home

adobe_flash_setup.exe

flash setup

OOO ELEKTRO-KOD

The application adobe_flash_setup.exe by OOO ELEKTRO-KOD has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from update.soft2download.tech and multiple other hosts.
Publisher:
OOO ELEKTRO-KOD  (signed and verified)

Product:
flash setup

Version:
1.0.0.0

MD5:
fe4c5fb6c3192c4dd23202e512ee18e1

SHA-1:
fc6fb42e84abecdfc0d0cca41831df0da13cc697

SHA-256:
d478a165d02a6d2ca7c8dac5447aa33c88d3f633460e9665d6a6525dc9ce232c

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/25/2024 1:35:21 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OOOELEKT.Installer (M)
16.4.26.6

File size:
187.1 KB (191,552 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
Flash.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\Documents and Settings\{user}\My documents\downloads\adobe_flash_setup.exe

Digital Signature
Signed by:
OOO ELEKTRO-KOD

Authority:
COMODO CA Limited

Valid from:
7/6/2015 12:00:00 AM

Valid to:
7/5/2016 11:59:59 PM

Subject:
CN=OOO ELEKTRO-KOD, O=OOO ELEKTRO-KOD, STREET="ul. Ibragimova, d. 35 str. 2 Pom I Komn 14", L=Moscow, S=Moscow, PostalCode=109428, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
705F063CA94054E944AA5E217181FF04

File PE Metadata
Compilation timestamp:
4/16/2016 10:38:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:3Xc8Eufojifsq2eWEXQjb4tMUeTkHHRAzQ4IbLHhxy/jJdurUh1T/WLwA6Fs:RoGUq2eWEQbjQUQ7hxyLur+YMF

Entry address:
0xC2CE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.3778

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
41 KB (41,984 bytes)

The file adobe_flash_setup.exe has been seen being distributed by the following 32 URLs.

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in1fbv80bqiheoisqbxk&subid=2279&conversion_id=14616556249363&app_id=4&lp_id=1518&v=tribat&stub_id=305&v_id=r-zI8GKkIWNEQ23qLIBhG8O1CQxNDH5DvCneSzku2UM.&lpp=w10*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in1gfdy44gpfuu1ewruu&subid=2279&conversion_id=14616553947041&app_id=4&lp_id=1401&v=tribat&stub_id=305&v_id=7Q-qFCj5LwN81lp5lsNN3q48f6RDdNM0kT6YkKgOthk.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=V6ggtPSfPBnjgGPLPRg1F8RvkCX3npdk8pUvwP5LaCY.&cid=29878425491461660252&conversion_id=14616602538150&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=YSzju-094fFjKEF-LfmyAVL9Bci-AcVJ-uZgfbMoRS4.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=zo1y2Xi9PFo46XICdALWKY7Iv7iHEX4a2b2o8JXIESo.&cid=31055878441461681423&conversion_id=14616814244882&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=gSPjLMAGXZ9a4Tm_rgzeokw-Q3HoRIFcTOqhZ_je-Ao.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=3gyYySmOGJCgnf420qkn-OeEVGZVRlkn9f3J8QO71iA.&cid=14085136821461660699&conversion_id=14616607020211&app_id=4&lp_id=1594&v=tribat&stub_id=305&v_id=Z5N4x_8Hsh6p51uek1wyDAQPkI2eJoY47ZeN_z1gTRE.&lpp=*-*-*

http://newalways.software-zone.website/dl.php?cfyd=mwK9xqzoV7CJFZFuMzUljhhSqRfSzOS0OjpXu8EpXWQ.&cid=MTA5MHw1MjEyfElOfDN8MXwxMTc2MDg2fGN6SnoqT0RNMU56QTNPVGN4TVRRMk1UWTFNalEzTVF-YzI5MWNtTmwqTVRFM05qQTROZ3x8&conversion_id=14616524762842&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=yZ4TxXcaEpWSaxSKKqQ80700IRS1uOKhhPgcXkO_2SI.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=zo1y2Xi9PFo46XICdALWKY7Iv7iHEX4a2b2o8JXIESo.&cid=30008680831461675487&conversion_id=14616754896148&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=O2c5htRNh4X7JQwOI9ct-fnk-ocLpif2Vlypt7TzSMU.&lpp=*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in188bk8cc70pe2no32j&subid=2279&conversion_id=14616519775418&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=2UTkJgljw-CgOSkumUDzcjFl5AapV_lvJCoe3d2hc8s.&lpp=*-*-*

