home

flashplayer__3719_i141106818_il128.exe

Installer

Amonetize ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application flashplayer__3719_i141106818_il128.exe by Amonetize ltd has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Amônétízé Ltd  (signed by Amonetize ltd.)

Product:
Installer

Version:
1.1.5.86

MD5:
f448f7d776adb8556ab66fb3767bbc09

SHA-1:
2cc81915821e2b95148136095518221391d77b49

SHA-256:
44274efffe0add120d8ae231ce00e0b844c0a55f35ccaea3c9887d234121258e

Scanner detections:
11 / 68

Status:
Adware

Explanation:
This setup file is a re-distribution of the original program that bundles various adware offers during installation including toolbars and browser search extensions.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 8:17:57 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clode2e.Trojan
1.3.0.4613

Boost by Reason
PUP.Installer.Amonetizeltd.c
2013.11.20.5

Dr.Web
Adware.Downware.1655
9.0.1.0324

ESET NOD32
Win32/Amonetize (variant)
7.9181

K7 AntiVirus
Unwanted-Program
13.174.10538

Malwarebytes
PUP.Optional.InstallMonetizer
v2013.11.20.12

McAfee
Artemis!F448F7D776AD
5600.7267

Reason Heuristics
PUP.Installer.Amonetizeltd.c
14.8.7.19

Sophos
Amonetize
4.96

Trend Micro House Call
TROJ_GEN.F47V1119
7.2.324

VIPRE Antivirus
Conduit
24448

File size:
393.5 KB (402,984 bytes)

Product version:
2.1.12

Copyright:
(c) Amônétízé Ltd, 2012,2013. All rights reserved.

Original file name:
Installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayer__3719_i141106818_il128.exe

Digital Signature
Signed by:
Amonetize ltd.

Authority:
Thawte, Inc.

Valid from:
3/18/2013 5:00:00 PM

Valid to:
6/18/2015 4:59:59 PM

Subject:
CN=Amonetize ltd., O=Amonetize ltd., L=Raanana, S=Alberta, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
235E7B2F1D4E0152189F6381E2BA8C97

File PE Metadata
Compilation timestamp:
11/18/2013 7:58:32 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:6QPAfK2+hHEe+9MC8jha2ojJsimJ0ftRrprx:g+6xwhk/mJ0vrprx

Entry address:
0x26C13

Entry point:
E8, 74, 96, 00, 00, E9, 89, FE, FF, FF, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00, 00, 00, 8B, D1, 83, E1, 7F, C1, EA, 07, 74, 65, EB, 06, 8D, 9B, 00, 00, 00, 00, 66, 0F, 6F, 06, 66, 0F, 6F, 4E, 10, 66, 0F, 6F, 56, 20, 66, 0F, 6F, 5E, 30, 66, 0F, 7F, 07, 66, 0F, 7F, 4F, 10, 66, 0F, 7F, 57, 20, 66, 0F, 7F, 5F, 30, 66, 0F, 6F, 66, 40, 66, 0F, 6F, 6E, 50, 66, 0F, 6F, 76, 60, 66, 0F, 6F, 7E, 70, 66, 0F, 7F, 67, 40, 66, 0F, 7F, 6F, 50, 66, 0F, 7F, 77, 60, 66, 0F, 7F, 7F, 70, 8D, B6, 80, 00, 00, 00, 8D, BF...
 
[+]

Entropy:
6.6083

Code size:
229 KB (234,496 bytes)

The file flashplayer__3719_i141106818_il128.exe has been seen being distributed by the following 21 URLs.

