home

adobe_flash_player-55179017.exe

Zen Bros Media

The application adobe_flash_player-55179017.exe by Zen Bros Media has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from intva31.sitememory.info and multiple other hosts.
Publisher:
Zen Bros Media  (signed and verified)

MD5:
ac5bc3b48b763e4a4ade351c292298d0

SHA-1:
79b666e0bd4440b83dfb225431681078bd144737

SHA-256:
d51dd6f92cec4feb4254a3d6c32aeb6ceea83ba7753516d211ac8d136b220f37

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 10:24:08 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.ZenBrosM (M)
16.6.9.12

File size:
429.3 KB (439,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_flash_player-55179017.exe

Digital Signature
Signed by:
Zen Bros Media

Authority:
GoDaddy.com, Inc.

Valid from:
3/9/2016 5:12:43 AM

Valid to:
3/9/2017 5:12:43 AM

Subject:
CN=Zen Bros Media, O=Zen Bros Media, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00DA69A0BD854BB554

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
12288:6zxKdSZiZRNS8hZiMYpQ3qyNwkJAH/YdU8n4OBmkaA:6lKdSYR9hZiMYpQ3qyekJMAdU8nhBmkR

Entry address:
0x4D830

Entry point:
C6, 05, 70, E2, 44, 00, 00, B9, 00, 10, 46, 00, BA, 04, 10, 46, 00, B8, B0, 07, 45, 00, E8, 65, FF, FF, FF, E8, 70, FF, FF, FF, B8, 90, 07, 45, 00, E8, C6, 39, FC, FF, C3, 00, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.4613

Code size:
306.1 KB (313,456 bytes)

The file adobe_flash_player-55179017.exe has been seen being distributed by the following 32 URLs.

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55324110&ephemeral=1&filename=adobe_flash_player.exe&cb=278685338&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55253413&ephemeral=1&filename=adobe_flash_player.exe&cb=-1467819363&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55180264&ephemeral=1&filename=adobe_flash_player.exe&cb=1535643818&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55516812&ephemeral=1&filename=adobe_flash_player.exe&cb=-1353948967&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55662574&ephemeral=1&filename=adobe_flash_player.exe&cb=459423018&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55206177&ephemeral=1&filename=adobe_flash_player.exe&cb=753785185&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55427165&ephemeral=1&filename=adobe_flash_player.exe&cb=-2102086147&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55400250&ephemeral=1&filename=adobe_flash_player.exe&cb=-881111230&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55176169&ephemeral=1&filename=adobe_flash_player.exe&cb=954775127&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55629576&ephemeral=1&filename=adobe_flash_player.exe&cb=-1252851836&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55251663&ephemeral=1&filename=adobe_flash_player.exe&cb=842573164&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55508346&ephemeral=1&filename=adobe_flash_player.exe&cb=1805784048&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55445131&ephemeral=1&filename=adobe_flash_player.exe&cb=1602752391&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55666275&ephemeral=1&filename=adobe_flash_player.exe&cb=1709834819&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55513502&ephemeral=1&filename=adobe_flash_player.exe&cb=-675173128&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55315910&ephemeral=1&filename=adobe_flash_player.exe&cb=-1653677503&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55390932&ephemeral=1&filename=adobe_flash_player.exe&cb=737120594&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55571639&ephemeral=1&filename=adobe_flash_player.exe&cb=-242928215&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55523294&ephemeral=1&filename=adobe_flash_player.exe&cb=1237256538&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55700245&ephemeral=1&filename=adobe_flash_player.exe&cb=-743163899&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55572669&ephemeral=1&filename=adobe_flash_player.exe&cb=-392063093&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55317593&ephemeral=1&filename=adobe_flash_player.exe&cb=-1916838952&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55310378&ephemeral=1&filename=adobe_flash_player.exe&cb=1099015598&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55519100&ephemeral=1&filename=adobe_flash_player.exe&cb=1764089957&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55400753&ephemeral=1&filename=adobe_flash_player.exe&cb=866955828&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55606854&ephemeral=1&filename=adobe_flash_player.exe&cb=653911729&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55669593&ephemeral=1&filename=adobe_flash_player.exe&cb=1753250519&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55671205&ephemeral=1&filename=adobe_flash_player.exe&cb=1086197328&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55429621&ephemeral=1&filename=adobe_flash_player.exe&cb=-1380398852&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

http://intva31.sitememory.info/dl-pure/1202331/.../?bc=1202331&checksum=55674442&ephemeral=1&filename=adobe_flash_player.exe&cb=-1282335126&hashstring=Yasfasdcvasdasdas&usefilename=true&executableroutePath=1203371&stub=true

Latest 30 of 32 download URLs

Remove adobe_flash_player-55179017.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.