Hikvision NVR's player.exe malmware

[surveillancelot]

When I download video files from Hikvision NVR, it automatically adds player.exe to the folder. For some reason, antivirus software recognizes it as malmware. Does this happen to others and is there a real threat?

The player itself is good for one purpose: it plays audio. For some reason VLC or other players do not play audio from hikvision cameras (external mic).

 

[toysareforboys]

When I download video from my hikvision NVR the sound also doesn't play in VLC player but it plays perfectly in MPC-HC.

-Jamie M.

 

[alastairstevenson]

For some reason, antivirus software recognizes it as malmware

Odd. What antivirus, and what strain does it claim it is?

Does this happen to others and is there a real threat?

I have never seen this.
Nor have I seen player.exe downloaded with videos.

It might be interesting to drop a copy of player.exe (assuming the AV allows you to do this without temporarily disabling it ...) on to VirusTotal to see what the 70 plus AV scanners on there think of it.

 

[surveillancelot]

Odd. What antivirus, and what strain does it claim it is?

It might be interesting to drop a copy of player.exe (assuming the AV allows you to do this without temporarily disabling it ...) on to VirusTotal to see what the 70 plus AV scanners on there think of it.

I will try this at some point. FOR SCIENCE!!!

 

[surveillancelot]

looking pretty bad i guess

 

[alastairstevenson]

looking pretty bad i guess

Interesting! It does look like Hikvision have some trojan-like code in the player.

Here is a scan of the player.exe from the NVR_K51_BL_ML_STD_V3.4.96_170921 firmware.
It's the same file in the K41 version and also several earlier firmware versions.
It might be interesting to contact Hikvision's Cyber Security team for comment ...
I might just do that.

 

[alastairstevenson]

It might be interesting to contact Hikvision's Cyber Security team for comment ...
I might just do that.

I just did.