http://lax1.ib.adnxs.com/click?skP8w5Ye0D_chBg7I8LKPwAAAAAAAPA_3IQYOyPCyj-zQ_zDlh7QP0h0ODe_IkoO4lfTcS3lRTooqo9SAAAAAP8tHgA_AQAAdgIAAAIAAABKgpYABfkEAAAAAQBVU0QAVVNEANgCWgA5awAAq74AAQUCAQIAAIoAnSP3UAAAAAA./cnd=!LAZJOgi615MBEMqE2gQYhfITIAA./referrer=http://bigslick55.com/cog/loginverify.asp/clickenc=http://.../direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=lax1COKvzY7XpfmiOhACGMjo4bnz14ilDiINOTkuMTAxLjIwNS40OCgB&til2=1977855&til3=${APN}

http://www.samedownload.com/download.php?version=1.1.5.86&prefix=VLCMediaPlayerSetup&campid=3715&instid[appname]=VLC Media Player&instid[appsetupurl]=http://videolan.c3sl.ufpr.br/vlc/2.0.8/win32/vlc-2.0.8-win32.exe&instid[appimageurl]=http://s3.amazonaws.com/free-sw/carriers/.../player.html

http://www.winflashplayer.com/direct-download.html?version=1.1.5.86&iaff1=10118&ci=4121&capp=FlashPlayer&ti1=UI_uSNa_W99t9NcKMI5NyXUkndSkrY02r2uszumuY6RigxLlaJuINbuGyDeJO-wWfCoSnHhVrgSa0iOxGHJcppvIUU0-rHKi1qe7IjKSaQRISn4Ixqi9ucSo_MeH9x1ZFlZOocwy_45JnNicVObZ9b_vB_YBTlgLXKliawKytcPQOJgvtlL6W7L7Pk2IY30gA-lTUdR-AEtovBZj--dkNklYN466svA0UiFf0Nl64thYrnxRBlTwBwI7p_23tDD8Wka6_lwuPJkYOkgEmYd1yEg3GZ6Q625H2i1VsaDepfO_guxYk5Bfff_X17gvpInWs4FvKskURwdCZsB35opNp99UvEyXu8QYX75PsySbKxA-2CdMiqC5cB9rFyXJBQ

http://www.samedownload.com/download.php?version=1.1.5.86&prefix=FlashPlayerSetup&campid=3719&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=lax1CJC_obD4_bjMRBACGJafpIe4vvG-eiIMNjguMTI3LjQ4LjM0KAE.&capp=FlashPlayer&iaff1=9886

http://www.samedownload.com/download.php?version=1.1.5.86&prefix=FlashPlayerSetup&campid=3322&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=0038974685959849997&capp=FlashPlayer&iaff1=10036

http://www.amoninst.com/download.php?version=1.1.5.86&capp=FlashPlayer&iaff1=9890&campid=1003&prefix=FlashPlayer&ti1=LqOPtmbfswtzqwEOt0aqnaFubGha_FSaubaQ-VF_J-baBdWgn1fn6nyiEQPPe6nWgt4PpkeertPnMmbuMGHr1djmzIjm9utrd1m1PH0Oq9nn1ddaeq0gCt4ZZvLnSBuITjk7M_z3sfzHxelE9-B7LM4Hmy3S0zDrX1zSXwsiasQptBgSKa2eQ2Voi5HSOjXIstGrGeGwe7AJfSbQh6kdJP9qKcGLdCmTMGEPojcbmsY9rvs3icxmU0Kfs2ba5vBd0Gy1jKp7ZZx272DMSPJbkqnCNmhOUjbqLbSGTU0HKIAxv1JmPGymXNMgt-fs46ZYhRec0bxlZxFTkuqoTEaBshjymnjfaBCrqypLgphe02GyKWbX90su7HJlDYojWebPz-c2MiI22BQ60BQ_f3j3ofcfcq7Hnra&ti2=7362

http://www.amoninst.com/download.php?version=1.1.5.86&capp=FlashPlayer&iaff1=9890&campid=1003&prefix=FlashPlayer&ti1=LqOPtmbfswtzqw5xsDainaFubGha_FSaubaQ-VF_J-baBdWgn1enPyN6MIEIGP7rmvQNcEXMfbsptnn9QjegbgagWeccpvuuq9t9H0OP90nqdnaqb0BbE6Z2wLCXwRI7tJDXrxrBcfobUix87931llWdzOTzFZVfgxLXetjHaiP-gTyWqc2rY0_1klw4enkoX2fSbO1o1T1iblWA-6IUbMlwidbtbctntQTCGjceutXP1Xmkvr08HHyuFVjsm5caYldhrcXOBi_j7NMyUZ2zOMngHa0OCYnWXzayzWjyYk7zTr2fvTOsi4Jz-e0GjNczm9zzJ1cL-a1YT1o4dQO-LCGkYgjumljfGkDrqigLOmFqpBdIrcoiPMtKzVECjtWjfMpaoZsW2es0ymzsYb8xCxuKu4aj-fuxaI&ti2=7362

