home

adobeflashplayer.exe

Installer

OOO ELEKTRO-KOD

The application adobeflashplayer.exe by OOO ELEKTRO-KOD has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from keyupgrade.newupdater4u.xyz and multiple other hosts. While running, it connects to the Internet address www.ibbalance.com on port 443.
Publisher:
OOO ELEKTRO-KOD  (signed and verified)

Product:
Installer

Version:
1.0.0.1

MD5:
19196b1be7dc0cf7e68ad78cfa8fdfc7

SHA-1:
690347a55cf15bba7e6ba987c34722a1dc19266f

SHA-256:
2f78cb7c484619f5f404b1b4ce888788fee6dd8e0e624e6576238b031faaae0d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/15/2024 9:42:53 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OOOELEKT.Installer (M)
16.6.24.22

File size:
107.6 KB (110,144 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2016

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobeflashplayer.exe

Digital Signature
Signed by:
OOO ELEKTRO-KOD

Authority:
COMODO CA Limited

Valid from:
4/15/2016 3:00:00 AM

Valid to:
4/16/2017 2:59:59 AM

Subject:
CN=OOO ELEKTRO-KOD, O=OOO ELEKTRO-KOD, STREET="ul. Ibragimova, d. 35 str. 2 Pom I Komn 14", L=Moscow, S=Moscow, PostalCode=109428, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
2EC7061CBC4E49BEE7F530967BE4F7BC

File PE Metadata
Compilation timestamp:
6/23/2016 1:03:18 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
80.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:XCsJvxS+G6b/5kz1LbI9u2wdAvwu6b9YA:XCEcny/5wbQuNAvwu49

Entry address:
0x125AE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 03, 00, 00, 00, 30, 00, 00, 80, 0E, 00, 00, 00, 20, 01, 00, 80, 10, 00, 00, 00, 50, 01, 00, 80, 18, 00, 00, 00, 80, 01...
 
[+]

Entropy:
6.6002

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
65.5 KB (67,072 bytes)

The file adobeflashplayer.exe has been seen being distributed by the following 6 URLs.

http://keyupgrade.newupdater4u.xyz/dl.php?fds=0ZK6LYwE9Q89ZaLgS0HdFWuVwpKYydTITyVX2MxrCbo.&cid=25055929241466784470&conversion_id=14667844733944&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=aNyT6-KUGdtWUfxr9Tjc3vdQrGVWumIQEXYdCFfiHCk.&lpp=*-*-*

http://freemaintenance.safe-video4u.xyz/dl.php?pcl=lgBmcgAlhYEs7goK81CIRLbj4o9gkYhtthY6E3MLwiw.&cid=857897411466684274&conversion_id=14666842762354&app_id=4&lp_id=954&v=tribat&stub_id=305&v_id=rFq7VasUq0vVD5lCOzfFli1DiV6M_TaL5yOGgy0b644.&lpp=*-*-*

http://freemaintenance.safe-video4u.xyz/dl.php?pcl=GGPQhunJg1746w2gOUPJhIaN3udhlKrMd6zR0S-ik_E.&cid=14303249441466683471&conversion_id=14666834729153&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=2XLScNI_MjvwQMFz-wld8ALtgh51PAfIB2DzEfU_TT8.&lpp=*-*-*

http://update4now.secure-updates.site/dl.php?rtyru=S4uNCVdZc7Y5SRsOfssmpG_G93cOBz-H7RVyhtTnxxs.&cid=31040193011466774514&conversion_id=14667745205337&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=sNeg6ZI8cpbvc8zZPY0dyx9O1VXz_TE_bT9No82vWFM.&lpp=*-*-*

http://update4now.secure-updates.site/dl.php?rtyru=RmukkuNC2r8uJlSVUpNwF4mmWT4ez4F4NnW8Lg1mtXs.&cid=29536461021466778329&conversion_id=14667783329918&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=WwanLCdPosgzS_9Yr6ZjgNFWZ1fIpniepaU8A8eO6Ak.&lpp=No match

http://keyupgrade.newupdater4u.xyz/dl.php?fds=GGPQhunJg1746w2gOUPJhIaN3udhlKrMd6zR0S-ik_E.&cid=7796420331466784458&conversion_id=14667844623458&app_id=4&lp_id=1561&v=tribat&stub_id=305&v_id=nXjADRESmNxnmZBVsUKp3KY-aKfBIpSmL68_TNgG3mY.&lpp=*-*-*

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

TCP (HTTP):
Connects to stats-182385724-1591972470.us-east-1.elb.amazonaws.com  (54.221.252.69:80)

Remove adobeflashplayer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.