» flashplayer_updater.exe
Overview
Analysis
File Details
Downloads (8)

flashplayer_updater.exe

Hata

File Validated

This is the InstallMetrix bundle installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application flashplayer_updater.exe, “Hata Setup ” by File Validated has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the InstallMetrix Software installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Nis (signed by File Validated)

Product:

Hata

Description:

Hata Setup

MD5:

a0d3054846895eb8cd079e6288d91753

SHA-1:

60cb6f8a4ce918225dfcff2f54cb6f7d24a846b6

SHA-256:

286b270783393a8d880880cf88d4af9ac5abd1cc4ec0989809484994eae4e300

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

1/15/2025 7:43:56 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.InstallMetrix.FileValidated.Installer (M)

16.3.6.7

File size:

1 MB (1,094,232 bytes)

Product version:

1.4.9

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallMetrix Software (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\flashplayer_updater.exe

Digital Signature

Signed by:

File Validated

Authority:

GlobalSign nv-sa

Valid from:

2/2/2016 4:33:01 AM

Valid to:

2/2/2017 4:33:01 AM

Subject:

CN=File Validated, O=File Validated, L=San Francisco, S=CA, C=US

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112127B04ABA745F034A3BB2B235BBD0A1E4

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:m4WAxCGMH40LR+AgKoyiXByynmCywV+/zhwbWDRxwAbNTg5:m4XCDe9Vhw93wVkxHB

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8769

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file flashplayer_updater.exe has been seen being distributed by the following 8 URLs.

http://www.contenthostingvaults.com/c?x=4LZ1lSc2QjV1AfRb1l bdJaO40JyMbNkJnCO7TSgrwg=&c=BiM19xcxZvT3nuQ3wr/xy2w4gO/mXtgPvBK95CIK2dFjWuyuwYZrFr2g4cmJn7E0b3LwO5dMK4H6hGQSlrvsBeaOZpXolIDqP0Y1ygBN4d9QVAjVuhbcKaHXFZk3u2od&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.contenthostingvaults.com/c?x=YbOQNAb kfIL/nqmvCZyLhhnsUY9KgOyr1p5cMd20Cc=&c=XFxgObxdGDAi3q/PEeW23Vxqo/Vejfsr6bN2QgC1ShnF7gwJARnsjVMXOeOMXCiKfQSKnympQM9HlAsm6kXkM4UnCB7od D0oehK LJeDpv9wyLFUPoczfDvUQZto7f3&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.contenthostingvaults.com/c?x=DMQA4 Y/Q2kLyF31dG0i2r51CFEj7qzzjAe6zq4NKYk=&c=Nd5C378Mys/qTiEPsnYYW4ih71m1xhCmCg4xLolXQ N fPMugm7Oo1Ach24lMamAeXNshnrLDCY80KKHBZGaNosdVypQE9jdobNfJSdrcXCBcOX/kUbtSAl4k0ABLyiw&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.contenthostingvaults.com/c?x=u5R8iMFPXOBHOBizB4SkixAKKGoSLXG5WF27B6plHUA=&c=RFYWcCwpPsdGZjL6jPEjneulM22ab/8D8GKhLA5pArw70z64oBWvN/8fYya8boYJxXxqMjiqDf/ga 75ISVF/f2TRD5wASmqFf3LY3/VczcJ0Q6I9XOZqjnJXCDSRni9&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.bundleconceptsshare.com/c?x=3RunaooiuJmuUbawUhbb7xBy6xqohdYvbK9U3W2w9q8=&c=65UhhfJNE7IHsw6hWiGVu/qa7djjanLAlOVwTHykzhQbgq8LqBIDw6J vmKHutguRU0Otbd3zhBc56M2DI3lLbS6w1phbUjzq2iilGQtMtkVIU2lOmMlB/ gduc0Q1CV&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.contenthostingvaults.com/c?x=IA1XsT19/M0LHejyXxH3whBhNpCqXS/cX9LWfQa1WG0=&c=uKcrhD1AtzE7TZkmzW18LW7x2/SjE2127I3 6rCYQATLiF4hlgsTb3N2pQhyzrYFAKxIKuxAuAOs85Q/J5Gb9Q5iujQBnXxpRdJ/DLdA8b52H7X1FPrEKtTy9inlpfLs&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.contenthostingvaults.com/c?x=e4Q6JBnMLsJ7LdGI4F9hbB6RFwcb CBN/9jw4VA5Ki0=&c=voWW2w5adaYxOmp8PdHJc8UNrikhE DKHdkPH2rTJiJ0KUcMWmgYcKNewvheFCeqUrWud9fiejDxoM5HNErc7i4ooVmK/a1OQo2nlyIY3dI6 4XI9VdN5s9oEptiTPB2&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

http://www.contenthostingvaults.com/c?x=01xRu5SOUp UK6oKw2nRuR9YNjx7Rb25C19S1bxPJ3w=&c=ztkzAqUhDJkJcsvDHCxApdC1hAOqbSpATJipPPpCQYduN7tMHm7btDInLF0UAVBXVRyyE0g/nvI 2H g10Pq8eTh IPwzEmnD 5YdU3pf/KJ2V7ZrmD4I5U Hkf9xddJ&downloadAs=FlashPlayer_Updater.exe&fallback_url=http://tundra.site/pages/.../IM_IN.html

Remove flashplayer_updater.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.