home

adobe-flash-player-13091-dp.exe

Penota

Sonepopi

The application adobe-flash-player-13091-dp.exe, “Penota Setup ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.todayconceptsnew.com and multiple other hosts.
Publisher:
Sonepopi

Product:
Penota

Description:
Penota Setup

MD5:
b7499141e882945ca96d54ca84fe3682

SHA-1:
48feb735f95dce3f4455a0fd6227ebeaca83ed75

SHA-256:
96228e40bf80a20e2138c7695c97dba27a20266aa8ded2cc7bb2b06247419705

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 1:29:44 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.AHC potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.EST (M)
16.5.12.11

File size:
957.2 KB (980,199 bytes)

Product version:
1.0

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\documents and settings\artur\pulpit\adobe-flash-player-13091-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:4xBAz6a8UnYV1V+WD5UUoeb+ZfKBskh4oCUFLCoDBLENnJi5KQIV:4X86a8bRxhb4fzkhHFLCsMnJGKL

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file adobe-flash-player-13091-dp.exe has been seen being distributed by the following 2 URLs.

http://www.todayconceptsnew.com/c?x=Vv111Ds5/Dr V3wZgyCPR2600k9Mv2dMyz/7RauFD54=&c=fTt9LK2PDFDM1sN9nGJPs81CGio5I5GCmHuUQiDHlBzQ1GAUwqtq/sIALTu/Dq8B72NFQ55Uk2i4TYIn3vxd6hyo8wrwB9JgYpODExij5CDZY5uatfnlyK99VGXi/eJQ&fallback_url=http://fpdownload.adobe.com/get/flashplayer/pdc/.../install_flash_player.exe&downloadAs=Adobe-Flash-Player-13091-dp.exe

http://www.bundlespresentbundles.com/c?x=ErOzHIBOLZAzItW5kEBokwK8h6OulJA7g3j2duG 6KI=&c=Y6ZfwrG opaiKYcX4I17FyRWzpbuMwp3tpo9sQcUyF4q89jXNhxiEVVenqxCMU2V141T31 Neej4C49tEmH2xJwtL5vy93FDsLbltqlJqh1tTZvuoHRdIPdM7cRnvC6R&fallback_url=http://fpdownload.adobe.com/get/flashplayer/pdc/.../install_flash_player.exe&downloadAs=Adobe-Flash-Player-13091-dp.exe

Remove adobe-flash-player-13091-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.