home

flashplayer_v.115743234c.exe

TUGUU SL

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application flashplayer_v.115743234c.exe by TUGUU SL has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. This file is typically installed with the program Pastor's New Testament Commentary by The Pastor's Helper. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
TUGUU SL  (signed and verified)

MD5:
2bd888317b51c28659f68ac998cdc467

SHA-1:
956755da05a3ca625441d1feb1ed21bd465b2a99

SHA-256:
c1463e73f4ad6fdf61e6ee33d7b4fdceffdb2755a24cc482aea8342c76012624

Scanner detections:
20 / 68

Status:
Adware

Explanation:
Uses the InstallIQ download installer to bundle various adware offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 4:28:12 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.DomaIQ.K
1116

Avira AntiVirus
APPL/DomaIQ.Gen
7.11.124.210

avast!
NSIS:DomaIQ-C [PUP]
2014.9-140114

Bitdefender
Adware.DomaIQ.K
1.0.20.70

Comodo Security
Application.Win32.DomaIQ.~qk
17594

Dr.Web
Adware.W3i.29
9.0.1.014

Emsisoft Anti-Malware
Adware.DomaIQ.K
8.14.01.14.04

ESET NOD32
Win32/DomaIQ
8.9278

F-Secure
Adware.DomaIQ.K
11.2014-14-01_3

G Data
Adware.DomaIQ
14.1.22

IKARUS anti.virus
AdWare.DomaIQ
t3scan.2.2.29

K7 AntiVirus
Trojan
13.175.10814

Malwarebytes
PUP.FakeFlash.Domaiq
v2014.01.14.04

Norman
Suspicious_Gen4.ERZRG
11.20140114

nProtect
Adware.DomaIQ.K
14.01.10.01

Panda Antivirus
Adware/MultiToolbar
14.01.14.04

Reason Heuristics
PUP.TUGUUSL.X
14.8.7.18

Sophos
Generic PUA CF
4.96

Vba32 AntiVirus
TScope.Trojan.MSIL
3.12.24.3

VIPRE Antivirus
DomaIQ
25328

File size:
420.4 KB (430,440 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\flashplayer_v.115743234c.exe

Digital Signature
Signed by:
TUGUU SL

Authority:
GoDaddy.com, Inc.

Valid from:
5/3/2013 7:24:02 PM

Valid to:
5/3/2014 7:24:02 PM

Subject:
CN=TUGUU SL, O=TUGUU SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
2776B257979F9A

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:xFRaLqsbL9s3p5eysb03PvLOHd6bdrjESuiEva:xFYjbLS3pwtuhNui8a

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file flashplayer_v.115743234c.exe has been discovered within the following program.

Pastor's New Testament Commentary  by The Pastor's Helper
www.pastorscommentary.com
About 6% of users remove it
 
Powered by Should I Remove It?

The file flashplayer_v.115743234c.exe has been seen being distributed by the following 50 URLs.

http://dls.nicdls.com/p/151/FlashPlayer/79/.../V.126044921c

http://ad.xtendmedia.com/clk?3,eJytTV1vgkAQ.DW8EcJ9AGdIHw4QUgNWLdTgS3M9DkFFiF4K-Os9pfEXdDLZnZ3ZzQLkFhY3GfixS1tgwK3SBUgwxCEEJdNN13UhAXgGMDQdPevFyS.lctXTrk.XHn0gkuVnTyfsvYTSfNIr8qiBPx7ZZj9ZUbyp6L.AI6TP.vS7-qsYEGp5ht.esPdai7JxCXOQRHMcbxeHfJvJJA1PSW1a-WFxjFOOd2lxTNKv5iOaW7v16.JN1yspOw1RDYaK.CKYrH-FMUhxLhpR1MzgbaOS7tIOo-oNk20zPpOnZVSyOWkoZMW3HDuhoYAVGrTVeK1vj9GBZJiZyroKLuv2rCwMMHEQuAO7O3jb,

