home

adobe_flash_player-61729116.exe

Zen Bros Media

The application adobe_flash_player-61729116.exe by Zen Bros Media has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from intva31.sitecyber.info and multiple other hosts.
Publisher:
Zen Bros Media  (signed and verified)

MD5:
fc115c8f1fc0017e7e7d5b013014f857

SHA-1:
19ddbf58273ea149068999eedae4304fc4aac324

SHA-256:
5c30f1b107a16eb815fde3ed031763e86edcb1bda9acca36b8eea8514ab50b41

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 9:28:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.DownloadAdmin.ZenBrosM (M)
16.6.16.5

File size:
429.3 KB (439,560 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\adobe_flash_player-61729116.exe

Digital Signature
Signed by:
Zen Bros Media

Authority:
GoDaddy.com, Inc.

Valid from:
3/8/2016 2:12:43 PM

Valid to:
3/8/2017 2:12:43 PM

Subject:
CN=Zen Bros Media, O=Zen Bros Media, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00DA69A0BD854BB554

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
12288:6zxKdS7vd/x3z+NiqIJQ3I11NWkeytTkUMnm0ZMhojG:6lKdSbPj+NiqIJQ3I110keoTkUMnmYMn

Entry address:
0x4D830

Entry point:
C6, 05, 70, E2, 44, 00, 00, B9, 00, 10, 46, 00, BA, 04, 10, 46, 00, B8, B0, 07, 45, 00, E8, 65, FF, FF, FF, E8, 70, FF, FF, FF, B8, 90, 07, 45, 00, E8, C6, 39, FC, FF, C3, 00, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.4620

Code size:
306.1 KB (313,456 bytes)

The file adobe_flash_player-61729116.exe has been seen being distributed by the following 20 URLs.

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61862722&ephemeral=1&filename=adobe_flash_player.exe&cb=-353320540&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=62078074&ephemeral=1&filename=adobe_flash_player.exe&cb=-1882151884&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61787891&ephemeral=1&filename=adobe_flash_player.exe&cb=582527754&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=62040301&ephemeral=1&filename=adobe_flash_player.exe&cb=1062828673&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61899107&ephemeral=1&filename=adobe_flash_player.exe&cb=-623613056&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61814909&ephemeral=1&filename=adobe_flash_player.exe&cb=856050563&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61867784&ephemeral=1&filename=adobe_flash_player.exe&cb=-1493353505&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61823322&ephemeral=1&filename=adobe_flash_player.exe&cb=-774044930&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61944046&ephemeral=1&filename=adobe_flash_player.exe&cb=-2007378263&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=62060708&ephemeral=1&filename=adobe_flash_player.exe&cb=-1087530935&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61860138&ephemeral=1&filename=adobe_flash_player.exe&cb=1461337229&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61988001&ephemeral=1&filename=adobe_flash_player.exe&cb=1791237835&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=62085248&ephemeral=1&filename=adobe_flash_player.exe&cb=1391302875&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61847556&ephemeral=1&filename=adobe_flash_player.exe&cb=1223106507&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61907076&ephemeral=1&filename=adobe_flash_player.exe&cb=-2082962721&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61789943&ephemeral=1&filename=adobe_flash_player.exe&cb=-779866502&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61734335&ephemeral=1&filename=adobe_flash_player.exe&cb=1009745807&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61779794&ephemeral=1&filename=adobe_flash_player.exe&cb=-1492171035&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61873673&ephemeral=1&filename=adobe_flash_player.exe&cb=-1096351134&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

http://intva31.sitecyber.info/dl-pure/1202331/.../?bc=1202331&checksum=61744802&ephemeral=1&filename=adobe_flash_player.exe&cb=-33136908&hashstring=REaXFfJj67fi&usefilename=true&executableroutePath=1203525&stub=true

Remove adobe_flash_player-61729116.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.