» flashplayer_v.112365025c.exe
Overview
Analysis
File Details
Downloads (91)

flashplayer_v.112365025c.exe

TUGUU SL

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application flashplayer_v.112365025c.exe by TUGUU SL has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

TUGUU SL (signed and verified)

MD5:

2369bed04897024d4897b59f4c6f32b5

SHA-1:

34d5219c2bee1de6ce2f74c1b7a2408261350c02

SHA-256:

3153146e1535d2dac2459e11694cb45baae3d155ea5e11a18007b62fa461c0f5

Scanner detections:

17 / 68

Status:

Adware

Explanation:

Uses the InstallIQ download installer to bundle various adware offers.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

12/25/2024 12:10:01 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/DomaIQ.Gen

7.11.119.158

avast!

NSIS:DomaIQ-C [PUP]

2014.9-140428

Comodo Security

ApplicUnwnt

17435

Dr.Web

Adware.W3i.29

9.0.1.0118

ESET NOD32

Win32/DomaIQ

8.9171

Fortinet FortiGate

W32/Crypt.AALD!tr

4/28/2014

IKARUS anti.virus

AdWare.DomaIQ

t3scan.2.2.29

K7 AntiVirus

Trojan

13.174.10509

Malwarebytes

PUP.FakeFlash.Domaiq

v2014.04.28.02

Norman

Suspicious_Gen4.ERZRG

11.20140428

Panda Antivirus

Adware/MultiToolbar

14.04.28.02

Reason Heuristics

PUP.TUGUUSL.X

14.8.7.18

Sophos

Generic PUA CF

4.96

Trend Micro House Call

ADW_DOMA

7.2.118

Trend Micro

ADW_DOMA

10.465.28

Vba32 AntiVirus

Trojan.MSIL.Crypt

3.12.24.3

VIPRE Antivirus

DomaIQ

24332

File size:

420.4 KB (430,440 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup (using Nullsoft Install System)

Common path:

C:\users\{user}\downloads\flashplayer_v.112365025c.exe

Digital Signature

Signed by:

TUGUU SL

Authority:

GoDaddy.com, Inc.

Valid from:

5/3/2013 6:24:02 PM

Valid to:

5/3/2014 6:24:02 PM

Subject:

CN=TUGUU SL, O=TUGUU SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2776B257979F9A

File PE Metadata

Compilation timestamp:

12/5/2009 10:50:46 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:xF0H2zHZA2iIcWaF7cUdVvLqfiujEVpzuu2Z:xFo45A2ldaFPd17KEVpH2Z

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Entropy:

7.9395

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file flashplayer_v.112365025c.exe has been seen being distributed by the following 50 URLs.

http://yads.zedo.com/ads2/c?a=1492734;x=7181;g=172;c=1856000373,1856000373;i=0;n=1856;s=128;1=8;2=1;tg=1368063202;vr=3;m=218;w=37;p=6;h=1714596;f=1723964;b=10;u=mnct@AoBADQAAHCAHiEAAACO~112609;z=0.6784002745346058;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=12

http://yads.zedo.com/ads2/c?a=1532899;x=2317;g=171;c=1856000415,1856000415;i=1;n=1856;s=138;1=8;2=1;tg=1368312626;vr=1;m=451;w=1;p=6;h=1714596;f=1764834;b=10;u=IQZxjwkASUinsATxp65IEg**~051113;z=0.2589013421915074;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=45

http://yads.zedo.com/ads2/c?a=1488443;x=2317;g=41;c=1856000382,1856000382;i=2;n=1856;s=129;1=8;2=2;tg=1368037716;vr=2;m=237;w=4;p=6;h=1714596;f=1719164;b=10;u=TPNBUKNX0P@QWnQAekjva7tf~090112;z=0.9114425753045967;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=1

http://yads.zedo.com/ads2/c?a=1488443;x=2317;g=41;c=1856000382,1856000382;i=0;n=1856;s=129;1=8;2=2;tg=1368469079;vr=2;m=204;w=4;p=6;h=1714596;f=1719164;b=10;u=zHfECgrODR8AAEEYM5UAAAEW~041412;z=0.9932275670389997;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=1

http://yads.zedo.com/ads2/c?a=1563946;x=7949;g=123;c=1856000462,1856000462;i=0;n=1856;s=143;1=8;2=8;tg=1368197461;vr=2;m=4095;w=7;p=6;h=1714596;f=1799984;b=10;u=wIGuekx-TFiarAx68CtmYA**~051013;z=0.6558323508978925;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=99

