» flash.exe
Overview
Analysis
File Details
Downloads (20)

flash.exe

The application flash.exe has been detected as a potentially unwanted program by 13 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from q5hu7hmdm9.adddveer.com and multiple other hosts.

File name:

flash.exe

MD5:

b2e283b11802cdc5a9b59359889e1dd1

SHA-1:

f02c07bd6b1f3afbac6b528503c5ac9cdea513ab

SHA-256:

4f3f2f087d0cd779517d459c82220dec16a028ddf5abcd86003a7cca692e261d

Scanner detections:

13 / 68

Status:

Potentially unwanted

Analysis date:

11/25/2024 3:43:07 AM UTC (today)

Scan engine

Detection

Engine version

Baidu Antivirus

Trojan.JS.Clicker

4.0.3.14625

ESET NOD32

JS/TrojanClicker.Agent.NFJ.Gen

8.9964

Fortinet FortiGate

Adware/Coupons

10/2/2014

Kaspersky

not-a-virus:AdWare.Win32.Coupons

14.0.0.3165

McAfee

RDN/Generic PUP.x!chb

5600.6990

Qihoo 360 Security

HEUR/Malware.QVM06.Gen

1.0.0.1015

Quick Heal

AdWare.Coupons.r5 (Not a Virus)

10.14.14.00

Rising Antivirus

PE:Trojan.Win32.Generic.16E8F60B!384366091

23.00.65.14930

Sophos

Generic PUA PA

4.98

SUPERAntiSpyware

Trojan.Agent/Gen-Injector

10522

Trend Micro House Call

TROJ_GEN.R0CBC0PGE14

7.2.275

Trend Micro

TROJ_GEN.R0CBC0PGE14

10.465.02

VIPRE Antivirus

Trojan.Win32.Clicker

30426

File size:

86.9 KB (89,008 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\flash.exe

File PE Metadata

Compilation timestamp:

12/6/2009 6:50:52 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

1536:apgpHzb9dZVX9fHMvG0D3XJ8MnrUrocWek0XR/bxD/YjDhuWEMxC1Lo477spb/Y1:YgXdZt9P6D3XJ8MnraxI0XdFCFuWM1Lh

Entry address:

0x30FA

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.6204

Packer / compiler:

Nullsoft install system v2.x

Code size:

23.5 KB (24,064 bytes)

The file flash.exe has been seen being distributed by the following 20 URLs.

http://q5hu7hmdm9.adddveer.com/.../xz.php?ii=ejk1NU4zMjhsMzJQNDEzQTg2OEIzNjk=&id=22&a=51169&l=xh

http://mbt4jpjjkixcwir.adddveer.com/.../xz.php?ii=czc1NFY1NDNzNjU4RzI0OFg3MjNQMzgy&id=22&a=41213&l=xh

http://uiuvpttij.adddveer.com/.../xz.php?ii=ZDY1NVc3NjB5OTE3TDg0NEg1NDBaNTEw&id=22&a=41213&l=xh

http://4kpglixie8z2o.adddveer.com/.../xz.php?ii=cTI2OVcxNTBzNzA0VTgyM0Y0MDZPNjE1&id=22&a=41213&l=xh

http://pryqiexksg1o4z.adddveer.com/.../xz.php?ii=bjQzOEcxODRrMzk3VTg2Mks3NzNBMzUy&id=22&a=35859&l=xh

http://dp0wciqij4eiu1myv.adddveer.com/.../xz.php?ii=cDc4NkkyMTh6ODk0UzcxNFUxNzBZMjk0&id=22&a=41213&l=xh

http://r9skfv6u.adddveer.com/.../xz.php?ii=Yzg2MVIxNDFrMTQ1VDk0MlY2MzVFNDk1&id=22&a=41213&l=xh

http://akd4rlawnsawt0.adddveer.com/.../xz.php?ii=bDcyN1k1NzdpNDIxUjk2NFAxNjRNNg==&id=22&a=41213&l=xh

http://mzhjm8hofasggm6a.adddveer.com/.../xz.php?ii=aTgwNlc2MjdxNjU1QjM5NEU4M1g3NzI=&id=22&a=41213&l=xh

http://jte28ekqd1.adddveer.com/.../xz.php?ii=Zjg3N041OTRiNDU4QzE4Mkc4NThDMzUz&id=22&a=41213&l=xh

http://142fbj3j00jy2z.adddveer.com/.../xz.php?ii=bzg5M1M2MnE3ODVOODA0SjQ4OUoyNDU=&id=22&a=41213&l=xh

http://eqhbtbxlp.adddveer.com/.../xz.php?ii=aDk5OE43NDd2OTMxSjg4RTIxNEc0MDM=&id=22&a=41213&l=xh

http://txpilkhuvabv.adddveer.com/.../xz.php?ii=dDgyM1o3MDdiOTI4Rzk1OVE1NjJSNzkz&id=22&a=41213&l=xh

http://9vklyzfk2z.adddveer.com/.../xz.php?ii=ZzE4M0s3MzNnMjQzVDEwMkgzNjhEODk=&id=22&a=41213&l=xh

http://trmacctcr.adddveer.com/.../xz.php?ii=Zzg5OVQ1NTJqMTI1STk0NFc2MDhHMjcx&id=22&a=41213&l=xh

https://doc-0g-7k-docs.googleusercontent.com/docs/securesc/adulcd07grmsdlqdu5d1d46pr1s6o6r3/g441pp5l703f9h0bjtugtjbigv59ic54/1403445600000/10462124777546911848/.../0B-FHAiRn2jUqaFRvc1NNcWNMSzA?e=download&h=16653014193614665626&nonce=3v0qdcp567o28&user=13423738212551072860&hash=qq95u01crdaf0qmblh1vm9nsulh16757

https://docs.google.com/nonceSigner?nonce=3v0qdcp567o28&continue=https://doc-0g-7k-docs.googleusercontent.com/docs/securesc/adulcd07grmsdlqdu5d1d46pr1s6o6r3/g441pp5l703f9h0bjtugtjbigv59ic54/1403445600000/10462124777546911848/.../0B-FHAiRn2jUqaFRvc1NNcWNMSzA?e=download&h=16653014193614665626&hash=bkm66mm877t0f4lgvs3n3a5fmu21sdva

https://docs.google.com/uc?id=0B-FHAiRn2jUqaFRvc1NNcWNMSzA&export=download

http://edy6d5lrrohts9qxsq.adddveer.com/.../xz.php?ii=YTcyMU0zNDZzNjI3QjIxNFY4OTJTMjUx&id=22&a=41213&l=xh

Remove flash.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.