http://update.soft2download.tech/dl.php?vytew=BJWqvfdDsM3VVNs94zyiNvV0FsGZrdTJG2UwUp5pnpI.&cid=VjJ8MzA2MjJ8MjgzOTIwfDU3MjMyfDE0NjE2NTcwMzB8YzJlYzNmY2EtZTZiZi00M2IxLWMzODgtOGVlMjhmNzUyZmIxfDEwMy40OC4xMTEuMTI1fHwyfDhlMmFjNjQzMzhkMzc2NzRmZDAxZjliODE0NmVlZmNl&sub=2006&conversion_id=14616570324326&app_id=4&lp_id=1515&v=tribat&stub_id=305&v_id=4qM_oB0_Xat5t8EbEyMbYwq42TU1ynoP0SB_HnONvnE.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=E8AeT_i_eNx1fVDaFVIiw5vdn2LPPK_lhvVy7iBWfEw.&cid=MzAwNyMxMjEwMiM5NzIjMTAxMnwyODI1MjJ8R1R8M3wxfHxaWEJ0WVdSelgzZHBaSFJvKk16SXd-WTJnKn5kSG8qTFRZflkyeHBZMnMqfmRHRnlTV1EqWlhCdFlXUnpMVEZqTnpRNVpXVXdZV0l5TkRrNVpUQmxNMlZpWm1Zd1pHTTNPRGMzTWpKakxUTXdNSGd5TlRBflpYQnRZV1J6WDJobGFXZG9kQSpOVEF-Y21WeGRXVnpkRkpsWmcqYUhSMGNEb3ZMM2QzZHk1aFkyOXlkR0Z5TG0xbEx3fmRBKk1UUTJNVFkzTnpReE9USTRNUX5kZypNUX5jbVZ4ZFdWemRGVnliQSphSFIwY0RvdkwzZDNkeTR5YzJoaGNtVmtMbU52YlM5bWFXeGxMems0YWxSa2NXMWhMMHRCVGpFMU1UUXdVQzVvZEcxc35abXhoYzJoV1pYSSpNakV1TUNCeU1BfmMyTnlWMmxrZEdnKk1UTTJOZ35ZMGxrY3cqfllXUnpRMkZ0Y0dGcFoyNUxaWGsqTVRRMk1UWTNOek00T0RZNE5RfmEyVjUqTVdNM05EbGxaVEJoWWpJME9UbGxNR1V6WldKbVpqQmtZemM0TnpjeU1tTX5jMk55U0dWcFoyaDAqTnpZNHx8&conversion_id=14616774658450&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=XzTYCceOtw_4TMHrbyftZfUBVT6MdubP9VfMDRXq3XA.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=HBfZBqmjvShSyN8T7B6GF4EWeDXqP2-LqaW3Zz-EIQc.&cid=4625222011461675156&conversion_id=14616751627258&app_id=4&lp_id=1600&v=tribat&stub_id=305&v_id=7EKH8j9-lwF_K8B6cb5lQJg1wU-wy9mtc2ErnJlLjTY.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=zfhHF5uIJPwUCaQYl1z7-xUZ2Mfj7SDh7iR5biCspo8.&cid=13002075091461657064&conversion_id=14616570668744&app_id=4&lp_id=954&v=tribat&stub_id=305&v_id=jpgR8IhOrRpZ_hx4pFhlgHU-MlzP2kQPMCxeLZxgQSI.&lpp=*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in1olcnmkjzi0vtp04rc&subid=2279&conversion_id=14616641799548&app_id=4&lp_id=1389&v=tribat&stub_id=305&v_id=9dybJCJTAYgwL0tqnwy4sLA1Ac1KERpCrki3vipfF2Y.&lpp=*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in1w8c1aeje4dczacjdd&subid=2279&conversion_id=14616542541343&app_id=4&lp_id=1389&v=tribat&stub_id=305&v_id=YfHj1vYyV3TJcdaU1GhUQQYvDJTfqLpJkUPA7T461FY.&lpp=*-*-*

