home

adobe_flash_player-61755391_-61755391.exe

Fast Professional Software Installer

The executable adobe_flash_player-61755391_-61755391.exe has been detected as malware by 3 anti-virus scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from intva31.procedureconnect.info and multiple other hosts.
Publisher:
Fast Professional Software Installer

Product:
Fast Professional Software Installer

Version:
66.0.6.8726

MD5:
535065e108ee696a4283e7bc180af9d6

SHA-1:
1a9957c573e5fe6f243fca33c6582fb9b32c36d0

SHA-256:
7567599844e1dd2d198146ff6bf88b9a2aa014c5b72d50d4ae28b917f725fa5f

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
12/26/2024 11:37:22 AM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Gen:Variant.Symmi.58865
16.07.01

F-Secure
Variant.Symmi.58865
5.15.96

Norman
Gen:Variant.Symmi.58865
19.05.2016 01:04:49

File size:
1.1 MB (1,105,920 bytes)

Product version:
66.0.6.8726

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\adobe_flash_player-61755391_-61755391.exe

File PE Metadata
Compilation timestamp:
7/27/2015 4:12:10 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:VGR/tgrmYGZd8L7gVOyd7R65vMPbS72Q0K:oykdIh5kPbS72Q

Entry address:
0x47F8

Entry point:
E8, 83, DC, 07, 00, E9, 91, D0, 07, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 4C, 24, 04, 33, C0, 39, 44, 24, 08, BA, FE, FF, FF, FF, 0F, 95, C0, 2B, D0, 8B, 41, 14, 89, 50, 04, 83, 41, 14, 08, 8B, 41, 14, 3B, 41, 18, 72, 05, E9, D5, 65, 00, 00, C3, CC, CC, CC, CC, 56, 8B, 74, 24, 08, 8B, 46, 08, 8B, 48, 14, 3B, 48, 18, 72, 07, 8B, CE, E8, 09, 7A, 00, 00, 8B, 44, 24, 0C, 8D, 54, 24, 10, 52, 50, 56, E8, 09, D3, 00, 00, 83, C4, 0C, 5E, C3, CC, CC, CC, CC, E8, 1B, 3F, 02, 00, 85, C0, 75...
 
[+]

Entropy:
7.4790

Code size:
524 KB (536,576 bytes)

The file adobe_flash_player-61755391_-61755391.exe has been seen being distributed by the following 3 URLs.

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0305&hashstring=ap0305&signature_id=0&_action_=getbin&filename=adobe_flash_player-70060715.exe&checksum=97664

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=2ap0302&hashstring=2ap0302&signature_id=0&_action_=getbin&filename=adobe_flash_player-66294083.exe&checksum=124753

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=jb31216&hashstring=jb31216&signature_id=0&_action_=getbin&filename=adobe_flash_player-81205871.exe&checksum=111365

Remove adobe_flash_player-61755391_-61755391.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.