home

flashplayer__4369_i586265574_il77.exe

The executable flashplayer__4369_i586265574_il77.exe has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the Amonetize Downloader installer, however the file is not signed with an authenticode signature from a trusted source. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware. The file has been seen being downloaded from www.innovativedownload.com.
Version:
1.1.6.20

MD5:
76e02f41f1ae7338ed65dc94e58ed44b

SHA-1:
86f40b21c4259d2cbe1a3558cd16f244fdbd3795

SHA-256:
da916a2354caa915fb0d945b27f5b23ceb9c2b929c35b93c95e5d8d843233bc6

Scanner detections:
1 / 68

Status:
Malware

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 1:38:47 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.3.7.6

File size:
344 KB (352,256 bytes)

Product version:
1.1.6.20

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayer__4369_i586265574_il77.exe

File PE Metadata
Compilation timestamp:
4/22/2014 2:00:57 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:kkXsKpMfmUN+eLc5pCWcWWBa7Dslc6bDNegcYYfWC5p/WhvpgL+4BgC:kkXsKpMf9+eL4pCWcW2a7DrGOWyp/WZQ

Entry address:
0x29E21

Entry point:
E8, C6, 97, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F...
 
[+]

Code size:
245.5 KB (251,392 bytes)

The file flashplayer__4369_i586265574_il77.exe has been seen being distributed by the following URL.

http://www.innovativedownload.com/download.php?version=1.1.6.20&prefix=Dvd Shrink . 4.1.2 key generator&campid=7401&instid[appname]=Dvd Shrink . 4.1.2 key generator&instid[thankyoupage]=&instid[appsetupurl]=&instid[interrupted]=&instid[appimageurl]=http://s3.amazonaws.com/.../downloadall.png&ti1=01

Remove flashplayer__4369_i586265574_il77.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.