http://update.soft2download.tech/dl.php?vytew=BJWqvfdDsM3VVNs94zyiNvV0FsGZrdTJG2UwUp5pnpI.&cid=VjJ8MzA2MjJ8MjgzOTIwfDQwMTE5MXwxNDYxNjU2MDMzfGYxMzAwOWFjLWRlYTItNDEyOC1jMTdmLWJjM2JkMWI1YmQ2N3wxMDMuNDIuOTAuMTB8fDR8OGUyYWM2NDMzOGQzNzY3NGZkMDFmOWI4MTQ2ZWVmY2U=&sub=2006&conversion_id=14616560443827&app_id=4&lp_id=1526&v=tribat&stub_id=305&v_id=30PmdUBRI7L2pMWEk5m_nuVEjg4ltQgbeyblNBwG4n8.&lpp=*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in1bybfto1wf46c8d54m&subid=2279&conversion_id=14616532102492&app_id=4&lp_id=1590&v=tribat&stub_id=305&v_id=pVmsrO627MS_lZsfoJS2vE-T9I6XF1skWcyJVYATw7o.&lpp=w10*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in16eckut3ft6fi3fxb6&subid=2279&conversion_id=14616820136853&app_id=4&lp_id=1389&v=tribat&stub_id=305&v_id=tp_KP_BtREqTX3Z_cmSEHwDjcBj0GJjl_x-5QsI1QZ4.&lpp=*-*-*

http://set2updatenow.preparedupdate.xyz/dl.php?tgher=FOxpjjPbb5uWJF4egS_a5iOG8oqZgkc60zinEq__lyo.&cid=P23P10R4616741769014331009&sub=3903&conversion_id=14616741811735&app_id=4&lp_id=1175&v=tribat&stub_id=305&v_id=HcNEbDiNr18Pt4zoDG2EoIv734zlfCgJTk4wDJFNONQ.&lpp=w10*-*-*

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=in1d6dfczdee6dahi4m8&subid=2279&conversion_id=14616743199375&app_id=4&lp_id=1518&v=tribat&stub_id=305&v_id=HStD7E0zuf7kFON1jkytufSOQjWxCbc6Rj_G8Mbb_FU.&lpp=w10*-*-*

http://update.soft2download.online/dl.php?sdgb=ixCD18FVNFrzvqXPojRYqImzd7RCg-m6oRQWVazMq3E.&subid=VjJ8MTgxOHwyNzI4NTh8NDAxMTkxfDE0NjE2NjA3NDZ8MGM2OGI2ZWItMGJlMC00YWRlLWNhMjQtMDBjY2RiZDk3ZTRjfDE1Ni4xOTguMTguMjl8fDF8N2I4NmRhNDFkNjI5MDAwNWQ3N2RhY2MwNDdiNjQyM2I=&conversion_id=14616613517901&app_id=4&lp_id=1401&v=tribat&stub_id=305&v_id=ZMFC__GYAnXLiLPIW2kXU20rTxhGc2C7UorafmEwR8M.&lpp=No match

http://update2.whensoftworks.site/dl.php?hdgjfv=zfhHF5uIJPwUCaQYl1z7-xUZ2Mfj7SDh7iR5biCspo8.&cid=33127161121461659287&conversion_id=14616592892280&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=SnWwmJJ2Tfdu3SasJhAANacL4NieVdEgM1VBIRRYxyA.&lpp=*-*-*

http://nowsetup.freesearch4u.xyz/dl.php?xved=ixCD18FVNFrzvqXPojRYqImzd7RCg-m6oRQWVazMq3E.&subid=VjJ8MTgxOHwyNzI4NTh8MzI1MDc0fDE0NjE3MjAwMTB8MzBiMTgyNTEtMmVkZS00OWU2LWM5NmMtYTVmMTY4MTI4MzE2fDE5Ny4zOS4xNTcuMTQ3fHwxfDdiODZkYTQxZDYyOTAwMDVkNzdkYWNjMDQ3YjY0MjNi&conversion_id=14617200357039&app_id=4&lp_id=1526&v=tribat&stub_id=305&v_id=7M2Hmj-9ldocW3Zoabb_XLhY0CoVR8bjdOD77zmucZM.&lpp=w10*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=HBfZBqmjvShSyN8T7B6GF4EWeDXqP2-LqaW3Zz-EIQc.&cid=7123663061461653336&conversion_id=14616533409492&app_id=4&lp_id=1594&v=tribat&stub_id=305&v_id=-AsUyrv2u-2z7oUD1F8wdtczdu0pjpHonz3PfmT46-w.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=3gyYySmOGJCgnf420qkn-OeEVGZVRlkn9f3J8QO71iA.&cid=13494078521461654852&conversion_id=14616548542678&app_id=4&lp_id=1594&v=tribat&stub_id=305&v_id=8XngcgxWV26SvpZFfWQ2CISGFNY26pnwYpRw5Jt7VTM.&lpp=*-*-*

