home

do_application_start.exe

Kpi Media Group

The application do_application_start.exe has been detected as a potentially unwanted program by 2 anti-malware scanners. This is a setup program which is used to install the application. The file has been seen being downloaded from intva31.procedureconnect.info and multiple other hosts.
Publisher:
Kpi Media Group

Product:
Kpi Media Group

Version:
83.0.1.1579

MD5:
5805ce06e7928b66ce2c3ddd48767c06

SHA-1:
ab11f44f3112d1f88465b77b84201bc7fef7f40a

SHA-256:
d543ab13f46cbb70f0edb5773cc691c412a64fc793a4137b2552f1888194e575

Scanner detections:
2 / 68

Status:
Potentially unwanted

Analysis date:
11/24/2024 6:23:54 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/DownloadAdmin.Q potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.DownloadAdmin.Installer
16.3.9.13

File size:
884.7 KB (905,952 bytes)

Product version:
83.0.1.1579

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\do_application_start.exe

File PE Metadata
Compilation timestamp:
3/11/2015 7:31:08 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:4rhxBQYWkl63YxbtlOZIjay9FOCh0JIyQvQE+6:4d9l6tZIjTIxdQvu6

Entry address:
0x4FD6

Entry point:
E8, 15, 93, 00, 00, E9, 17, 8C, 00, 00, FF, 25, D0, 34, 48, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, FC, 34, 48, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, A8, 34, 48, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 84, 34, 48, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, 60, 34, 48, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, FF, 25, CC, 33, 48, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 57, 8B, 7C, 24, 08, B8, 84, 9A, 47, 00, E8, 01, 5C, 00, 00, A1, 2C, 9A, 47, 00, 50, 57...
 
[+]

Entropy:
7.9656  (probably packed)

Code size:
56.5 KB (57,856 bytes)

The file do_application_start.exe has been seen being distributed by the following 50 URLs.

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78914337.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-76218299.exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-79902313.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-76746991 (1).exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78854591.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78113693.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78084445.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=mediaplayer_update-76118987.exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-77546211.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78322489.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78179261.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78086397.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=jb31216&hashstring=jb31216&signature_id=0&_action_=getbin&filename=adobe_flash_player-80118191_2.exe&checksum=111365

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-76303565.exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-79114739.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-77990205.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78045355.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-76491415 (1).exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=2ap0306&hashstring=2ap0306&signature_id=0&_action_=getbin&filename=adobe_flash_player-75425353.exe&checksum=161004

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=2ap0306&hashstring=2ap0306&signature_id=0&_action_=getbin&filename=adobe_flash_player-75367433.exe&checksum=161004

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78713481 (1).exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-76571413 (1).exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=jb31216&hashstring=jb31216&signature_id=0&_action_=getbin&filename=adobe_flash_player-80094823.exe&checksum=111365

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-78834653 (3).exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-77738209.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=jb31216&hashstring=jb31216&signature_id=0&_action_=getbin&filename=adobe_flash_player-80108069 (1).exe&checksum=111365

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-79140271.exe&checksum=161495

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-77138251(1).exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0309&hashstring=ap0309&signature_id=0&_action_=getbin&filename=adobe_flash_player-77261241.exe&checksum=124546

http://intva31.procedureconnect.info/dl-pure?usefilename=true&hashstring=ap0310&hashstring=ap0310&signature_id=0&_action_=getbin&filename=adobe_flash_player-77736727.exe&checksum=161495

Latest 30 of 498 download URLs

Remove do_application_start.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.