home

flash_player_setup.exe

flash setup

OOO Kod Intertainment

The application flash_player_setup.exe by OOO Kod Intertainment has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from doc-0g-3g-docs.googleusercontent.com and multiple other hosts.
Publisher:
OOO Kod Intertainment  (signed and verified)

Product:
flash setup

Version:
1.0.0.0

MD5:
0bc7e9d31aaabe31bcad32fdc828dd0c

SHA-1:
95d1643e791395f2a44973d187d22e6f87a76b67

SHA-256:
3d656ee758d0d9016f98303ac0e8ee9965154efe0edcbc01cfbe93c71981cbcb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/26/2024 3:39:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.OOOKodIn.Installer (M)
16.5.7.20

File size:
144.6 KB (148,080 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
Flash.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flash_player_setup.exe

Digital Signature
Signed by:
OOO Kod Intertainment

Authority:
COMODO CA Limited

Valid from:
5/19/2015 5:00:00 PM

Valid to:
5/19/2016 4:59:59 PM

Subject:
CN=OOO Kod Intertainment, OU=Application Pool Update, O=OOO Kod Intertainment, STREET="per. Sukharevski M., d. 9 str. 1 of. 36", L=Moscow, S=Moscow, PostalCode=127051, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
7A6FDC0F2D8E213EC782BFD34D9EE9D4

File PE Metadata
Compilation timestamp:
5/4/2016 4:49:55 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:714w5YXcmgXtOb0RK+IoD2222222222222R6FiJP:7h5nmg0bN+lD2222222222222gFi

Entry address:
0xC67E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
4.8477

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
42 KB (43,008 bytes)

The file flash_player_setup.exe has been seen being distributed by the following 5 URLs.

https://doc-0g-3g-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/lqu85en2s5uu99st2q2tkvlbhul04ba8/1462651200000/09034358203482314548/.../0B_TQrhMzXRYlSFlNM2xnNlpGcEE?e=download

http://update.set4freeupdates.site/dl.php?frgcwec=YTmiD1vEemt9awKI3TMY4oYRuLuOxbFwDlf1_6sa-i8.&cid=6339794521462653185&pubid=1066247&conversion_id=14626531872496&app_id=4&lp_id=1262&v=tribat&stub_id=305&v_id=PnywLg7zIf2n7j32RzwPSIERQaA7wM_8UAdEVpom8XA.&lpp=*-*-*

http://get24update.soft2update.online/dl.php?vhtd=Ng4WtNxhGPEQZdqC1dWAshWscO8dCXLx14dzm1z-R-E.&cid=189420687542&sid=10802&conversion_id=14626517604860&app_id=4&lp_id=1609&v=tribat&stub_id=305&v_id=OvE5iea7soe1IPBU29qTntW5nD3PNncKtdWDv4dXyoQ.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?tberb=E8AeT_i_eNx1fVDaFVIiw5vdn2LPPK_lhvVy7iBWfEw.&cid=MzAwNyMxMjEwMiM5NzIjMjA2NjZ8MjgyMzU1fEJSfDN8MXx8fHw&conversion_id=14626524736592&app_id=4&lp_id=1661&v=tribat&stub_id=305&v_id=Mykh017Myzn5ni5Ks2SI98lLhMyNrCO8mgoWZAakdjA.&lpp=*-*-*

http://checkupdate.whensoftworks.tech/dl.php?ctwewc=NCDF8u0WEbGG-U9QxWeNOwcEx_mBd6Fw5z6oPgN5AXA.&s2=1147291084.472953.1519b5f3b6.8036.109a6da2f1a3f2624aa470a25483828d&conversion_id=14626521687478&app_id=4&lp_id=1454&v=tribat&stub_id=305&v_id=2v1XW_B3ihMqgoJQHkk6WdBiZu6Q77_jBkaUyFY14JM.&lpp=w10*-*-*

Remove flash_player_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.