home

adobe_flash_player.exe

Astalavista

The application adobe_flash_player.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The file has been seen being downloaded from netapp.cool-4free.top.
Publisher:
Astalavista

Description:
Download Manager

Version:
1.3.2.1

MD5:
c5cddd5e7451a37d4cf3d151157039de

SHA-1:
20f317571cdeebb4eee16f4ff5bf6083e9f47fbd

SHA-256:
2ca84a705d7fd02d1fd1db27785fb763994896fe321572398f3481b8efde476a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/26/2024 10:19:31 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Bundler.Astalavi.Meta (M)
16.4.29.8

File size:
110.7 KB (113,328 bytes)

Product version:
1.3.2.1

Copyright:
Copyright © 2015

Original file name:
PreInstaller.NET.exe

File type:
Executable application (Win32 EXE)

File PE Metadata
Compilation timestamp:
3/28/2016 7:28:39 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
48.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:CGmCnGai20nEkGM/0zrH2JTcPc8FbV1KodIkkYtc:xfWE7hHH2JTcPc8Fbmoju

Entry address:
0x197FE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
94.5 KB (96,768 bytes)

The file adobe_flash_player.exe has been seen being distributed by the following URL.

http://netapp.cool-4free.top/dl.php?fecwc=DnpSQdqzYfx_s_FrbE3AwGPmsTozys2PoBW_Y66P_HI.&cid=JtCB8xTyJ6ffylNbme_B6FQPXp2JFUffr72mzpMud_m_CZ4WF4QDstTvA7RpRpdyzb-yZ0IGoj5R-4r-BH2keg41nAHOlxtf-Le8xryJ2mWBGjPgXW9PvSa6k4E5Bg6e4iCDV3juDKXI4bbhbs-D3tZ4an4uy4MYGGA9CxWa13wr7dPJD4odfuP7S-ZuQFMkQXVAlNDEF6_OjLV9ZoEj_OsFHGVgBAowI1AmIArRqfDEQAENJFboT_nMsZOQRpmwyCo2su_9cRBsT41ZUt8OxDdlzjXt0Fqwpzk8LeEWm24P03kJmbvP5l3s4hrlaB9HrA2a9EekdzXzet02-8Ix1HTvCEA80PDeV1N9FOWLpmVZ-gxyW0xF93g66Xtdae66Jf7dUXv9xVRvUBuWoSEWqsb0bwfRBTDdQaSTeQNSht4rRwF9j-l3SPewRBP0y8LUNbg6FFJVt31k0OSnojXPuzbL3vdJt9GCYBlfB4jPgHKkXF4d4SUkjA7CBH89mQsAvUu8IhUQlDSoonC_jjc0noCsVQHdiC04bAxSTg&sid=[SUB_ID]&conversion_id=14599742575765&app_id=4&lp_id=1543&v=coin&stub_id=285&v_id=zoKEQ6re3Q53601YcK6jinXqDZhPV4ThMlZtFUCR0Z8.&lpp=*-*-*

Remove adobe_flash_player.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.