home

adobe_flashplayer.exe

Installer

Digital Zones

The application adobe_flashplayer.exe by Digital Zones has been detected as a potentially unwanted program by 2 anti-malware scanners. The file has been seen being downloaded from testpc24.software2upgarde.xyz. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
Digital Zones  (signed and verified)

Product:
Installer

Version:
1.0.0.0

MD5:
0ff63a81a4d17458c42f9fd947d92084

SHA-1:
3e162eff8928e4ad174bfcf4845839aba3212e4f

SHA-256:
6a096b16ddd9e582d43a3c041dad992b54de9528b65fcbd4be8e8048c97c4e27

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 1:12:14 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
MSIL/Adware.Testing24.B application
8.0.319.0

Reason Heuristics
PUP.DigitalZ.Installer (M)
16.5.28.22

File size:
667.6 KB (683,672 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2015

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\adobe_flashplayer.exe

Digital Signature
Signed by:
Digital Zones

Authority:
COMODO CA Limited

Valid from:
3/27/2016 8:00:00 PM

Valid to:
3/28/2017 7:59:59 PM

Subject:
CN=Digital Zones, OU=Digital Zone, O=Digital Zones, STREET="ul. Akademika Koroleva, d. 9 korp. 5", L=Moscow, S=Moscow, PostalCode=129515, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
07775D7C7B8C20E915DD534EA4F8DB84

File PE Metadata
Compilation timestamp:
5/5/2016 4:07:13 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
12288:mxW3r807/FdAioDpjzD3dNymfycVOr2lmnR8veDYmxVi35KxaFSUcXyoJvGCr00N:KWwaoDNmsw2QDxEI

Entry address:
0xA4ECE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.0127

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
652 KB (667,648 bytes)

The file adobe_flashplayer.exe has been seen being distributed by the following URL.

http://testpc24.software2upgarde.xyz/ehJybGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9/eyifaWQJOjQuOTIzNDQyODc3MjQ4MTIyZSsxOCwiX20iOiIxIiwiX3FwIjoieF9tY2lkPWlfNTcyYmYxYTkxMTU0ZVx1MDAyNnhfbWN1cmw9aHR0cCUzQSUyRiUyRjU0Ljg4LjI0Ni40MiIsIl9zZXIiOjE0NjI0Njk3MzAsIl90IjpmYWxzZSwiX3RpZCI6IjM0YzExMzIyLThkYmQtNDg2OS1hMWNjLTZmODY3MzkyYTk3NC0zIiwiX3VhaCI6Ijc1MTExNzM2MDczOTYwMzY1MTIiLCJfeGluIjoiYWRvYmVfZmxhc2hwbGF5ZXIuZXhlIiwiX3hpcCI6IjY4LjkuNTEuNDEiLCJhaWQiOiI2IiwiZGVidWdlcnIiOiIxIiwiZXhwIjoyLjE0NzQ4MzY0OGUrMDksImgiOiJ0ZXN0cGMyNC5zb2Z0d2FyZTJ1cGdhcmRlLnh5eiIsImgwIjoicG9ydGFsLXNhZmUubmV0IiwibmciOjMsInJlIjoxNDYyNTg0MTA1LCJyZXQiOjkwMCwicnQiOjEuNDYyNDk3NzA1ZSswOSwicyI6IjIwMTUwOTIzNiIsInNlYyI6IjFhM2QzZjk5Y2UxYzEwMGZiN2ZhZmNjZTVhMzNjYTRkIn0/.../download

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove adobe_flashplayer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.