http://yads.zedo.com/ads2/c?a=1556387;x=7181;g=172;c=1856000458,1856000458;i=0;n=1856;s=91;1=8;2=1;tg=1368574698;vr=2;m=56;w=46;p=6;h=1714596;f=1795024;b=10;u=1YTPFQoBAIoAAB@l@kEAAAAX~031713;z=0.38416282399412216;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=12

http://yads.zedo.com/ads2/c?a=1490641;x=2317;g=49;c=1856000389,1856000389;i=0;n=1856;s=130;1=8;2=4;tg=1368493032;vr=4;m=11;w=28;p=6;h=1714596;f=1721773;b=10;u=2X5@TBJfKDEVK3lyPVf1Wy2n~090110;z=0.9940898728465959;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.119629518a

http://yads.zedo.com/ads2/c?a=1559312;x=7949;g=23;c=1856000385,1856000385;i=0;n=1856;s=129;1=8;2=12;tg=1368502455;vr=2;m=6;w=18;p=6;h=1714596;f=1796487;b=10;u=4jglUGOxhlRXb9UndzNRMAAV~081012;z=0.4098641247686373;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=55

http://yads.zedo.com/ads2/c?a=1515924;x=2317;g=172;c=1856000389,1856000389;i=1;n=1856;s=130;1=8;2=1;tg=1368558293;vr=3;m=7;w=8;p=6;h=1714596;f=1755999;b=10;u=w7dfUB5CXozbBuFQkLsERUbM~092412;z=0.9637286621908159;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=14

http://yads.zedo.com/ads2/c?a=1490641;x=2317;g=49;c=1856000389,1856000389;i=0;n=1856;s=130;1=8;2=4;tg=1368379323;vr=4;m=11;w=28;p=6;h=1714596;f=1721773;b=10;u=fahRbAoBADQAADhScRUAAABX~061512;z=0.3205095888367645;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://yads.zedo.com/ads2/c?a=1491150;x=2317;g=27;c=1856000356,1856000356;i=78;n=1856;s=98;1=8;2=1;tg=1368171123;vr=3;m=50;w=8;p=6;h=1714596;f=1722024;b=10;u=unknown;z=0.9035439197727252;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.117319272a

http://yads.zedo.com/ads2/c?a=1492800;x=2317;g=171;c=1856000389,1856000389;i=2;n=1856;s=130;1=8;2=1;tg=1368559674;vr=3;m=9;w=4;p=6;h=1714596;f=1724156;b=10;u=EDhRGOGFRZiNpMzyCK2mXw**~051413;z=0.9676828411713465;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=14

http://yads.zedo.com/ads2/c?a=1488722;x=2317;g=171;c=1856000382,1856000382;i=0;n=1856;s=129;1=8;2=1;tg=1368540042;vr=3;m=733;w=1;p=6;h=1714596;f=1720193;b=10;u=LqjITw1SoshUPIlGpxAFc5N5~060112;z=0.7819689380436752;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=1

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.127067824b

http://yads.zedo.com/ads2/c?a=1526737;x=2317;g=172;c=1856000415,1856000415;i=7;n=1856;s=138;1=8;2=1;tg=1368128634;vr=2;m=179;w=34;p=6;h=1714596;f=1764831;b=10;u=z8NtUddCY5qLs4Evx8jaVrFA~041613;z=0.6996853755221902;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=14

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.126038615c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../825.74.110.07833257

http://cp.tuguu.com/.../download.php?p=825&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1648749956&_cc=US&asdd=1&_qs=ClickID=ZZf1785327Za1544823Zg172Zw30Zm115Zc1856000441,1856000441Zs141Zi1ZZ&PubID=14&__tc=1368468709.06

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1785327Za1544823Zg172Zw30Zm115Zc1856000441,1856000441Zs141Zi1ZZ&PubID=14&__tc=1368468709.06

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.124970427c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.0772e5bb

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.124970426c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.0772e5ba

http://cp.tuguu.com/.../download.php?p=857&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1221006651&_cc=US&asdd=1&_qs=ClickID=ZZf1755999Za1515924Zg172Zw21Zm6Zc1856000389,1856000389Zs130Zi0ZZ&PubID=14

http://tc.nicdls.com/tracking/a/.../ClickID=ZZf1755999Za1515924Zg172Zw21Zm6Zc1856000389,1856000389Zs130Zi0ZZ&PubID=14

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.127041545c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.07928009

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.127041366c

Latest 30 of 91 download URLs

Remove flashplayer_v.112365025c.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.