home

adobe_flash_player-36625931.exe

Zen Bros Media

The application adobe_flash_player-36625931.exe by Zen Bros Media has been detected as a potentially unwanted program by 4 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from intva31.nixcontact.info and multiple other hosts.
Publisher:
Zen Bros Media  (signed and verified)

MD5:
87dfc1ba8781f7d52278f9428f624604

SHA-1:
9aa3735a09ee13472fdc2dc2fefd956444a6e67a

SHA-256:
880ddbafbe190b36f8bc69b7e952ad805043ccc8c993e8617450f404b4eb7523

Scanner detections:
4 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 8:57:39 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Helper
2016.05.15

IKARUS anti.virus
Trojan.Win32
t3scan.2.0.9.0

Qihoo 360 Security
HEUR/QVM20.1.0000.Malware.Gen
1.0.0.1120

Reason Heuristics
PUP.DownloadAdmin.ZenBrosM (M)
16.5.17.23

File size:
471.3 KB (482,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_flash_player-36625931.exe

Digital Signature
Signed by:
Zen Bros Media

Authority:
GoDaddy.com, Inc.

Valid from:
3/8/2016 11:12:43 PM

Valid to:
3/8/2017 11:12:43 PM

Subject:
CN=Zen Bros Media, O=Zen Bros Media, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00DA69A0BD854BB554

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
12288:/ThKd6hIaNYLNcYM4+Q3sMnMbI7cRFUJ6DNF99GIR6/:/VKd62AYJcYM4+Q3sMMbIIRFUJ6DNF9C

Entry address:
0x4C6E0

Entry point:
C6, 05, 70, D2, 44, 00, 00, B9, 00, 00, 46, 00, BA, 04, 00, 46, 00, B8, B0, F6, 44, 00, E8, 65, FF, FF, FF, E8, 70, FF, FF, FF, B8, 90, F6, 44, 00, E8, 16, 4B, FC, FF, C3, 00, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Code size:
301.8 KB (309,024 bytes)

The file adobe_flash_player-36625931.exe has been seen being distributed by the following 15 URLs.

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36701093&ephemeral=1&filename=adobe_flash_player.exe&cb=860762886&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36685155&ephemeral=1&filename=adobe_flash_player.exe&cb=1540965263&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36715266&ephemeral=1&filename=adobe_flash_player.exe&cb=-668291085&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36639227&ephemeral=1&filename=adobe_flash_player.exe&cb=1284914676&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36727224&ephemeral=1&filename=adobe_flash_player.exe&cb=-1822400947&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36629406&ephemeral=1&filename=adobe_flash_player.exe&cb=1852559063&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36626661&ephemeral=1&filename=adobe_flash_player.exe&cb=-741226049&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36724165&ephemeral=1&filename=adobe_flash_player.exe&cb=2107303075&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36696332&ephemeral=1&filename=adobe_flash_player.exe&cb=1938553989&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36702151&ephemeral=1&filename=adobe_flash_player.exe&cb=673301522&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36659058&ephemeral=1&filename=adobe_flash_player.exe&cb=-1845184037&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36680131&ephemeral=1&filename=adobe_flash_player.exe&cb=-1600050439&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36737464&ephemeral=1&filename=adobe_flash_player.exe&cb=-2019799184&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36693201&ephemeral=1&filename=adobe_flash_player.exe&cb=1606401077&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.nixcontact.info/dl-pure/1202331/.../?bc=1202331&checksum=36642771&ephemeral=1&filename=adobe_flash_player.exe&cb=1061096119&hashstring=Ty5h5zCaTvTb&usefilename=true&executableroutePath=1202485&stub=true

Remove adobe_flash_player-36625931.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.