home

flashplayer14_install_win_pi.exe

Adobe Flash Player

Innovative Systems LLC

The application flashplayer14_install_win_pi.exe by Innovative Systems has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The installer uses the OpenCandy monitzation platform which will donwload and install offers in the setup for potentially unwanted software including ad/search-supported toolbars. The file has been seen being downloaded from flashplayer.joydownload.com and multiple other hosts.
Publisher:
Innovative Systems LLC  (signed and verified)

Product:
Adobe Flash Player

Version:
1.0.0.0

MD5:
fc67b34e91b49080bf40398981c9cb47

SHA-1:
6ed21667ffcf2f803b367702a9c4571f6c972f29

SHA-256:
2770b03800284dfc25dd92b931590f715d8897d25f6fb09e4ae58165d0dc2a94

Scanner detections:
18 / 68

Status:
Adware

Explanation:
Packages the OpenCandy software bundler that offers to install additional software and may include web browser add-ons and toolbars which display advertising (based on publisher settings and geo context).

Analysis date:
2/25/2025 2:53:21 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Riskware.Agent
7.1.1

AhnLab V3 Security
PUP/Win32.Agent
2014.09.20

avast!
PUP-gen [PUP]
2014.9-140815

AVG
Generic
2015.0.3382

Baidu Antivirus
Adware.Win32.OpenCandy
4.0.3.14112

Clam AntiVirus
Win.Trojan.Opencandy
0.98/21411

Comodo Security
ApplicUnwnt
19190

Dr.Web
Adware.Downware.6712
9.0.1.0227

ESET NOD32
Win32/JoyDownloader.D potentially unwanted application
8.7.0.302.0

G Data
Win32.Adware.OpenCandy
14.8.24

IKARUS anti.virus
PUA.JoyDownloader
t3scan.1.7.5.0

Malwarebytes
PUP.Optional.OpenCandy
v2014.08.15.11

McAfee
Adware-Opencandy
5600.7038

Qihoo 360 Security
HEUR/Malware.QVM06.Gen
1.0.0.1015

Reason Heuristics
PUP.InnovativeSystems.CC
14.8.15.11

Sophos
Generic PUA NG
4.98

Trend Micro House Call
Suspici.F184F561
7.2.227

VIPRE Antivirus
Threat.4791855
32938

File size:
509.2 KB (521,408 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\flashplayer14_install_win_pi.exe

Digital Signature
Signed by:
Innovative Systems LLC

Authority:
VeriSign, Inc.

Valid from:
5/19/2014 3:00:00 AM

Valid to:
5/20/2015 2:59:59 AM

Subject:
CN=Innovative Systems LLC, O=Innovative Systems LLC, L=Dnepropetrovsk, S=Dnepropetrovska oblast, C=UA

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
450EACFE8D673E82864CE46BC1A92FCA

File PE Metadata
Compilation timestamp:
5/20/2013 2:53:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:PKc2anRh3F7sa3b0R8x5minQHaruEMemKUhg6g+4pCYSYY3ZqlPY:B2iPVYa3bhx+arbM+Ul4gTYYJAY

Entry address:
0x333E

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, A2, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 80, 40, 00, 55, FF, 15, AC, 82, 40, 00, 6A, 08, A3, 78, 4F, 43, 00, E8, A8, 2E, 00, 00, A3, C4, 4E, 43, 00, 55, 8D, 44, 24, 34, 68, B4, 02, 00, 00, 50, 55, 68, F0, B1, 42, 00, FF, 15, 7C, 81, 40, 00, 68, 7C, A3, 40, 00, 68, C0, 3E, 43, 00, E8, 13, 2B, 00, 00, FF, 15, 34, 81, 40, 00, BB, 00, F0, 43, 00, 50, 53, E8, 01, 2B, 00, 00...
 
[+]

Entropy:
7.8386

Packer / compiler:
Nullsoft install system v2.x

Code size:
24.5 KB (25,088 bytes)

The file flashplayer14_install_win_pi.exe has been seen being distributed by the following 13 URLs.

http://flashplayer.joydownload.com/get_file/wUia6yjQOM3I2mmuF6G5QwMsilYkNHutHhLgNoOP4bZ0/269qGt42dkKLVXsK7H/NWHlmQBKOSCGGeO1GbYlyPpqx8yPQVXF7SS7BkD9qnm9i/fXrsvT0mlPq4dm2gkXRn3kAD13ntF/onq5AiPFEfUJisblWG5ZK/1jc0RgdPapOTomZpuGcwkpz6vnGDRlIdHg2q4/CGOos1rLn/1rFpn esOuZWMIhoL9Qbht2l9J/4O h1n5ZLgjy33lW48Bv47uAWvi8JuWkD51L/.../rFE6q94jvngUkNT8=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhzycteQv A8/.../44JDnzR1mZybWszMe3NKQOnCiVwWZmvE8YwP6xyDFD0c=

