» adobe_acrobat_11.exe
Overview
Analysis
File Details
Downloads (1)

adobe_acrobat_11.exe

ProfitServis LLC

This is a bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application adobe_acrobat_11.exe by ProfitServis has been detected as adware by 22 anti-malware scanners. The program is a setup application that uses the ProfitServis Downloader installer. The file has been seen being downloaded from qlsndkebt7t77fw.assbreak.ru.

File name:

Publisher:

ProfitServis LLC (signed and verified)

Version:

1.0.0.0

MD5:

2ccb3be7b72778ef53c0e64eb24cf9a5

SHA-1:

ad1b70a035e0dad5ceaa9ad466fedca43aa7f7e3

SHA-256:

c1bebf896be5e9eacc2a2783fde68c55a3166fd4f6d97bbba6bc81b3bd5a6e08

Scanner detections:

22 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

1/15/2025 9:58:27 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Graftor.157854

843

Agnitum Outpost

Riskware.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.InstallMonster

2014.10.15

Avira AntiVirus

APPL/InstallMon.enib

7.11.178.86

avast!

Win32:InstallMonstr-GC [PUP]

141003-0

AVG

Generic

2015.0.3321

Bitdefender

Gen:Variant.Graftor.157854

1.0.20.1435

Dr.Web

Trojan.InstallMonster.953

9.0.1.05190

Emsisoft Anti-Malware

Gen:Variant.Graftor.157854

8.14.10.14.11

ESET NOD32

Win32/InstallMonstr.FM potentially unwanted application

7.0.302.0

F-Prot

W32/A-4193a7fa

v6.4.7.1.166

F-Secure

Gen:Variant.Graftor.157854

11.2014-14-10_3

G Data

Gen:Variant.Graftor.157854

14.10.24

K7 AntiVirus

Unwanted-Program

13.183.13676

MicroWorld eScan

Gen:Variant.Graftor.157854

15.0.0.861

NANO AntiVirus

Trojan.Win32.InstallMonster.dewbsi

0.28.2.62671

Norman

InstallMonstr.S

11.20141014

Reason Heuristics

PUP.ProfitServis.Q

14.10.14.21

Sophos

Install Monster

4.98

Vba32 AntiVirus

Signed-Downware.InstallMonstr

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

33932

Zillya! Antivirus

Adware.InstallMonster.Win32.30

2.0.0.1955

File size:

2.6 MB (2,774,368 bytes)

Product version:

1.0.0.0

File type:

Executable application (Win32 EXE)

Bundler/Installer:

ProfitServis Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\adobe_acrobat_11.exe

Digital Signature

Signed by:

ProfitServis LLC

Authority:

Thawte, Inc.

Valid from:

5/20/2014 8:00:00 PM

Valid to:

5/21/2015 7:59:59 PM

Subject:

CN=ProfitServis LLC, O=ProfitServis LLC, L=Village of Kommunar, S="Kharkiv District, Kharkiv Region", C=UA

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

259670E42586FCE460513727E39AB7DF

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

49152:2j69BnfCPeQMOtIlPvFHs4hVfE4kuYwnQhrH5ym:M69Bn+ZMOtIhphVfE4hYPH5T

Entry address:

0x590E20

Entry point:

60, BE, 00, C0, 7A, 00, 8D, BE, 00, 50, C5, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89... 
[+]

Entropy:

7.9633

Packer / compiler:

UPX 2.90LZMA

Code size:

1.9 MB (1,990,656 bytes)

The file adobe_acrobat_11.exe has been seen being distributed by the following URL.

http://qlsndkebt7t77fw.assbreak.ru/eyJ2ZXIiOiIxIiwic2lkIjoiMzM2NCIsInVybCI6Imh0dHA6Ly9maWxlcy1iZXpzbXMuY29tL2ZpbGVzL0Fkb2JlX0Fjcm9iYXRfMTEucmFyIiwibmFtZSI6IkFkb2JlX0Fjcm9iYXRfMTEucmFyIiwidHlwZSI6ImFyY2hpdmUiLCJybmQwIjo5NTQ4NzIzMDI5NDM4NH0=

Remove adobe_acrobat_11.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.