http://a.ad-sys.com/.../click?tenant=AD&context=LqOPtmbfswtzqw5xsDainaFubGha_FSaubaQ-VF_J-baBdWgn1enPyN6MIEIGP7rmvQNcEXMfbsptnn9QjegbgagWeccpvuuq9t9H0OP90nqdnaqb0BbE6Z2wLCXwRI7tJDXrxrBcfobUix87931llWdzOTzFZVfgxLXetjHaiP-gTyWqc2rY0_1klw4enkoX2fSbO1o1T1iblWA-6IUbMlwidbtbctntQTCGjceutXP1Xmkvr08HHyuFVjsm5caYldhrcXOBi_j7NMyUZ2zOMngHa0OCYnWXzayzWjyYk7zTr2fvTOsi4Jz-e0GjNczm9zzJ1cL-a1YT1o4dQO-LCGkYgjumljfGkDrqigLOmFqpBdIrcoiPMtKzVECjtWjfMpaoZsW2es0ymzsYb8xCxuKu4aj-fuxaI&fwd=

http://a.ad-sys.com/.../click?tenant=AD&context=LqOPtmbfswtzqwEOt0aqnaFubGha_FSaubaQ-VF_J-baBdWgn1fn6nyiEQPPe6nWgt4PpkeertPnMmbuMGHr1djmzIjm9utrd1m1PH0Oq9nn1ddaeq0gCt4ZZvLnSBuITjk7M_z3sfzHxelE9-B7LM4Hmy3S0zDrX1zSXwsiasQptBgSKa2eQ2Voi5HSOjXIstGrGeGwe7AJfSbQh6kdJP9qKcGLdCmTMGEPojcbmsY9rvs3icxmU0Kfs2ba5vBd0Gy1jKp7ZZx272DMSPJbkqnCNmhOUjbqLbSGTU0HKIAxv1JmPGymXNMgt-fs46ZYhRec0bxlZxFTkuqoTEaBshjymnjfaBCrqypLgphe02GyKWbX90su7HJlDYojWebPz-c2MiI22BQ60BQ_f3j3ofcfcq7Hnra&fwd=

http://www.wilddownload.com/download.php?version=1.1.5.86&direct=1&prefix=FlashPlayersetup&campid=3720&ti1=lax1CJm0qNy5jbfWbhACGPSh6P-PyMy9SSINNzYuMTczLjI0Ny41NSgB&iaff1=9886&capp=FlashPlayer

http://www.winflashplayer.com/direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=lax1CJm0qNy5jbfWbhACGPSh6P-PyMy9SSINNzYuMTczLjI0Ny41NSgB&til2=1977855&til3=${APN}

http://lax1.ib.adnxs.com/click?u2QcI9kjwD9fAyo13sq6Pw4tsp3vp-o_XwMqNd7Kuj-7ZBwj2SPAP_QQ-v9AMntJGRqKm2vcrG4NlopSAAAAAP8tHgA_AQAAdgIAAAIAAABKgpYAem0EAAAAAQBVU0QAVVNEANgCWgA5awAAJq0AAQUCAQIAAIoAlSRmzwAAAAA./cnd=!hwYsPAi615MBEMqE2gQY-toRIAA./referrer=http://www.downloadcamp.com/yt_downloader_v6/?aflt=cd2361&subid1=02492&subid2=1368439082&mt_aflt=CD4349&src=version6/clickenc=http://.../direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=lax1CJm0qNy5jbfWbhACGPSh6P-PyMy9SSINNzYuMTczLjI0Ny41NSgB&til2=1977855&til3=${APN}

