home

adobe_flash_player-46663169.exe

Zen Bros Media

The application adobe_flash_player-46663169.exe by Zen Bros Media has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from intva31.maticnetworks.info and multiple other hosts.
Publisher:
Zen Bros Media  (signed and verified)

MD5:
e01a9b97fe930f57d5b2d6431652064e

SHA-1:
d3eb88accce39e569077f4025456adb09553f8a3

SHA-256:
081c3ea92fdbb8f3c60fb02796bd5e8c267402ea7810ad76be6fc091ac75dd58

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 12:53:36 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.ZenBrosM (M)
16.5.29.7

File size:
471.3 KB (482,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_flash_player-46663169.exe

Digital Signature
Signed by:
Zen Bros Media

Authority:
GoDaddy.com, Inc.

Valid from:
3/9/2016 3:42:43 AM

Valid to:
3/9/2017 3:42:43 AM

Subject:
CN=Zen Bros Media, O=Zen Bros Media, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00DA69A0BD854BB554

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
12288:vThKd6hIaNYLNcYM4+Q3sMnMbI7cRFUJ/DNF99GIRYu:vVKd62AYJcYM4+Q3sMMbIIRFUJ/DNF9L

Entry address:
0x4C6E0

Entry point:
C6, 05, 70, D2, 44, 00, 00, B9, 00, 00, 46, 00, BA, 04, 00, 46, 00, B8, B0, F6, 44, 00, E8, 65, FF, FF, FF, E8, 70, FF, FF, FF, B8, 90, F6, 44, 00, E8, 16, 4B, FC, FF, C3, 00, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.7059

Code size:
301.8 KB (309,024 bytes)

The file adobe_flash_player-46663169.exe has been seen being distributed by the following 21 URLs.

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46690383&ephemeral=1&filename=adobe_flash_player.exe&cb=409323576&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46743563&ephemeral=1&filename=adobe_flash_player.exe&cb=-1761391834&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46691007&ephemeral=1&filename=adobe_flash_player.exe&cb=1466590481&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46689528&ephemeral=1&filename=adobe_flash_player.exe&cb=-1514559391&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46743095&ephemeral=1&filename=adobe_flash_player.exe&cb=-1984123804&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46763607&ephemeral=1&filename=adobe_flash_player.exe&cb=-1002671151&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46778460&ephemeral=1&filename=adobe_flash_player.exe&cb=-438989326&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46663721&ephemeral=1&filename=adobe_flash_player.exe&cb=-914529702&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46735477&ephemeral=1&filename=adobe_flash_player.exe&cb=637021033&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46713494&ephemeral=1&filename=adobe_flash_player.exe&cb=-824777324&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46693549&ephemeral=1&filename=adobe_flash_player.exe&cb=-2058311991&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46741522&ephemeral=1&filename=adobe_flash_player.exe&cb=830298818&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46737392&ephemeral=1&filename=adobe_flash_player.exe&cb=-894381941&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46722016&ephemeral=1&filename=adobe_flash_player.exe&cb=-1768431846&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46743892&ephemeral=1&filename=adobe_flash_player.exe&cb=402331996&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46768084&ephemeral=1&filename=adobe_flash_player.exe&cb=-276493538&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46718544&ephemeral=1&filename=adobe_flash_player.exe&cb=-1776729948&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46742088&ephemeral=1&filename=adobe_flash_player.exe&cb=830651036&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46760039&ephemeral=1&filename=adobe_flash_player.exe&cb=340506586&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46683608&ephemeral=1&filename=adobe_flash_player.exe&cb=-2135678676&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

http://intva31.maticnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=46774758&ephemeral=1&filename=adobe_flash_player.exe&cb=814228594&hashstring=hlkjpI1V64hJ&usefilename=true&executableroutePath=1203021&stub=true

Remove adobe_flash_player-46663169.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.