» flashplayer__6741_i572918502_il3.exe
Overview
Analysis
File Details
Downloads (1)

flashplayer__6741_i572918502_il3.exe

The application flashplayer__6741_i572918502_il3.exe has been detected as a potentially unwanted program by 30 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer, however the file is not signed with an authenticode signature from a trusted source. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Version:

1.1.5.89

MD5:

00f4ed2b7ded68d918f6baef902c9638

SHA-1:

012600029b64e8359ca1c005b108c66cb9c4b32a

SHA-256:

8a5cbf88190aeed2d615c486239c39ed69b15b60d1c7b58277162d543871a1e4

Scanner detections:

30 / 68

Status:

Potentially unwanted

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

12/25/2024 12:40:25 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Trojan.Generic.11219753

984

Agnitum Outpost

PUA.Amonetize

7.1.1

AhnLab V3 Security

PUP/Win32.Amonetiz

14.05.26

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.149.10

avast!

Win32:Amonetize-AM [PUP]

2014.9-140526

AVG

Generic_r

2015.0.3462

Baidu Antivirus

Adware.Win32.Amonetize

4.0.3.14526

Bitdefender

Trojan.Generic.11219753

1.0.20.730

Dr.Web

Adware.Downware.2467

9.0.1.0146

Emsisoft Anti-Malware

Trojan.Generic.11219753

8.14.05.26.02

ESET NOD32

Win32/Amonetize.AJ (variant)

8.9786

Fortinet FortiGate

Riskware/Amonetize

5/26/2014

F-Secure

Trojan.Generic.11219753

11.2014-26-05_2

G Data

Trojan.Generic.11219753

14.5.24

IKARUS anti.virus

Trojan.SuspectCRC

t3scan.1.6.1.0

K7 AntiVirus

Trojan

13.177.12041

Kaspersky

not-a-virus:HEUR:AdWare.Win32.Amonetize

14.0.0.3807

Malwarebytes

PUP.Optional.Amonetize.A

v2014.05.26.02

McAfee

RDN/Generic PUP.x!c2m

5600.7118

MicroWorld eScan

Trojan.Generic.11219753

15.0.0.438

NANO AntiVirus

Riskware.Win32.Amonetize.cwsnth

0.28.0.59608

nProtect

Trojan.Generic.11219753

14.05.11.01

Panda Antivirus

Trj/CI.A

14.05.26.02

Qihoo 360 Security

Win32/Virus.Adware.932

1.0.0.1015

Reason Heuristics

Threat.Win.Reputation.IMP

14.5.26.14

Rising Antivirus

PE:Malware.Adware!6.17D8

23.00.65.14524

Sophos

Amonetize

4.98

Trend Micro House Call

TROJ_GEN.R0CBC0EDN14

7.2.146

Trend Micro

TROJ_GEN.R0CBC0EDN14

10.465.26

VIPRE Antivirus

Amonetize

29110

File size:

342.5 KB (350,720 bytes)

Product version:

1.1.5.89

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\flashplayer__6741_i572918502_il3.exe

File PE Metadata

Compilation timestamp:

4/17/2014 6:02:00 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:tpHfXepDjrqfx+WiETBRkXVV47eWtP5Y6KeqsUO2GjaOBjLZmBZBAnsH:tpHfXe1jrEx+Wi+Rksp5KoUO24aOaB3a

Entry address:

0x29961

Entry point:

E8, C6, 97, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F... 
[+]

Code size:

244 KB (249,856 bytes)

The file flashplayer__6741_i572918502_il3.exe has been seen being distributed by the following URL.

http://www.holddownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6741&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=u298d9251527bd2fe32aaafea9c&capp=FlashPlayer

Remove flashplayer__6741_i572918502_il3.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.