home

flash_player_setup.exe

flash setup

Digital Zones

The executable flash_player_setup.exe has been detected as malware by 3 anti-virus scanners. The file has been seen being downloaded from now.software-buddy.site and multiple other hosts.
Publisher:
Digital Zones  (signed and verified)

Product:
flash setup

Version:
1.0.0.0

MD5:
d8a5937bf642e80a73c8c05737c2b77e

SHA-1:
d03b491097f520a22aedad1e4d458e8d238dd65c

SHA-256:
c8313527d18638841af8757e16cf16355a9ada0938fd2b3567c532ee5836a690

Scanner detections:
3 / 68

Status:
Malware

Analysis date:
11/25/2024 2:35:00 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
MSIL/TrojanDownloader.Adload.AZ trojan
8.0.319.0

F-Secure
Variant.MSILPerseus.30942
5.15.96

Norman
Gen:Variant.MSILPerseus.30942
02.04.2016 17:35:19

File size:
117.4 KB (120,264 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
Flash.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flash_player_setup.exe

Digital Signature
Signed by:
Digital Zones

Authority:
COMODO CA Limited

Valid from:
3/27/2016 7:00:00 PM

Valid to:
3/28/2017 6:59:59 PM

Subject:
CN=Digital Zones, OU=Digital Zone, O=Digital Zones, STREET="ul. Akademika Koroleva, d. 9 korp. 5", L=Moscow, S=Moscow, PostalCode=129515, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
07775D7C7B8C20E915DD534EA4F8DB84

File PE Metadata
Compilation timestamp:
5/10/2016 1:57:29 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
1536:XsB2W6U8Q7RSdXLBvbfDb3zTBuMZAn6Fo6nri:62W6U8QQdXLBvb7bPMMZ+6Fo6

Entry address:
0xC47E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.7234

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
41.5 KB (42,496 bytes)

The file flash_player_setup.exe has been seen being distributed by the following 13 URLs.

http://now.software-buddy.site/dl.php?btrg=_Va78cAhdKUbkAZyfdq3Fi0pW-7WD3DQnzhWcty3-dw.&cid=us5kpzd2emeuged0oxg0&subid=2279&conversion_id=14629146097341&app_id=129&lp_id=1389&v=tribat&stub_id=305&v_id=EQPtsXDmgLTP509esZyeULt-0a6fLj0HjSSmYp1nfW0.&lpp=*-*-*

http://livecheck.ugrade4ever.website/dl.php?vytrbe=Ck9ciPLQ64ema6KqI6KvjRcWjfMOaynSp0Opaaaw3LY.&cid=29742224511462916937&conversion_id=14629169415622&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=Ulf1dAEaSIk-jIra1ogVgZ-51w5BXCLcSj9yvxAhK9Y.&lpp=*-*-*

http://keyupgrade.soft2update.tech/dl.php?klsfd=mwK9xqzoV7CJFZFuMzUljhhSqRfSzOS0OjpXu8EpXWQ.&cid=MTA1MXw1MjEyfENBfDN8MXx8Y3pKeipTazFETVRFME5WOXJVa3Q2YzBwWVpGVnZMVkJqTkVKQ1dFZHlVR0pFfHw&conversion_id=14629182624232&app_id=4&lp_id=1602&v=tribat&stub_id=305&v_id=xLdp7JOIK1YxqxWD8NS7Jf4pkC2gL7zSadyE0yVA2S8.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?tberb=UhtopDfT-Qw1wd0I9sitpTYHGuohmSBqFaltbtgBkBI.&cid=JFC903_Qn6KdKDQF5-Pc_EBXNDPaj&conversion_id=14629111599558&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=41l7sl45zlfuxckRs_qo4tOsfpPOHPMQF3WqAvfNen4.&lpp=*-*-*

http://livecheck.ugrade4ever.website/dl.php?vytrbe=GVaWYHIOVQncaGxIQLPoAUEqrsoSBrTQoRRUFr9R4iA.&cid=4051862571462917446&conversion_id=14629174484058&app_id=4&lp_id=954&v=tribat&stub_id=305&v_id=EHvtk6MpWkJOQORJ1I4zrIA6_W4NaigMKlvkRvwh7a0.&lpp=*-*-*

http://safe.safeupdate4soft.xyz/dl.php?gvsfg=ww0ZyS3LXwXbcfAyYDv7Oa6aYcM6SogE5Pl-haYHK6c.&cid=[CLICK_ID]&sub=[3]&conversion_id=14629092264334&app_id=129&lp_id=1606&v=tribat&stub_id=305&v_id=fxVSHrY5sxkB_ihC8TT2jIxu0JaW1LWdpyZ3ejxrgAM.&lpp=*-*-*

http://readyupdate.safesystemonline.website/dl.php?buyjtr=MDYFLcmc8ZrwpuJzcGX6a0wVgA6VfAYfBDfeSHwJbdM.&cid=6270_7375044758_8KhYh&conversion_id=14629194295264&app_id=4&lp_id=1613&v=tribat&stub_id=305&v_id=vXAIP_MrqK8trFj09nGzMbVIeC7rbqGHXB5VSq2oW_I.&lpp=*-*-*

http://livecheck.ugrade4ever.website/dl.php?vytrbe=gkFxLPUcpk7xf6JHEpK7C7_F2gl5rT0l1skK5_kvm54.&cid=12981987341462913111&conversion_id=14629131121517&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=PFnsJBPewIzBwPJz54LcXNlCmlSMe9kpQ8LTF7DaiMw.&lpp=*-*-*

http://livecheck.ugrade4ever.website/dl.php?vytrbe=Ck9ciPLQ64ema6KqI6KvjRcWjfMOaynSp0Opaaaw3LY.&cid=29074084241462913489&conversion_id=14629135138432&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=ztR9sc2oVMCmo5AFGVENOKN6i1tYO1XKC-YGn-L6Mn0.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?tberb=xvhafOuwQ9_CyI_g5YJnT3l1ICddzVfsvmMxIHbq2Ds.&cid=14835224221462911705&conversion_id=14629117096931&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=CVVIhca-4eoKSYNpT-4ZpCIEVt6YNCIh9iIRpQnxLdg.&lpp=*-*-*

http://update2.whensoftworks.site/dl.php?tberb=U9D0nJ7k9bUg5bGHlEzAWjLoG_fk8HErqK_2L_ETCN8.&cid=28921260681462912249&conversion_id=14629122590483&app_id=4&lp_id=1543&v=tribat&stub_id=305&v_id=jW2WlGawN3u83Mu9xSwLfe4WCWODvIzAq9sr9M4hLWg.&lpp=*-*-*

http://livecheck.ugrade4ever.website/dl.php?vytrbe=gkFxLPUcpk7xf6JHEpK7C7_F2gl5rT0l1skK5_kvm54.&cid=15885621201462912978&conversion_id=14629129798222&app_id=4&lp_id=1561&v=tribat&stub_id=305&v_id=cRYVH9wGpY8cRQuv3sehhMxAITOhUxdm7xBdX9CJy8I.&lpp=*-*-*

http://checksoft.newsafeupdate.site/dl.php?asfjad=Ng4WtNxhGPEQZdqC1dWAshWscO8dCXLx14dzm1z-R-E.&cid=176158012764&sid=473939&conversion_id=14629209624241&app_id=129&lp_id=1609&v=tribat&stub_id=305&v_id=QPopII0s0yQRpwB7smggjqb4Xvy_zLjrYXDJbzPuvlI.&lpp=No match

Remove flash_player_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.