http://nowsetup.freesearch4u.xyz/dl.php?sfsfh=ixCD18FVNFrzvqXPojRYqImzd7RCg-m6oRQWVazMq3E.&subid=VjJ8NzY4OTZ8MjgzMjU4fDQwMTE5MXwxNDYxNjcyNDcwfDBlY2M2NzUyLTdkZWItNGExOS1jYTdlLTQ5NWE5NzA3NmM3NnwxNzcuOTkuMTk4LjIxNHx8MnxjMGM1Yjg5YzBmYzBhZmRjMTU1NjdlMWQ0NWE3NTdkZA==&conversion_id=14616725651204&app_id=4&lp_id=1401&v=tribat&stub_id=305&v_id=b6dpdhPYU6VvSBKUSoG753PB2gz-tLb4C1IzObW3u0A.&lpp=No match

http://update.soft2download.tech/dl.php?vytew=44qzaB45lQGnw9sT1vTWQ1UsYo5-Lqz2FRZIQMEZkuk.&cid=eu18pdubfacdk6qqboef&subid=2279&conversion_id=14616610757482&app_id=4&lp_id=1518&v=tribat&stub_id=305&v_id=K_ruQihguQBsjpK3cb-se6YUBiXdGg4yF7YYsO4253k.&lpp=w10*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=qU3Z7XUlfImHuT1FQ4EPPqG1uIwy8JoStrTO-HH4cqA.&cid=1461677383mb56766533745&conversion_id=14616773838499&app_id=129&lp_id=1590&v=tribat&stub_id=305&v_id=VsmeNFUyU4DektUYEBGt17JQRwsZYm_cCBaQ4L9lars.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?hdgjfv=qU3Z7XUlfImHuT1FQ4EPPqG1uIwy8JoStrTO-HH4cqA.&cid=1461655217mb94374497649&conversion_id=14616552183976&app_id=4&lp_id=1590&v=tribat&stub_id=305&v_id=9UP50rzbgq6B3kLWHEOLbu4C126LTTpdc-BRI5WwEjg.&lpp=*-*-*

http://set2updatenow.preparedupdate.xyz/dl.php?tgher=uAs7iFL2gKnFOz6ueOYC8usb1XB2lQtDS9oOfaSS97k.&cid=adkm_6fP2U8_ZfGUjXihdiU9KZU9TjP-hZYO8t9OzGFm2O6mUHrtVU2fYWhU69Qay_cP_SVnhDDu-fk65N4tsyYXSrtDzUuPOw9MHhS4cE99n7I_Q1sWUhOGGghmmXoAQeeupycdr8hWrVmfkrbutqRrDEAEWlWXvNjeTm0Z9yZQyq5QLD4ts-59A3UCkjunC5xsyYL4xu8HPK8PqSfui4esCeJyxsmAR2pt8oGtIn3CeYxVVA8Ebq6BWIfmQKByAEaBTAFEJ1ecAm1LaiBVgs8niY5PlCEP_Dy2gviTvcS1fzYKYS2CtI15PeTAEGP46iJUlRTT46A3mVpAj4DKKolx0BzgVNBh833Veo6hwCcdtkexgeL8mxfDi4JBIn67oevqAQfrC3DVxPEDT4r4VtyjRNoJ9Za2nNe-F8ejauYiuODCMmlWk9agV0I6QHyROwem7KKc9_fvQxLTSdWra1vHsadh54AQN_4-rJMJxGcj3wDhG2-uKlw&sid=70678102&qs1=559&conversion_id=14616590356618&app_id=4&lp_id=1593&v=tribat&stub_id=305&v_id=UY5FvkdNDLNrRy_GpjdC5NFIWS5bvmDXKqVy-Un9Ms4.&lpp=w10*-*-*

http://newalways.software-zone.website/dl.php?cfyd=Iu5sv4NYl_zlgN93nmUm2GAAg-MzAOgMZUlagyP7ABQ.&cid=MTA1MXw1MjA1fElOfDN8MXx8Y3pKeipTazFETVRFMU1sOXNPRkpDTXpSUFZEWnFMVkJqTkVaQ1dFZDJVRnBEfHw&conversion_id=14616634410379&app_id=4&lp_id=1600&v=tribat&stub_id=305&v_id=HZ0Jyeub_JBLwWfE3y4bh2FP8jzK57D2eEZyL6Hq_34.&lpp=*-*-*

Latest 30 of 32 download URLs

Remove adobe_flash_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.