home

flash_player_installer.exe

WindowsFormsApplication1

The executable flash_player_installer.exe has been detected as malware by 28 anti-virus scanners. The file has been seen being downloaded from flget.com and multiple other hosts.
Product:
WindowsFormsApplication1

Version:
1.0.0.0

MD5:
71f8f9a169b5f879776d455d243bdf63

SHA-1:
cbb7cde2996d9738755aa63d8b5eb1c1a184fc47

SHA-256:
a10dc671a3eb6d8dffdc1dad69d0febda9ab174ed9a72fdb5bae8523f6c534f0

Scanner detections:
28 / 68

Status:
Malware

Analysis date:
11/27/2024 11:36:09 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.8412233
352

Avira AntiVirus
TR/Drop.Chextad.A
7.11.213.58

avast!
Win32:Trojan-gen
2014.9-160218

AVG
Dropper.Small
2017.0.2830

Baidu Antivirus
Trojan.MSIL.Chextad
4.0.3.16218

Bitdefender
Trojan.Generic.8412233
1.0.20.245

Comodo Security
UnclassifiedMalware
21273

Emsisoft Anti-Malware
Trojan.Generic.8412233
8.16.02.18.10

ESET NOD32
MSIL/TrojanDropper.Small
10.11259

Fortinet FortiGate
W32/Chextad.W!tr
2/18/2016

F-Secure
Trojan.Generic.8412233
11.2016-18-02_5

G Data
Trojan.Generic.8412233
16.2.25

IKARUS anti.virus
Trojan.Win32.Webprefix
t3scan.1.8.6.0

K7 AntiVirus
Trojan
13.200.15136

Kaspersky
Trojan-Dropper.MSIL.Chextad
14.0.0.643

McAfee
Artemis!71F8F9A169B5
5600.6486

Microsoft Security Essentials
TrojanDropper:MSIL/Chextad.A
1.1.11400.0

MicroWorld eScan
Trojan.Generic.8412233
17.0.0.147

NANO AntiVirus
Trojan.Win32.Chextad.bedyms
0.30.0.296

Norman
Troj_Generic.GCZMM
11.20160218

nProtect
Trojan.Generic.8412233
15.03.03.01

Panda Antivirus
Generic Malware
16.02.18.10

Qihoo 360 Security
Malware.Radar01.Gen
1.0.0.1015

Rising Antivirus
PE:Trojan.Win32.Generic.13E3224D!333652557
23.00.65.16216

Sophos
Mal/Generic-L
4.98

Vba32 AntiVirus
TScope.Trojan.MSIL
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
38068

Zillya! Antivirus
Dropper.Chextad.Win32.1
2.0.0.2088

File size:
18 KB (18,432 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2012

Original file name:
WindowsFormsApplication1.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flash_player_installer.exe

File PE Metadata
Compilation timestamp:
11/23/2012 10:47:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
384:+7LqdLuLkL+LuiCLnL4Pl9BwZgVKIdqMeQ5a0V0KgkCzYcHe+m:qOqolLSl9BwZXIdqMTaK0KgRzYcHe+m

Entry address:
0x54AE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
4.6691

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
13.5 KB (13,824 bytes)

The file flash_player_installer.exe has been seen being distributed by the following 2 URLs.

http://flget.com/get.php?c=cl9yZWY9aHR0cDovL3d3dy5zaGVtYWxlY2FmZS5uZXQvO2Zyb209c2hlbWFsZWNhZmUubmV0O2xmcm9tPXNoZW1hbGVjYWZlLm5ldDtpZGNoZWNrPTEzNTYwMDg3MzY7dnM9c2hlbWFsZWNhZmUubmV0fDtpbmRleF9wYWdlPTE7SHN0Q2ZhMjAzODg4Mz0xMzU2MDA4NzQyMjYyO0hzdENtdTIwMzg4ODM9MTM1NjAwODc0MjI2MjtjX3JlZl8yMDM4ODgzPWh0dHA6Ly93d3cuc2hlbWFsZWNhZmUubmV0Lzt0bz18dXJsO2xhc3RfdXJsPWNvbnRlbnQ7SHN0Q2xhMjAzODg4Mz0xMzU2MDA4NzYyMzEwO0hzdFBuMjAzODg4Mz0yO0hzdFB0MjAzODg4Mz0yO0hzdENudjIwMzg4ODM9MTtIc3RDbnMyMDM4ODgzPTE7TUxSVl83MjAzODg4Mz0xMzU2MDA4NzYyNjQ2O01MUjcyMDM4ODgzPTEzNTYwMDg3NDcwMDA7cm90X2luPTE7&id=2

http://flget.com/get.php?c=cl9yZWY9aHR0cDovL3d3dy5zaGVtYWxlY2FmZS5uZXQvO2Zyb209c2hlbWFsZWNhZmUubmV0O2xmcm9tPXNoZW1hbGVjYWZlLm5ldDtpZGNoZWNrPTEzNTYwMDg3MzY7dnM9c2hlbWFsZWNhZmUubmV0fDtpbmRleF9wYWdlPTE7cm90X2luPTE7SHN0Q2ZhMjAzODg4Mz0xMzU2MDA4NzQyMjYyO0hzdENsYTIwMzg4ODM9MTM1NjAwODc0MjI2MjtIc3RDbXUyMDM4ODgzPTEzNTYwMDg3NDIyNjI7SHN0UG4yMDM4ODgzPTE7SHN0UHQyMDM4ODgzPTE7SHN0Q252MjAzODg4Mz0xO0hzdENuczIwMzg4ODM9MTtjX3JlZl8yMDM4ODgzPWh0dHA6Ly93d3cuc2hlbWFsZWNhZmUubmV0LztNTFJWXzcyMDM4ODgzPTEzNTYwMDg3NDg2MzE7TUxSNzIwMzg4ODM9MTM1NjAwODc0NzAwMDs=&id=2

Remove flash_player_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.