home

flashplayer__6528_i594223426_il221.exe

The application flashplayer__6528_i594223426_il221.exe has been detected as a potentially unwanted program by 19 anti-malware scanners. This is a setup program which is used to install the application. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from ams1.ib.adnxs.com and multiple other hosts.
Version:
1.1.1.72

MD5:
ba5be4d4983d4d1b9566033f12de4142

SHA-1:
14b45693d04f8b76045e00bcf6c918d473800545

SHA-256:
223a929e9fb2c9abbcc53c2f39139e91733d7e47f951eb805cade541c3c33e02

Scanner detections:
19 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 12:46:39 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Trojan.Generic.11241702
1010

AhnLab V3 Security
PUP/Win32.Amonetiz
14.04.24

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.145.40

avast!
Win32:Amonetize-AX [PUP]
2014.9-140430

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.14424

Bitdefender
Trojan.Generic.11241702
1.0.20.600

Emsisoft Anti-Malware
Trojan.Generic.11241702
8.14.04.30.09

ESET NOD32
Win32/Amonetize.AJ (variant)
8.9717

G Data
Trojan.Generic.11241702
14.4.24

K7 AntiVirus
Trojan
13.177.11922

Malwarebytes
PUP.Optional.Amonetize.A
v2014.04.30.09

McAfee
Artemis!D5F74C41F572
5600.7144

MicroWorld eScan
Trojan.Generic.11241702
15.0.0.360

nProtect
Trojan.Generic.11241702
14.04.29.01

Qihoo 360 Security
Win32/Trojan.Multi.daf
1.0.0.1015

Reason Heuristics
Threat.Win.Reputation.IMP
14.4.30.21

Sophos
Amonetize
4.98

Trend Micro House Call
TROJ_GEN.F47V0427
7.2.120

VIPRE Antivirus
Amonetize
28688

File size:
344.5 KB (352,768 bytes)

Product version:
1.1.1.72

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayer__6528_i594223426_il221.exe

File PE Metadata
Compilation timestamp:
4/24/2014 11:00:25 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:7oh05BJt1mgudsZPNkBXEjIan3BzS36kMbHe7JdywHdfBOMXGxCTSWLe32Wp:7oh053t1huds4BXE8anxzSKn2DfsQGx3

Entry address:
0x2A061

Entry point:
E8, 97, 9F, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F...
 
[+]

Code size:
246 KB (251,904 bytes)

The file flashplayer__6528_i594223426_il221.exe has been seen being distributed by the following 5 URLs.

http://ams1.ib.adnxs.com/click?TO-10gbHsz9M77XSBsezPwrXo3A9Csc_TO-10gbHsz9M77XSBsezP96Vh3Cg7S1WgkkIYN2YhwOCMFxTAAAAAGSCHgB2AgAAdgIAAAIAAADnSLcAlU4FAAAAAQBVU0QAVVNEACADuAG8nAAANc4AAQQAAQIAAIoAuSihYAAAAAA./cnd=!UAYJPgj2srEBEOeR3QUYlZ0VIAQ./clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5561&capp=FlashPlayer&ti1=ams1CIKToYDWm-bDAxACGN6rnoSHtPuWViINNzguMTkwLjE1My41MCgBMILh8JoF&ti2=1999460&ti3=${APN}

http://www.holddownload.com/download.php?version=1.1.1.72&prefix=FlashPlayerSetup&campid=4120&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=r3v2-Bxr054s-IgkTkNwRYbqTTtrMkTzOLdndFsHgwA8j9Z5b1G6lwbp7f6e5vPXLEi8Kg98O6e4kU0j8rf3dgGT70HMqjOBdRcmFLlRYQA65cXNR1xnugm8OyYqL0Uj377S0cb6HLMRTOG-IIIWDAQnPGp5XqrzftZXT8mkM2icp7kBC7fAfYOxSAIUNQ3N1GLRO9M55HdyoaLvQajb_S07eq4yRZ_aMwsDwOzvwPDdAw1HkPEq2N9Ih8zJebfto-UKu8UK8PorknrqPkUrvJV_tdXOsT0M9e2AxsI4vJ4VK_eWejo7LqIi7N1lboHS-w8PyEb2jLMJYG-x-h-Es7ndpX8ZxZFjETOn0rdEcfgE4nChaGyZxooljBT5HUaIRPc&capp=FlashPlayer&iaff1=10118

http://ams1.ib.adnxs.com/click?7FG4HoXrsT_NXUvIBz2rP8HKoUW2890_zV1LyAc9qz_sUbgeheuxP_EBIrX35oxqwtKRqpZzfAxxR1tTAAAAAMfdJQCZBwAAdgIAAAIAAAB9988AF9cFAAAAAQBVU0QAVVNEANgCWgDXNwAAiNcAAgUAAQIAAI4AgCuH_QAAAAA./cnd=!_Ab7RAjL8eIBEP3uvwYYl64XIAA./referrer=http://www.bugaga.ru/pictures//clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5462&capp=FlashPlayer&ti1=ams1CMKlx9Tq8py-DBACGPGDiKn73rnGaiIOODguMjAwLjEzNi4yMDgoATDxju2aBQ..&ti2=2481607&ti3=${APN}

http://adk2trk.cpmrocket.com/event/click/0/adSNffM3k7fHL4C6-VhYBejhZBaRezZaxGKe7VnvH-yWgeSxDqqZfNVi83wiKujOp3yG7GBP_s66-1fAEHOglMCO0Rb2MZUAj3KKBkj58lqCmk9jy9HlN3UnqmSeXrckhP5eqg-MQdDgtKc1Gu2-cUQhmwgWvUSTBhYW9_BZSyRFPBThsIQsMQvi6L3F0spisJcHScO-6FKzEJZRaLWSgY0OLt9bvfR_r8YIltN_jygjfYFxo5ix1AgxBHI4d7QXkDzl8CxeemIikoPkrUfS7eSvhyHbl4nFfn7Y2QwiEO8eF0YeMCbI6tP_ilrMmlFIARC97waM7TcuHYqCg0MyCQxtJ_VthFowLzLkp0BsQLenVP5PPAJ6OF4QqOQkqzdRnet9Jg/.../

http://www.holddownload.com/download.php?version=1.1.1.72&prefix=FlashPlayerSetup&campid=6528&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=_8Ol1rcIM-abmSuZOmN6U2bEJlSk51Eb2jqmPsyRuOwU_Yka9HtNMH-JytFpkSZL5GE84ouz2t-CKtB5mwl50KYMFCydcz4rWKKSfWHbG_jBbUII5vc-acmATsij0zjdNcEkq5YacLeU9UmSOFz-2C9ewa6sjvm5XxfRyyS6HS1qSzPusPDoiaG9FteMgEOanMEPJwAuRMugIbibHSfCoUDOOv1GMEPasLA2wgbJmXreD96i08v0BV7eBT8MP-JkwEAZ4C6Jr_EtJbqaNrTb51iRqBLJSB0XshxyfYtzwrYVS8zBKCNuVUh6DhaTPFnCVx86ukRq58QOaIooC6nQLCShTNayblqBkA8q_4FesQD26uDnycekR319o_CEKJ7iuzbjVdP44azqiHU&capp=FlashPlayer

Remove flashplayer__6528_i594223426_il221.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.