http://www.wilddownload.com/download.php?version=1.1.5.86&prefix=FlashPlayerSetup&campid=3719&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=nym1CO6Sg8jjwdKAIhACGJWm7cTv7pr8QyIOMTA4LjE1LjE2NS4xMjEoAQ..&capp=FlashPlayer&iaff1=9886

http://nym1.ib.adnxs.com/click?27jF_NzQtD9kggrc9EaxPzm0yHa-n-4_ZIIK3PRGsT_cuMX83NC0P4Y7wiQfWk4b5LGqZe6vdCF4AY1SAAAAAAAuHgA_AQAAdgIAAAIAAAA9gpYABfkEAAAAAQBVU0QAVVNEAKAAWAI7awAARKYAAQUCAQIAAIoAlSkfOgAAAAA./cnd=!HwbHOQi615MBEL2E2gQYhfITIAA./referrer=http://www.tracsdirect.com/OrderSelect.aspx/clickenc=http://.../direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=nym1COTjqq3m_au6IRACGIb3iKbyw5anGyINMjA3LjI1NS4xNC4zNygB&til2=1977856&til3=${APN}

http://www.winflashplayer.com/direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=nym1COTjqq3m_au6IRACGIb3iKbyw5anGyINMjA3LjI1NS4xNC4zNygB&til2=1977856&til3=${APN}

http://www.samedownload.com/download.php?version=1.1.5.86&direct=1&prefix=FlashPlayersetup&campid=3720&ti1=nym1COTjqq3m_au6IRACGIb3iKbyw5anGyINMjA3LjI1NS4xNC4zNygB&iaff1=9886&capp=FlashPlayer

http://www.wilddownload.com/download.php?version=1.1.5.86&prefix=FlashPlayerSetup&campid=3719&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=lax1CI6JyZ-drv33LxACGLDzwpmOkZ6hAyIONzIuMTY5LjIyNi4xNTIoAQ..&capp=FlashPlayer&iaff1=9886

http://lax1.ib.adnxs.com/click?i83HtaFixj_hy46ebJTCPx1aZDvfT-0_4cuOnmyUwj-Kzce1oWLGP7_SII3KaMwZvXyOEYrxyi2_vYtSAAAAAP8tHgA_AQAAdgIAAAIAAABKgpYABfkEAAAAAQBVU0QAVVNEANgCWgA5awAARpEAAQUCAQIAAIoAVyslgAAAAAA./cnd=!LAZJOgi615MBEMqE2gQYhfITIAA./referrer=http://www.audible.com/lib/clickenc=http://.../direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=lax1CL35uYyhsbzlLRACGL-lg-momZrmGSINNzUuMTQwLjI0MS41MygB&til2=1977855&til3=${APN}

http://www.winflashplayer.com/direct-download.html?version=1.1.5.86&iaff1=9886&ci=3720&&capp=FlashPlayer&ti1=lax1CL35uYyhsbzlLRACGL-lg-momZrmGSINNzUuMTQwLjI0MS41MygB&til2=1977855&til3=${APN}

http://www.wilddownload.com/download.php?version=1.1.5.86&direct=1&prefix=FlashPlayersetup&campid=3720&ti1=lax1CL35uYyhsbzlLRACGL-lg-momZrmGSINNzUuMTQwLjI0MS41MygB&iaff1=9886&capp=FlashPlayer

http://www.wilddownload.com/download.php?version=1.1.5.86&prefix=FlashPlayerSetup&campid=3719&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=nym1CIHFyoXWw9nlYhACGN7I3aSD3oqyESIOMTczLjcwLjIyMi4xMzAoAQ..&capp=FlashPlayer&iaff1=9886

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.soledownload.com  (54.225.181.84:80)

TCP (HTTP):
Connects to www.activemonetizer.com  (23.23.96.46:80)

 
http://www.activemonetizer.com/index.php?Net2=v2.0.50727&Net4=&OSversion=NT5.1SP3&Slv=&Sysid=B2243465&Sysid1=B2243465&X64=N&admin=Y&browser=IEXPLORE.EXE&chver=&exe=ikjut__27354&offver=&lang_DfltUser=04

Remove flashplayer__3719_i141106818_il128.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.