http://ad.xtendmedia.com/clk?3,eJytkNtugkAQhp-GO2L2ABVDerF0Q0IrtLRYlRuz7q64FYTApgJPX1Yb0wfon8kcvpnJJAOxDw.sIOYCINdjnmTIh1gyh3G4h3sb-L7vLVxvjl3g2KuLLJ82L-9pQfFlTANitHRWHym5qSARMWb05hlPw8VZbIobilR4IP-iIN4H.DePzF1SUI90veoa6gT3MXpCMd2O23VSLtfPXzmNdJyFZayAk1MOl9kJJ-Nn-ZqdhoSmOC.um4-2fdS6sTCxUDgZbyXT6lvOei3PopJCsRmvq6nTtHU.TLFiuq6Ga-eKZkddlRYOmdjpoZEWpkxY6GEqOzWaEgPQIxdMrFPaAOhOX3aRAZJrVZ93vBZ.JndNyQbZ.gAHNIKa,

http://ad.yieldmanager.com/clk?3,eJydjd1ugkAQhZ-GO0L2D9yG9GKBICVCK12rcGPIshUqiJFNaX367sboA.TkZDL5Zs4MxP4CC0wFEgTWQC4E9CGWNSQuRYDYwPd96ELgUs8j1E6S8BIWapPPQXJ9HwNmlCaEz-ymA3thxkZv1NQwbovjfX5qKnHrAoFQyf6v4PWjuOf1P33.EFHm7J7ikZPgsbZM-5y3fR6JebVNv.LlWmU87rMOthXP3BUXpOLNMePlnG83uFw.ks-23Sp1tjCzUKxdN5Oj-u9BNl3tiHHQaFIW1nyvfs.SwlH3eakHaSFPo6m7GoQB-EEu0GySQnXjyTAPeQDCP2imbFc=,

http://ad.xtendmedia.com/clk?3,eJydTV1vgkAQ.DW8EXMfHEJIH9CDxsaz0WAa-2Iot6mnnBC5CvTX91Bq3zvZZHdmdmcxjaahj7zQAx98ST8wRJhC7uMQh5S5KIoiSsOAIY8h4m5bKOfF.GvVxg07ilk8IOUqW8cjZnZajHMwMJ7yc71t78rGa8bNeQz6cfQfLPHm94.tNv-TB3HZ7d7rozd7bPE1feWr044k.fLt5SSeEyOytBQKH4Re9MssaVfHGO10wkS2ZeIv.8l1D8bUDo0dktoqLpAbdYVJZ-AsNUiVT4pKW6e-VF1vu85Npfubc5MmB6NLh6a53Ju-BofyXDrEt7RR3wOlCHWEIas1ygwCJtTDwXQQoDCqOu-LSg7GVUmoWgBJCNnXZd7DxSGMoDHhB2EJhqk=,

http://ad.yieldmanager.com/clk?3,eJyVjUtrg0AURn-NOzs4j4yKdHHtIJg4CWmVEnfGVyZolGSCOL--FkKzyaaHb3E5HLiYBi4uj5g33Csp8bnPAkxrv2BHvloR2wmCgHjcxy4hLrPFhnqhM8cJfOhMTSH8El3RF7yCAUwQijpKsod5m6rmZfpvQsw-5eOOY2gBWuHBnqyT.szCv0xIR.Z5t0vzc.K9VpLstUyjTiqstiabkjSmW5GZg4FZpgeTPx-82.ZJ69GiYJFoWVERNJfFra-QujTDYsr7TQ.9OIz3EY2npYyudWNR0Q6mKy6oXBpeqGoxGOMfxnRm3w==,

http://ad.yieldmanager.com/clk?3,eJytjd1ugjAYhq-GM0JaCgohO2hlZBI6g8M5d2IqrdiNApNu.ly9xZl5A3vTJt.zvt8PRJHvhYCVnG1YADkC2wgiEXIEoecjG0RRNHL9YOwD17UXB1FPeP-aV5iil5bgQVkyL.BNFb6LPGKS40mc5s7b4dfa0kTifxFxNqS81dPpcLeKA.xE6LEpPPLXFq8Oz25a03NaZ8tUrpYLTYukphJKquYqK97lLCYfNE7kqiCfs.uBB9vead1ZCFtuYl65F0zLH-EctWi4Elwyp2yVSRTTrTqZojNfs8rZaVVbKGF8rU-dsFDctSYaGe7leWBwBIZ7UWrZNoY9hEA4hsbbsKYRfG0GrrO9CV0AkEmullRXC954uxdf36IpT8POC19fiDw=,

