home

hd_player__mtcd16044&cid=33240432037d47b1f94a4f68805d7168.exe

Vlc Player

Downloadius S.a.r.l

The application hd_player__mtcd16044&cid=33240432037d47b1f94a4f68805d7168.exe by Downloadius S.a.r.l has been detected as adware by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from www.loadyvr.com and multiple other hosts.
Publisher:
Downloadius  (signed by Downloadius S.a.r.l)

Product:
Vlc Player

Description:
vlcplayer

Version:
6.1.0.0

MD5:
65d686cd8cfc837f4c18cc3e857beced

SHA-1:
5646c0119c28a6fa7205899c4660aa6e0f26d697

SHA-256:
bf31918afc7bc59a16d357273c5bf513371216646c630cf2d7802d3738650d84

Scanner detections:
8 / 68

Status:
Adware

Analysis date:
5/5/2024 6:40:54 AM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.Toolbar.Montiera
7.1.1

avast!
Win32:Dropper-gen [Drp]
2014.9-140725

ESET NOD32
Win32/Toolbar.Montiera
8.10153

Malwarebytes
PUP.Optional.Montiera.I
v2014.07.25.07

McAfee
Artemis!0140B84A59BB
5600.7058

Reason Heuristics
PUP.DownloadiusSarl.z
14.8.7.23

Trend Micro House Call
Suspicious_GEN.F47V0724
7.2.206

VIPRE Antivirus
Downloadius
31590

File size:
542.3 KB (555,352 bytes)

Product version:
2.0

Copyright:
Downloadius

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\hd_player__mtcd16044&cid=33240432037d47b1f94a4f68805d7168.exe

Digital Signature
Signed by:
Downloadius S.a.r.l

Authority:
COMODO CA Limited

Valid from:
7/25/2013 7:00:00 PM

Valid to:
7/25/2016 6:59:59 PM

Subject:
CN=Downloadius S.a.r.l, O=Downloadius S.a.r.l, STREET="7, Avenue Gaston Diderich", L=Luxembourg, S=Luxembourg, PostalCode=L-1420, C=LU

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
516E4C889E15D413F8CD7F3121095139

File PE Metadata
Compilation timestamp:
12/5/2009 4:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:hEwSr/+Zvwc4Ht+pY9nDW6NPBSBdZchgB9goPKJNZX/m9/E:mwSwwcfpYpPBSB/igB2NJNdm9/E

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9726

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file hd_player__mtcd16044&cid=33240432037d47b1f94a4f68805d7168.exe has been seen being distributed by the following 28 URLs.

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=25cb99c037167638adff143d47d9adc2

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=178d203ca0593e5a57c4daaca78ea738

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=3d591c8d8533dafab0eac7d49af4dfaf

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=1115fcbc6dc26462f496f5faec9cd632

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=843baede930abb37a3c14b5b6b9b92b4

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=8ad08cfb7ed4747d7ed94053c1e568fe

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=a6a2f8417d52346d86dd2afd90369a1d

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=23886328ba9c5d19dcc4200e513a8f6f

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD13345&cid=ab688ffab7c7c5f3707e544d007f1928

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=286d5dd839380153660625c545e5ba09

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=c790cdace8a7d3ba8940741b079b959b

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=67da0f849081f5dc5c3d554184b4ab70

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=67da0f849081f5dc5c3d554184b4ab70

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=b14468e074f1562ae54b0664565533fe

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=17cb256b8d3020641c7240be0990637b

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=afe746b32f9f0844e1b4cb76ad94ff0e

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=ee0f27ac3c50608cd7f77ea96750f7ca

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=fffbff18b5b08f088006cbc39453f221

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=ea91cada7599a350e4c9a7e357ed4b2f

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=ee63d228c6c77cad25ac715089d91e43

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=595125a522c4c4e2c59d2857747d2efe

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD7045&cid=6ecf1c1eaf85fc99636b298a6babd76c

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14068&cid=beb3e9ecca57b83105f2b2ce3d7ce565

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=4cbff210d4d679f591146d3014bbfe1e

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=01f6264c1564be31de2a043c597f6e56

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=0e0f8e21a277a254623d127c0213a5ae

http://www.masterloadius.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=0cf16d3a43b628763df443855c6f6dbf

http://www.loadyvr.com/.../downloader.php?aflt=CD5&mt_aflt=CD14192&cid=3b4a33c229937ba70879458c516c205c

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.