home

adobe_reader_10_1_free_downloader__3687_i1443234774_il1543166.exe

The application adobe_reader_10_1_free_downloader__3687_i1443234774_il1543166.exe has been detected as a potentially unwanted program by 3 anti-malware scanners. The file has been seen being downloaded from www.coralbells-download.com.
MD5:
a38760301254be09cbd8c575f32fccb1

SHA-1:
2918536cb9dc11646649ab0a43bf4d371533cc2f

SHA-256:
002abe3b6c5d2ed297fd34d85e4142af023c1b42db31274606d7326645957170

Scanner detections:
3 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 6:35:24 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Adware BundleApp.AJM
2015.0.4568

Dr.Web
Trojan.Adfltnet.71
9.0.1.05190

Reason Heuristics
Adware.Bundler (M)
16.5.22.0

File size:
103.3 KB (105,815 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_reader_10_1_free_downloader__3687_i1443234774_il1543166.exe

File PE Metadata
Compilation timestamp:
1/5/2015 9:54:45 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
1536:MMjVXDkmE7zAao6o5mBLeI7bMXdkI/EgGciJBSf7FGQROgCBKixfScpO:s7sRf5mBiMVciJBK7FGkXC3fScpO

Entry address:
0x12458

Entry point:
E8, 9B, 4B, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, 3D, 04, 2F, 3B, 00, 00, 75, 18, E8, 79, 35, 00, 00, 6A, 1E, E8, C3, 33, 00, 00, 68, FF, 00, 00, 00, E8, F0, F8, FF, FF, 59, 59, 8B, 45, 08, 85, C0, 75, 01, 40, 50, 6A, 00, FF, 35, 04, 2F, 3B, 00, FF, 15, C8, B0, 3A, 00, 5D, C3, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 04, 2F, 3B, 00, 00, 75, 18, E8, 2F, 35, 00, 00, 6A, 1E, E8, 79, 33, 00, 00, 68, FF, 00, 00, 00, E8, A6, F8, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3...
 
[+]

Entropy:
6.5319

Code size:
166.5 KB (170,496 bytes)

The file adobe_reader_10_1_free_downloader__3687_i1443234774_il1543166.exe has been seen being distributed by the following URL.

http://www.coralbells-download.com/tdownload.php?s1=a65c028be621b3fd7cb3e5ba9bd214bec46c481e&t1=1420807394&version=1.1.5.26&campid=3687&instid[appname]=Adobe Reader 10 1 Free Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1328525879.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Adobe Reader 10 1 Free Downloader&instid[interrupted]=http://.../?cancel&ti1=1328525879&instid[thankyoupage]=http://.../?success

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.