home

flash.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from 9bbgxscrcoaseoip.adddveer.com and multiple other hosts.
MD5:
d1e0f7128fdb880e69c269ea038d8441

SHA-1:
f134baa4cfbc6ae64b274b1ebec41821c935c8b1

SHA-256:
60c7da4226e21ae296032992dfd6b26db8324224e82a10b4107c1777423bf4a2

Scanner detections:
3 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/27/2024 1:47:32 AM UTC  (today)

Scan engine
Detection
Engine version

Qihoo 360 Security
HEUR/Malware.QVM06.Gen
1.0.0.1015

Trend Micro House Call
Suspicious_GEN.F47V0805
7.2.222

VIPRE Antivirus
Trojan.Win32.Generic
32066

File size:
809.5 KB (828,973 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\flash.exe

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:S2Xawb+wbIZ3kl7XlcPuztAv12UD0lpQ88:taKlbAUtlTCN5I2

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9878

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file flash.exe has been seen being distributed by the following 29 URLs.

http://9bbgxscrcoaseoip.adddveer.com/.../xz.php?ii=aDM1OEYyNzN2MzYxVzYxOVk2MjBXOTQ5&id=22&a=41213&l=xh

http://40tnuwxku.adddveer.com/.../xz.php?ii=eDYzNEIxMXY4NzBEOTQ5WjQ2MVU0&id=22&a=52500&l=xh

http://u7dzihix.adddveer.com/.../xz.php?ii=bzk3MEYzODd4NzQyUTg2TjQ5OEU3OTU=&id=22&a=41213&l=xh

http://q4fxpzyvze9afqr.adddveer.com/.../xz.php?ii=ejUyNk83NTV2MzcxRTYxOVo4ODlINzIy&id=22&a=41213&l=xh

http://l6g99efvkrtkg.adddveer.com/.../xz.php?ii=dDk5M1Y3ODhkMTQ3UzMxOFM1MTZTODgw&id=22&a=41213&l=xh

http://gqhtaainhejsstqy.adddveer.com/.../xz.php?ii=cDY4N1EzeTQyOUM3NDVRODY5TTQxNw==&id=22&a=35787&l=xh

http://knfgdlw5dq.adddveer.com/.../xz.php?ii=czY4M1g2NDFyNDMwQTcxOUg2MDdOMzY1&id=22&a=41213&l=xh

http://pn6vgznevoodoq.adddveer.com/.../xz.php?ii=bTk0NFo3NTJ5OTU5TDMxMlY3OTlENzMy&id=22&a=41213&l=xh

http://srto2ebjg.adddveer.com/.../xz.php?ii=dDI2N044NDl2MTMwWDcyMEwzNTVaMzc3&id=22&a=20618&l=xh

http://wyxqfk7bvhuj.adddveer.com/.../xz.php?ii=djc3N00zMjh6MTE1Ujg4OUs3MTlQMzI0&id=22&a=20575&l=xh

http://l4pxadiw485ajq.adddveer.com/.../xz.php?ii=ZDM2N1M0NjFsMzY2QjlSNzYwVTQxMA==&id=22&a=41213&l=xh

http://kzt4sxwtpaqfut0.adddveer.com/.../xz.php?ii=bTcwOFg1MjlqNDA4TzU4NFg3NjFMMTU3&id=22&a=47272&l=xh

https://doc-0g-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/8fqv172rhbpfsaoafok8hdvogih7udfv/1407866400000/10462124777546911848/.../0B-FHAiRn2jUqZHlVbVV5a1B5REU?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B-FHAiRn2jUqZHlVbVV5a1B5REU&export=download

https://doc-10-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/kuthlg5oq4gbkdhnf6i1kvtihqlitkhs/1407686400000/10462124777546911848/.../0B-FHAiRn2jUqbW52ZEVOcFRLZjA?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B-FHAiRn2jUqbW52ZEVOcFRLZjA&export=download

http://nfdb6fed0trjaz8tc.adddveer.com/.../xz.php?ii=dzgzMlQzMzNjN0UwQTg3Nkg5Mg==&id=22&a=41213&l=xh

https://doc-0s-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/k7pjho5h5683vapn43lq3ioh78es69d6/1407542400000/10462124777546911848/.../0B-FHAiRn2jUqQjQ1cS1EVmhsU0E?h=16653014193614665626&e=download

http://5p4ztared.adddveer.com/.../xz.php?ii=dTk2M0g3MHo2NTRJNDkyQTg4N0EzMTA=&id=22&a=41213&l=xh

http://pjhkekrqswpn9lkgx.adddveer.com/.../xz.php?ii=bzcxNlM0OThyMTgwQzkzMFc3NDNWNDQw&id=22&a=41213&l=xh

https://doc-10-0s-docs.googleusercontent.com/docs/securesc/4qsptifn2jkqt596alib49nmm44grh0h/gbukso9l1uhi22jlq4og8f71gp83j2dj/1407535200000/10462124777546911848/.../0B-FHAiRn2jUqU211b0xIX09LSFE?e=download&h=16653014193614665626&nonce=bri9ehsrgd188&user=17383838377795902861&hash=0imb3ldrl41c4n475snp4asnlpdaqkkt

https://docs.google.com/nonceSigner?nonce=bri9ehsrgd188&continue=https://doc-10-0s-docs.googleusercontent.com/docs/securesc/4qsptifn2jkqt596alib49nmm44grh0h/gbukso9l1uhi22jlq4og8f71gp83j2dj/1407535200000/10462124777546911848/.../0B-FHAiRn2jUqU211b0xIX09LSFE?e=download&h=16653014193614665626&hash=mr9idbivtgqn08k0h8d2bhmsnrq83hr6

https://doc-10-0s-docs.googleusercontent.com/docs/securesc/4qsptifn2jkqt596alib49nmm44grh0h/gbukso9l1uhi22jlq4og8f71gp83j2dj/1407535200000/10462124777546911848/.../0B-FHAiRn2jUqU211b0xIX09LSFE?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B-FHAiRn2jUqU211b0xIX09LSFE&export=download

http://tzyljdmr.adddveer.com/.../xz.php?ii=eTI3OVI2OTZjMTY5SDY2MlYyMTZRNTk=&id=22&a=41213&l=xh

https://doc-0s-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/6irrmo99ogco2t1l2caljkbsltcernpf/1407664800000/10462124777546911848/.../0B-FHAiRn2jUqQjQ1cS1EVmhsU0E?h=16653014193614665626&e=download

https://docs.google.com/uc?id=0B-FHAiRn2jUqQjQ1cS1EVmhsU0E&export=download

http://dyiabuwxsvhnlhbctx.adddveer.com/.../xz.php?ii=cDU5VTMzNWk1NzJaNzAzUTI4MUIzMDQ=&id=22&a=41213&l=xh

http://jeglmy2tvsdupt.adddveer.com/.../xz.php?ii=YTYwM1o5N285TDYyMUIzMFQ3NjY=&id=22&a=41213&l=xh

Scan flash.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.