home

adobe_flash_player-66094101.exe

KPI Media Group

The application adobe_flash_player-66094101.exe by KPI Media Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from intva31.platformuser.info and multiple other hosts.
Publisher:
KPI Media Group  (signed and verified)

MD5:
f4f72f15436ac6474490da732ece6f59

SHA-1:
51dbdf5ad2430217bc23357dc6fe8a9b329834ab

SHA-256:
fb03308759d5623c844b44a54a2dedfaa857ef894f50d8b004267dcd6bdb7caf

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 11:36:10 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.DownloadAdmin.KPIMediaGroup.Meta (M)
16.3.3.20

File size:
94.3 KB (96,512 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_flash_player-66094101.exe

Digital Signature
Signed by:
KPI Media Group

Authority:
GoDaddy.com, Inc.

Valid from:
12/8/2015 11:34:38 PM

Valid to:
12/8/2016 11:34:38 PM

Subject:
CN=KPI Media Group, O=KPI Media Group, L=" Oakland ", S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
5E43099D2166479B

File PE Metadata
Compilation timestamp:
2/8/2016 9:45:34 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
1536:3avIn5zCdzdMwdvCDggKwe2kYERFNcu8Ww1BsWjcdNkVzGZtBNFRJX:hJQbIqweXH8juNqzGZtpP

Entry address:
0x2E1D

Entry point:
E8, FC, 41, 00, 00, E9, 7F, FE, FF, FF, 55, 8B, EC, FF, 15, A4, F0, 40, 00, 6A, 01, A3, C4, 64, 41, 00, E8, 49, 47, 00, 00, FF, 75, 08, E8, DE, 46, 00, 00, 83, 3D, C4, 64, 41, 00, 00, 59, 59, 75, 08, 6A, 01, E8, 2F, 47, 00, 00, 59, 68, 09, 04, 00, C0, E8, AC, 46, 00, 00, 59, 5D, C3, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 6A, 17, E8, 9C, BF, 00, 00, 85, C0, 74, 05, 6A, 02, 59, CD, 29, A3, A8, 62, 41, 00, 89, 0D, A4, 62, 41, 00, 89, 15, A0, 62, 41, 00, 89, 1D, 9C, 62, 41, 00, 89, 35, 98, 62, 41, 00, 89, 3D, 94...
 
[+]

Entropy:
6.4909

Code size:
56 KB (57,344 bytes)

The file adobe_flash_player-66094101.exe has been seen being distributed by the following 49 URLs.

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66495767&filename=adobe_flash_player.exe&cb=-403854940&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67903569&filename=adobe_flash_player.exe&cb=-1370126390&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67586253&filename=adobe_flash_player.exe&cb=-39155040&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67142263&filename=adobe_flash_player.exe&cb=2005784225&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68378929&filename=adobe_flash_player.exe&cb=-1665110098&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66646153&filename=adobe_flash_player.exe&cb=-593769626&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=68096017&filename=adobe_flash_player.exe&cb=-414083430&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67317709&filename=adobe_flash_player.exe&cb=-13721956&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68330767&filename=adobe_flash_player.exe&cb=-506453192&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68188469&filename=adobe_flash_player.exe&cb=-919230557&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67364915&filename=java_runtime_enviroment_setup.exe&cb=-1229086538&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67828337&filename=adobe_flash_player.exe&cb=456806187&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67358771&filename=adobe_flash_player.exe&cb=-2095399388&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66952277&filename=adobe_flash_player.exe&cb=966408325&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66633903&filename=adobe_flash_player.exe&cb=-2031499569&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67870403&filename=java_runtime_enviroment_setup.exe&cb=854400559&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66388973&filename=adobe_flash_player.exe&cb=149239478&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67730911&filename=adobe_flash_player.exe&cb=673788040&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68179105&filename=adobe_flash_player.exe&cb=278659376&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66899473&filename=adobe_flash_player.exe&cb=354468685&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68136215&filename=adobe_flash_player.exe&cb=1229371723&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67589247&filename=adobe_flash_player.exe&cb=-1248517146&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67346193&filename=adobe_flash_player.exe&cb=-1235892097&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67688565&filename=adobe_flash_player.exe&cb=1929036378&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=66133023&filename=adobe_flash_player.exe&cb=1129104553&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=68092945&filename=adobe_flash_player.exe&cb=1502833524&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68223673&filename=adobe_flash_player.exe&cb=220802920&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67627537&filename=adobe_flash_player.exe&cb=636288737&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.platformuser.info/dl-pure/1200543/.../?bc=1200543&checksum=67730441&filename=adobe_flash_player.exe&cb=-289909628&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

http://intva31.computingclass.info/dl-pure/1200543/.../?bc=1200543&checksum=68207579&filename=adobe_flash_player.exe&cb=367569853&hashstring=2ap0302&usefilename=true&executableroutePath=1200375&stub=true

Latest 30 of 49 download URLs

Remove adobe_flash_player-66094101.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.