home

adobe reader xi xi 11.0.04.exe

Start Playing

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application adobe reader xi xi 11.0.04.exe by Start Playing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the OutBrowse Revenyou installer. The file has been seen being downloaded from get.file24desktop.com.
Publisher:
Start Playing  (signed and verified)

MD5:
b914faf81b922d3ccca489480830975d

SHA-1:
9499e1f29ea35abe847dbe26225087600bbdf725

SHA-256:
82c8956409ea9e8b5c0950620ce26e15420b4350e95e5f350b19c1a7dcd27f07

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/24/2024 6:54:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Outbrowse.StartPlaying.Bundler (M)
15.12.25.9

File size:
564.6 KB (578,184 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou (using Nullsoft Install System)

Language:
Language Neutral

Digital Signature
Signed by:
Start Playing

Authority:
GlobalSign nv-sa

Valid from:
11/5/2014 7:31:25 AM

Valid to:
10/22/2015 7:57:40 AM

Subject:
CN=Start Playing, O=Start Playing, L=Dublin, C=IE

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E42341A4A0E7A33C8B243CF91451FD01

File PE Metadata
Compilation timestamp:
12/5/2009 3:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:U/VpcPr7vOOu7YdqYLavNZmc5SFmCO61y0AzATpRbzUTQB:UUxdJazm6SkCO61JAQsE

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9748

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file adobe reader xi xi 11.0.04.exe has been seen being distributed by the following URL.

http://get.file24desktop.com/.../Get?p=13481&d=19421&l=18584&n=1&productname=Adobe Reader XI XI 11.0.04&exeurl=Adobe Reader XI XI - Download&dynamicname=Adobe Reader XI XI 11.0.04&filename=Adobe Reader XI XI 11.0.04&dt=1415370876

Remove adobe reader xi xi 11.0.04.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.