31174

Zillya! Antivirus
Downloader.Genome.Win32.51214
2.0.0.1855

File size:
528.5 KB (541,184 bytes)

Product version:
3.3.10.2

Copyright:
©1999-2013 Jonathan Bennett & AutoIt Team

File type:
Executable application (Win32 EXE)

Language:
French (Luxembourg)

Common path:
C:\users\{user}\downloads\webplayer_fr.exe

File PE Metadata
Compilation timestamp:
6/24/2014 2:42:43 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:dXe9PPlowWX0t6mOQwg1Qd15CcYk0We1WuVY0EczR7Pjg9gx4H:khloDX0XOf4EGMyG

Entry address:
0x107010

Entry point:
60, BE, 00, 30, 4B, 00, 8D, BE, 00, E0, F4, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
340 KB (348,160 bytes)

The file webplayer_fr.exe has been seen being distributed by the following 2 URLs.

http://clic.illyx.com/aff_c?offer_id=25&aff_id=1005&source=tvdirectplayer

http://ressource.illyx.com/setup/dl.php?l=regie/webplayer/.../exe&telecharger=webplayer_fr

Remove webplayer_fr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.