http://am10.ru/cu_out.php

http://ad.xtendmedia.com/clk?3,eJylTdtqwjAYfpreFcmph1F2ERcjnVonVmS7kSyJbbS1ZQZtffo16LYH2MfHz3eCH-IkjgBASKo9xJ9POiYJxFoQITVWwgdJkhAQhXEASRz5m6uuXtYzvirGEPbXMXXg1XZd0DsKmlJHh7fYXcYvMpit7hFv2p.lP8H2pJMPnbq.tGAxxcvpuWVk.DubpuD9UFyzW1XOt6-HD5baRc6rhYEmqydwnh.xMufHBdqgDE1I9vfg2fdLa1sPUw.xgfJLC2suetRZfVK1VkaMZFMPTS1sU.eDsKIYlbauPMyF2tm-1R5mQnkoHOzZ3JzFAHQoAEN2NtYFMAiDMMQu0NKa5rSTjXLFNx3ad-E=,

https://secure-nym.adnxs.com/click?ZO3vbI--JUC2ilmKP2UhQBsv3SQGARFAtopZij9lIUBj7e9sj74lQOjRvgZDIKI3e9Zq9oDiiBqCDpBRAAAAAEUBDgAdAgAAXwAAAAIAAABIWWEA65ECAAAAAQBVU0QAVVNEACwB-gC1LwAA9FYAAgUCAQIAAAAAHCPnWAAAAAA./cnd=!xgUiNAjXr1MQyLKFAxjrowogAg../referrer=https://scrabblefb-live2.sn.eamobile.com/live/html_3_9_4a/client/container/.../doubleclick_banner.php?width=300&height=250&secure=on/clickenc=http://network.adsmarket.com/click/i2FvnGfKfJyPYXDEXsp6w4lkcJlmnn6Vt2pwnWKcqZyKZG6WjaF6lJBlag?dp=CP1365975_S541_C6379848_917829&dp2=nym1CPusq7OP0LjEGhACGOij-7WwiIjRNyIOMTA3LjE5Mi45MC4xMTEoAQ..&dp3=Uhttps://scrabblefb-live2.sn.eamobile.com/live/html_3_9_4a/client/container/.../doubleclick_banner.php?width=300&height=250&secure=on

http://dls.nicdls.com/p/151/FlashPlayer/79/.../V.129175330a

http://ad.xtendmedia.com/clk?3,eJylTcluwjAU.JrcImTHzqaoB7OEQhNQkGlELyiNTRbFOCUWkH49DqXLvaMnzZuZp3kQBTmDgAHmAd87HBzbCiDivmNlHnpHJgiCAGMAMfagb24vvJlwnicF6ew6HpMBL25BL-QPFg.uCCnIc0iP7faRb3CXfG2T5JzuyD8Qwc33H826v5h6ZCNnH02Nxz9X81fxNl.0O5rgKF2W63ShYho2cQXsNV3WEZ1dVjUBOxE2q3Tbx7.9T6ZZKtUaiBhWqCc.8UxVZz66Kn5kgrMqG-VS6KQ9yWuvWWRKiv6e3K1RqURjoDBje9W33EDTjBmWo2VXfQ4SAXC1bKC9rlKDAS2EoecOBs9VJY.7XLIhwAC5ALo3HL9.QQ==,

