home

adobe flash player.exe

File

COnfirmed aPp nln

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application adobe flash player.exe by COnfirmed aPp nln has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from get.0124j.info.
Publisher:
COnfirmed aPp nln  (signed and verified)

Product:
File

Version:
1.9.3.0

MD5:
50aca512a81af067e83bf31159f91c48

SHA-1:
9ef6ee1922aacde387f8e3a03db4cce722640cb2

SHA-256:
20523eddb9532ed34f8e03eacba6793c3a6fcc31e686f91c49a4858ff6eccf74

Scanner detections:
23 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/27/2024 7:29:12 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Dropped:Adware.Generic.1226111
5656960

Agnitum Outpost
PUA.OutBrowse
7.1.1

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.04.22

AVG
Potentially harmful program Downloader.FPK
2014.0.4311

Bitdefender
Dropped:Adware.Generic.1226111
1.0.20.555

Dr.Web
Trojan.OutBrowse.334
9.0.1.05190

Emsisoft Anti-Malware
Dropped:Adware.Generic.1226111
9.0.0.4799

ESET NOD32
Win32/OutBrowse.BU potentially unwanted application
7.0.302.0

Fortinet FortiGate
Riskware/OutBrowse
4/21/2015

F-Secure
Adware.Generic.1226111
11.2015-21-04_3

G Data
Dropped:Adware.Generic.1226111
15.4.25

Malwarebytes
PUP.Optional.Outbrowse.Gen
v2015.04.21.09

McAfee
Adware-OutBrowse.e
5600.6788

MicroWorld eScan
Dropped:Adware.Generic.1226111
16.0.0.333

NANO AntiVirus
Trojan.Win32.OutBrowse.dpuxby
0.30.20.1219

nProtect
Dropped:Adware.Generic.1226111
15.04.20.01

Qihoo 360 Security
HEUR/QVM30.1.Malware.Gen
1.0.0.1015

Quick Heal
Adware.NSIS.OutBrowse.A
4.15.14.00

Reason Heuristics
Threat.Outbrowse.Bundler
15.4.21.16

Sophos
Generic PUA FI
4.98

Trend Micro House Call
TROJ_GE.D1B08FAD
7.2.111

Trend Micro
TROJ_GE.D1B08FAD
10.465.21

VIPRE Antivirus
Threat.5085447
39354

File size:
1 MB (1,099,016 bytes)

Product version:
1.9.3.0

Copyright:
File

Original file name:
Ionic.Zip-2015Apr14-123409-2d477a6c-c84c-40f1-b55c-183fe5c4ec96.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\adobe flash player.exe

Digital Signature
Signed by:
COnfirmed aPp nln

Authority:
thawte, Inc.

Valid from:
4/11/2015 5:00:00 PM

Valid to:
1/27/2016 3:59:59 PM

Subject:
CN=COnfirmed aPp nln, O=COnfirmed aPp nln, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
5C6B123E686654AFD5EA691C625BE3A0

File PE Metadata
Compilation timestamp:
4/14/2015 5:34:09 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:nbSaE4mvt/ZouO5/YI0uYA2BK8cj8U9apgwBJIb:nbSv4mvzXAoKr8e0A

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.5464

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file adobe flash player.exe has been seen being distributed by the following URL.

http://get.0124j.info/1429014847/1429014847/.../aTgtLjIwLCNhOTIqLjAsI2M2Ly0wMyohajYuHWlvbGB1XG9qWmpcNlBicHVpIWFxYmxraTpkdG1rISxeHCtjIi5mWmRkXWxuZ2lsXWQnXGBoX1wnYGxpJSthXmJrHCtjaWV2XiAuX2ZlbHFeaGxYYWhacF9paV51ZWssMXEwKVhqcG9hWFxdWlxYYmUrYXheIWBya1hmZmBqYWZgOTphZltiKEJsWm5kJE1jWnZibiZfZGhea1hmYjo9ZGhdYSRDY1pwZSdQZVx1Xm8dYmBsaj0rIXZibTQr

Remove adobe flash player.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.