http://flashplayer.joydownload.com/get_file/wUia6yjQOMzI2m2zUbjxCgggkkU3PzykGh/ga5/Zt kkqSHsqSt4ytEcLFXsK7H/NWH/mQBKOTqGGuLkErM90e8/mJLIRR6avCX7BlT1vHutgLbbrdPKyDofs55ziVdIRnekGDU2nsAj7G2jDnGSA7ZawtXjNTcFbrkgJFsFN6XlACMjLdzFZREhjqv2RHp0O92yjbx8Wyu7tjWWwrwoVc7hH4X3MR4cht/oVbw2lF4f64Lv2BC4N gghSf/.../8utkk03NT8=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYdbB479nrj2 /jk7npkcJgTta7HuZiro0l8bOGGGCeikCr50yb9q1pPVR1XTqj3zVUz2vHu4j/fVp9vdmiBBo58ixxFQXzWtCzRnldEivSH4UHHGA65Xi83mPSVAMedmcF9MIaS0XHl1ao2Xcgkp1avlGWUvfI/.../rAAfhoZjkxQklLHmHsmkez5mKZGCjBkvbguh aQbz1ybFD0c=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXEwj 8WvauHEA0kxQ8PDK1GhzycteQv A8/yWn9np5iNEIJ1XmaL//PXSuyxdSMWmeWLDzCr5uybhrh8yeDR7IpnvqBwX9unGtivbDpZrSlWlZ98xs1kdJF3ykCDRnwp94vXO6BjLQFf5dzKi4aXRDOeVuQF9WbcC3D2QqMJvcLVgoiqv2R25lIcenw ZsBGi sl3IlftkDZq2M8isZWMDnNO2XuMjlQ9StNap0h 7fKE2nS sEYkEutWwAHPvuYOSmCwiYbZRTsc3OH8porb Xlo931/.../rBwz5scy4lkx9fi6V8T9Wz9KQOnCiVwWZmvE8YwP6xyDFD0c=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjynHxz7aNTbvOh152f0sCw22dBNJ0bterruNDC2xF5KZDrQTvusW780wbNykprMRFTRo36xWQT2vBTm1baV/4WE/iQS//pw2ksXHCO1AX1/ksk7qHSmDjbbUrcfwsTrJTUDaKs5bBIOM6XlAiM8OJKfb15g0LPvUSwkeY/gh7FkTTH67guGyb1 D9G3c8i8LygIzcr F 8ujRwV6Yv/.../WptP5YSxQXP7spKCkW8qZLxRA91pK3RguuStDxhjjhS2189PUCbiDB w s72zFYvP3mHsmgez4aQInnrT0bXmr0mN1avkmLFD0c=

http://flashplayer.joydownload.com/get_file/wUia6yjQOMnI2nu1Wf6vCxAt2101NSqlHBjga5/ZtukkqzyqsGMxwd0EP0XlaLn6P2G3g15eOHHZU6n WuAlyOBqxcKdAgmR/Cn5D020sn 1maOI8ozKmiBBopc6kQMeBTX/SmIk3ZZr/y VAz3aBO0AlKimbmloKOAselBaIaS0XHl1apeXcgkpz6vmGDQke5f5kuc3BHv 9kjE3/VtDoC8YsntZXJWzYHkSfsv3BcT55r8jVz7bK1nnG sAs9X/JPiADm14tjV2HAybPVJRIU3Kyl/4aH/.../rFE6q94jvngUkNT8=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4coWK4fE9rm/8qHpzyMkFbk3kYqm/Zieuyw1SM2jPEe tCuNon 01htSWRAaS9T36CEblszi1iP/D7oCMg2gIq5M6kVRCUHWlDSx 18kt9DmsAz/MUrcfwsTjPSVRNOhxd1hTYuaiFHt7F5eQZV9z0P2LVX97F8Wrz7h9W3ux8VDOnPV UMv MJ7/.../zoZzk1QRmNHTOqj9cnYCRZWCjHEvcjPp4bgr40yjSD0c=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXAwj uQbjxCggnkkU3LTPkEhv4cpqK4fE9rm/4qHpwydsMK0f1Y/.../ExWtjdb0AT4c3Kzx65PCsRBBghVW60ddWRXO9UlixsZGnzQwvLHDAuHgfntPQOmDxHBXPg7l1awji1CLFD0c=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXBwj zXP7oQkEsml0kPju1E1v4YtbB6qAk5ib0pWJgjIJQeRigK6n3fHm4ykYOaz/ZCeLkErY1yas2mJfeX0zNrmatTkfz1yLhyLGA8oW31joVztVpnQAKAWSsSTR2ntFqp3/.../D2iwoAyTzbw0RM7sOZfsfXof1cK3D699yw8eroL7h0r6bKp3kSy0CIxX6M2pFSa158TSiCdjbbVJV4Y5OW0o8 ikFwgh10Ki3J5OFSbzBw33oJjj1QRmNHTOqj9cnYCRZWCjHEvcjPp4bwD01ifQD0c=

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXDyCf4UfO5CV530RJ0YyqsWxLzYdbB479nrj2 /jk7npkcJgTtbrHuajv8mRYNIGjVEeijGLIwxrFizMKWRAaT9T2nT1T8 3G4geeW94eMziQIs55ziVZIRjX Xix zcko9WjwXmmLFuUAndXqdD0EarMgeURecPe3Cis2LYzPInR70uKgQ3p5F8Krj4J1V3fv g/.../OX0lsPCsXhBnhATmiIEQRm7zDU75oJD2xQslLHmHsmkez5mKZGCjBkvbguh aQbz1ybFD0c=

http://flashplayer.1-104327-220260.53e7ac766ff01.jdcdn.net/get_file/Kg6uTfCtR3qRF2nxGdm9EQ/1407695494/1/13/1/.../flashplayer14_install_win_pi.exe

http://flashplayer.joydownload.com/get_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjynHx77ZdnUveh152H0sD4rl44cJgTta7n2LSXgkRcAcj/dUrzlGbFYmucjgJfBW2PWpnGXTB/p7TPqmf6SpNvSgzwIs55ziVJIRjH VGoq04A79WjwWWmLBuUI2syiPTENerswLxoJM738FXB8ctyXf08wh LuECw3eYbg2q4/.../Mawkk03NTHOu2AG393TInnrT0LXmrkmPRD7jCvWD0c=

Remove flashplayer14_install_win_pi.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.