http://ad.yieldmanager.com/clk?3,eJyljNFPgzAQxv8a3pC0vUJoiA8lFR2uLEyE4CMMKRvYZaKQ.fWWSBbf.XLJ.e6-7w5D8I4QeBh5BB-AsooGGBrmuq4ZwUZBEAAzJqWAbZgr9fASI8lD7h5lyBc97sZs4n9Urt3nYcufBHuG.ep.eTr9JcFUUfJ.SJ.C1xU3nJv.rfD5fh7zPqPhLSXy4W2IhmSIj9siVgnZjDKLetnhLrm28zZLkSxyJbNy3olyLtPb5b1tq3E8W8AtEpn6dPRd3Z-cWg9mmqZp2TWX78Y5K5OKrvqj6Q4WCOK5FvEuhugCdWUIfAbkB.bXZfI=,

http://ad.xtendmedia.com/clk?3,eJytTV1rgzAU.TW-ieRDjUX2EOeElqrrZin1pWRJajNM7dZQtb9-Bsv2B3Y4XM7H5V6IYxAhxHggOCEfYeCjGGK5YCQCLDy6II5jjBYhIdCPsLvtZft8.LqVTQLh2CfUIl-OVU9nNDSndDnr18jOJOtXQb2Zo7v31tL.gaiHx1H7r5mYRvR90.r6009-t1IKCp2PZbrv17uVKtKNyauszRVU5W7bryvu11WhiuoF19Xez..uP7nuyZiLg6mDson8WzKjbtIbjDwLLYViHu.01GhmOj1OwrDGOxndOjhj4mDGi3RwyoSDwsle1d1aDMCAAjBlV2VsADEmEBIbSG5Udz7wTtgC4SD8AfjJeOc=,

http://ad.yieldads.com/clk?3,eJydjdFygjAQRb8mb9RJNhHCMH0IgpYWaG2ZdvTFQYgaC0glFuvXN07VD-idfbh79u4uoV5ZEk4cMgQpmV24K49QyXmZA9jSwp7nAQNGh8zF3ILTEw-b2ehlHbSPo94XZ8Xb.k1ctBahENGf90NhAuOgiO-ml.FXj-Fia5cw8X.5oDfXq-Zfb14HXCzVQ64C5t9ik9dtAhFOJwmLPyL2nCU6ycZVoohK4P0zzgo2z1KVZmE.n0zpbHrbvLesjdYtogLB2FReDnZNpRqZl53cfw-KXW1opxE1o4X-aSWigVrt81oisA3q1OmMKMZHGGLDOllotWsMY9im3AbD2sNycdhXhiFgyPGvvRP8AtyldVk=,

http://w23.am15.net/bn3.php?k=19e7397a2e72080d35e4570a5e9bfb56

http://ad.xtendmedia.com/clk?3,eJytjdGOgjAQRb-GN0JoCwoh-1AkrO4KURdFeCGlbaBKxWizoF-.sBqzH7A3k8mdc2cyAHmwJKB0SgfRKUXMcT2AuFtyc4qgqZue500tG0DHRpa-7Xgz26wOn53.Dr6OPh4V5rukww9VeI3x4uFXztj9kMXJ.pnPe1fif9FsCzfrp1-Mf3EVOHi3n1fybvmvtQDfMhihOA3rZfohYrhQURI2kQAiDvLDMqFWnrBjlGYguzdNXL0u33S9VuqsIazBcCh64USJb270ip-Y5EwQg7ZySCRRrbwNRpHKqJVsNBQSVqjbmWsoIEyDk2G8ivs4ItPsoW0O7CrUCACaTCz4CzhVoj0VtGVjIE5XflHFX1rU.MJ.AF4dgdg=,

http://ad.yieldads.com/clk?3,eJydjUlvgzAQhX8Nt6gyXsAR6sGI0KYNUtJSpckFGQNmDU5CwvLrS5Y2934aPc88zfjpyEqmcQQ4FoASanIMLB3FnMQ4JAmYAMuykI4opjox0IRdmC2-V8x-HT5r-zovVtEXuyPZjLH5rV.Sizru-t3fyJvlHMvwvrm0XwT7P840-fi9H.PaMdqhTJjLQvnYfqytiJd77Tb34GL9VnjOvPF8t.QyPd0Mslv4Am.9qPD8TecNUb5d.V0-TyZp0ygNMQ26Y52UPPAo7uvTocyS-EnUoynKTBTjm8v0WMJC7IdY9dWp7agyWpztuUrLHS66XBb9rmrzRLWIt6e-J72q6jQVQ5loyI3GGOdQdQE3dEINEwZqFGRAGJxBcKiLkqd1xTVIIBBZ0wdHDCiCJg2EPsUQQAqD0DSQTqAGjUjB8Tt-ISa1kqFxFjK8ziFujvyO5A8UvWiUtGIY7n6u0h.JGqib,

