home

flashplayer15_install_win_pi.exe

Adobe Flash Player

The executable flashplayer15_install_win_pi.exe has been detected as malware by 9 anti-virus scanners. This is a setup program which is used to install the application. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from flashplayer.joydownload.com.
Product:
Adobe Flash Player

Version:
1.0.0.0

MD5:
ee7d6164d38e75c32cc265c7e338cf63

SHA-1:
f1d99365bf7ed91cefbad1376f0e488f38314267

SHA-256:
206c34d0730de91f19123cce06f1ff3d542d8a8e890e2965c44f1eae970fb175

Scanner detections:
9 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
2/25/2025 2:59:44 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160216-0

AVG
Win32/Sality
2015.0.4530

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5735

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Trojan.Artemis!D6BE031829AE
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.7480.0

File size:
588.2 KB (602,312 bytes)

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
5/20/2013 6:52:48 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:7Q9an4njFHXx6l9TiY9lvk4qYxzi7941YCuPNcsO8Q7/77HTV17WS:09i4yv/9ls4HW7i2Y77Hh1v

Entry address:
0x331F

Entry point:
8A, FA, 0F, BF, FB, 81, CE, C8, EB, A2, DC, 0F, AF, C1, 87, F5, 84, EC, 85, E8, C7, C1, E4, 92, 26, A4, BF, 65, 8A, A0, 58, F3, EB, 08, 69, F2, B8, EB, E3, C6, 12, CA, 3D, 5C, CC, 00, 00, 0F, AF, D3, 48, 8A, E7, 8A, FF, 86, D4, B6, 24, 3D, D8, 88, 34, 18, 69, CD, 3D, DA, C8, 27, E8, 00, 00, 00, 00, 0F, BE, EB, 81, FB, D7, 43, 75, B9, 8D, 15, 0E, 41, 0D, EC, 80, FB, 7C, 1A, C0, 3D, 96, 6C, 87, 54, 05, BE, AA, E6, 83, 13, F5, 02, E9, 04, A1, 68, 13, E7, 06, 00, 8D, 05, 7B, 40, 4E, 81, 5A, 81, FE, 9D, 28, F2...
 
[+]

Entropy:
7.8710  (probably packed)

Code size:
24 KB (24,576 bytes)

The file flashplayer15_install_win_pi.exe has been seen being distributed by the following URL.

http://flashplayer.joydownload.com/get_azure_file/wUiS4WnYccXEwj /TeqjC1c0kw48PjymGh3wYN7Xseh152f0sCw22dBNJ0bterruNDC2w15KdDrYCeLkErM90btixc6UBB6avCX5DEzl7CL8y6mA55yazXFA4p8xgl9QAir2SWY1yJJgq2noUSCTQrZOl4TzPHQNb7MgaEFRZ/CwFWh0O8TNLAlh1fX2GX8veY6x2 4/HCnj5kjE3/VqDoC8cMatbXZO1IK3G M2yUJJud2/n1O7ZKl/hS2mB91Wrc2/.../6s3FiCdjbbVBT5ZrZS5g6KL7TFM0zBe1uIQaUGiwWlGc5MO6qE98ICeM7XgfntPQOmDxHBXPg7l1awji1yXFD0c=

Remove flashplayer15_install_win_pi.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.