home

flash_player_setup.exe

flash setup

Digital Zones

The executable flash_player_setup.exe has been detected as malware by 3 anti-virus scanners. The file has been seen being downloaded from readynewsoft.noteupgrade.online and multiple other hosts.
Publisher:
Digital Zones  (signed and verified)

Product:
flash setup

Version:
1.0.0.0

MD5:
be949673ed2c5394be15ab6b24662ff9

SHA-1:
05d671ff6e69c5d9329028f48eb0d9fc17b0b4fa

SHA-256:
a98b7374212a3c5b563c8ac06e4011d0b916fb3276a0be56415b93d97171cfec

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
11/1/2024 9:31:58 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
MSIL/TrojanDownloader.Adload.AZ trojan
8.0.319.0

F-Secure
Variant.MSILPerseus.30942
5.15.21

Norman
Gen:Variant.MSILPerseus.30942
02.04.2016 17:35:19

File size:
117.4 KB (120,264 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
Flash.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flash_player_setup.exe

Digital Signature
Signed by:
Digital Zones

Authority:
COMODO CA Limited

Valid from:
3/27/2016 5:00:00 PM

Valid to:
3/28/2017 4:59:59 PM

Subject:
CN=Digital Zones, OU=Digital Zone, O=Digital Zones, STREET="ul. Akademika Koroleva, d. 9 korp. 5", L=Moscow, S=Moscow, PostalCode=129515, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
07775D7C7B8C20E915DD534EA4F8DB84

File PE Metadata
Compilation timestamp:
5/9/2016 11:57:29 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:H3xgXPx1AUtPwF1A4hVsqbmDb3zTBuMZAn6FB6nri:Hu/r/tPwF1A4hVsqbQbPMMZ+6FB6

Entry address:
0xC58E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.7336

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
41.5 KB (42,496 bytes)

The file flash_player_setup.exe has been seen being distributed by the following 14 URLs.

http://readynewsoft.noteupgrade.online/dl.php?gyte=CLewqHlWIIChBaR_iGisoxGg9pB7VpPKRIflToz1LAU.&subid=VjJ8MTgxOHwyODQ3MzV8NTcyMzJ8MTQ2MzExNTA0MXxhMzZmMjc5OS00OWM1LTRkNTEtY2Q3Mi03NzdhMmRkNTk5ZDZ8NjguMzcuMTI5LjQ1fHw0fDlhMWI0ZjI2M2Q2N2Q4ZThlM2E4NmZiMTg1OWQ2ZjAy&conversion_id=14631178656985&app_id=4&lp_id=1401&v=tribat&stub_id=305&v_id=bidOTBxEmRWYcM6ZZKr_1ik0__L5Xwm_dKV5BbNh9kw.&lpp=*-*-*

http://readynewsoft.noteupgrade.online/dl.php?gyte=CLewqHlWIIChBaR_iGisoxGg9pB7VpPKRIflToz1LAU.&subid=VjJ8MjI0NTc4NnwyODQ3NDV8NzQ1MzZ8MTQ2MzEyNTUxMXw0YmMwNTc4OC1lMzZlLTRkOWEtY2Q1Ny00MDUxZmNhY2FmM2V8OTkuMTAyLjE2MS40MXx8Nnw5YTFiNGYyNjNkNjdkOGU4ZTNhODZmYjE4NTlkNmYwMg==&conversion_id=14631257147267&app_id=4&lp_id=1389&v=tribat&stub_id=305&v_id=-0taO7AtMwIaw0fB19MZpQsr-LEjph0wZztPMaHrVQs.&lpp=*-*-*

http://newtest4pc.ready4newsoft.tech/dl.php?dfrtge=PVRRifnJ9E2m-OjcEUGk3djT51mXacklv4k_sXopRq0.&sub=235803&cid=5174833000&conversion_id=14631250276964&app_id=4&lp_id=1315&v=tribat&stub_id=305&v_id=6RjCqZ_8WbcwdbQGf_CEH3w7sMJxCaBIfzwGLcap9_M.&lpp=w10*-*-*

http://24upgrade.freeinstallsoft.xyz/dl.php?sdfgg=9esj4dWjCSiqP8SxWmRpeoyfP2UMcCr020S1UAiOIhA.&sub=235800&cid=5182845243&conversion_id=14631727465209&app_id=4&lp_id=1315&v=tribat&stub_id=305&v_id=1LgmvFnUIdxbFWEnbTVyrk3RduEetYUML5OOR35S8Xw.&lpp=w10*-*-*