http://network.adsmarket.com/.../i2dvlmfKfZeMZ2zEXsp6w4lkcJlmnn6Vt2pwnWKcqZyKZG6WjaF6lJBlag?dp=M028ONIL3IFZBM6I

http://cp.tuguu.com/pasarela/affp/.../pub_id=153281&ce_cid=20nDT13AWcPM7TsL1fqVbL1uBwvm000.&__tc=1368366001.12

http://dls.nicdls.com/p/151/FlashPlayer/79/.../V.115273422c

http://dls.nicdls.com/p/151/FlashPlayer/79/.../V.125033218c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/79/.../769.4.92.0773db02

http://cp.tuguu.com/.../download.php?p=769&_so=1&_bw=3&_sv=6.2&_bv=26.0&_ip=1668074989&_cc=US&asdd=1&_qs=ce_cid=20lodZ0snw.gEUHO1OT4vj1uBMTU000.&pub_id=9177?ce_cid=20lodZ0snw.gEUHO1OT4vj1uBMTU000.

http://cp.tuguu.com/pasarela/affp/.../ce_cid=20lodZ0snw.gEUHO1OT4vj1uBMTU000.&pub_id=9177?ce_cid=20lodZ0snw.gEUHO1OT4vj1uBMTU000.

http://network.adsmarket.com/click/kWJwnI2kfpeJkGnEXsp7l49lcZhinKmdj2ltlo2jfJeNYpibXpuCmIk?dp=RMX_A6679693_P4643186_V21609859_RSacramento_S4362171_C20178431_B744777&dp2=g71JAbuPQgD.5TMBAAAAAOorTwAAAAAAAAAYAAoAAAAAAAIAAQACAYEjSwAAAAAActlGAAAAAACN7GUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADS5xUAAAAAAAIAAwAAgD8A09u5nD4BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=,eJwzMbQIDw0Lzc8Oz630MvfINa8oMvZJ9zEztbSM9ylLtvQvLyz2LNfVBQAHcwzz&dp3=Uhttp://supremeadserver.com/www/.../afr.php?zoneid=6&cb=insert_random_number_here&ttl=game of thrones

http://cp.tuguu.com/pasarela/affp/.../pub_id=153281&ce_cid=20nDT11fCY6RNJGM1MDNif1uC7jy000.&__tc=1368507501.04

http://ad.yieldmanager.com/clk?3,eJydTdtugkAQ.RreCOG2XEL6sLiF1LhaIoboi4FluZSbXddS-.VOU43vPZlMzsycc8awgrJwPdv2C9PJHbuyvMCwuM8KnzHEVT0IAgN5yHJ8XTfU2jWWuLi8JzXRUEpD.IvNJNIZP7DHeLrTN4wTvMD714.t.c5kH.-xxdqNd.j.IFv0.fDDH8iviYd19olGYodP2bKjZN1t4t11lS3bTUYlTaOetjpam1G.Spl9SMuOZofmQBJEnw9eVLWR8qRYWDEjqPPlJPjA8.LMxRcXGpsG2M7zDL3kfQu7K9C8EtqpAVv0M428LRWLOIrpsAJIO4JXHkU-ltNwHC9DwcWx4YKDQMoeFHU-wBBOFTTZCEg43wCpnX1v,

http://dls.nicdls.com/p/151/FlashPlayer/79/.../V.124133143c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/79/.../769.4.92.07661f17

Latest 30 of 143 download URLs

Remove flashplayer_v.115743234c.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.