http://2nowup.ad4softinstall.website/dl.php?njbsc=qU3Z7XUlfImHuT1FQ4EPPqG1uIwy8JoStrTO-HH4cqA.&cid=1463152474mb71158601913&conversion_id=14631524759561&app_id=4&lp_id=1590&v=tribat&stub_id=305&v_id=v4E4VziRa32JynOP_tAV94ReuTtiRhDLqPJ7cBaWOLE.&lpp=*-*-*

http://alwaysnewsoft.noteupgrade.download/dl.php?ftygr=i3tCnE120uiRPGos8JmbRCR_GKOWydR8OoYMObPkBtY.&cid=10915&sid=102669bb139e40207ef615f42ad199&conversion_id=14631458929763&app_id=63&lp_id=1391&v=tribat&stub_id=305&v_id=0I--I9F6d7_jZEje5Ymt7fitVfccXbDKSVd64gLz9pI.&lpp=*-*-*

http://2nowup.ad4softinstall.website/dl.php?njbsc=qU3Z7XUlfImHuT1FQ4EPPqG1uIwy8JoStrTO-HH4cqA.&cid=1463147616mb30182957667&conversion_id=14631476182078&app_id=4&lp_id=1590&v=tribat&stub_id=305&v_id=9d5WU9TaEbQlh02kIKw2C2n2ejN4e1kynHXSTY2_Pc8.&lpp=*-*-*

http://readynewsoft.noteupgrade.online/dl.php?gyte=PYkNL5sAbbSY2HkOPtV-iwf0byznXlsU9d4ffMIl7dA.&cid=649db22b13ba3450393e2ee4bf665465-8148&sub=359&conversion_id=14631195243431&app_id=10&lp_id=1327&v=tribat&stub_id=305&v_id=vY0xxglWES77aBxCE_EeXK0kFnZD-OjUaWHvafQmsig.&lpp=w*-ch*-*

http://2nowup.ad4softinstall.website/dl.php?njbsc=1SITLpyxaicxO5PUMWVMxn1yxX_V1-7O1yOLk055PpE.&cid=4135020411463128721&conversion_id=14631287247552&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=sOLjd8sh5ARWI7w0fl39AbPWLYuMMzvJL68dimiy1Sc.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?tberb=J_VieM58x-A3QYETNvmZCqQYkJP3H7sdjueMIEDyUdQ.&cid=14594232051463158672&conversion_id=14631586736315&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=HCvGUcRr-VPxI8u0PqkmslWhzbo9fEgn8BuEWhfv7_g.&lpp=*-*-*

http://update.soft2download.website/dl.php?sgcd=a_gSS9xv_Aslbm_nX5Gm1lXQEGpCKel6dN-uoSQuQzE.&cid=1461958297mb98479399428&sid=[SUB_ID]&conversion_id=14619583109829&app_id=129&lp_id=1543&v=tribat&stub_id=305&v_id=ULXivjDxVhQZM_69bmatLiuNaSFsqB1LCpFvG1Z1MxA.&lpp=*-*-*

http://24upgrade.freeinstallsoft.xyz/dl.php?sdfgg=ww0ZyS3LXwXbcfAyYDv7Oa6aYcM6SogE5Pl-haYHK6c.&cid=[CLICK_ID]&sub=[3]&conversion_id=14631760536723&app_id=4&lp_id=1606&v=tribat&stub_id=305&v_id=g1wPsKyrYKgHcQ0MbNSFJ2ibb0y5o-fk1ABivakJKug.&lpp=*-*-*

http://setting4upgrade.nowinstallupgrade.online/dl.php?gther=m-Q-alLt-9hzD_xbAEyPOyjkhoxzWM-p655Er9S2Qj0.&cid=P23P8R4631475567803232152&sub=3224&conversion_id=14631475494052&app_id=4&lp_id=1526&v=tribat&stub_id=305&v_id=uS6on2b_gYkNLWvZ9Byb6sZWHDyn2lgsxkHZDbsNlrc.&lpp=*-*-*

http://setting4upgrade.nowinstallupgrade.online/dl.php?gther=Fgpsb5_0EEq9XI_O0QViPaSKgkibIftbZv3o0I39ENI.&cid=P23P6R4631296799511538622&sub=4175&conversion_id=14631296689806&app_id=63&lp_id=1427&v=tribat&stub_id=305&v_id=W31glCBf0yNlFOlHHKYqWaBPByfm5ecU6-Q1qeb-yZo.&lpp=*-*-*

Remove flash_player_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.