» flashplayer_v.136127643c.exe
Overview
Analysis
File Details
Downloads (19)

flashplayer_v.136127643c.exe

TUGUU SL

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application flashplayer_v.136127643c.exe by TUGUU SL has been detected as adware by 21 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

TUGUU SL (signed and verified)

MD5:

5ae68f408860f493758a6b8a8598f5ff

SHA-1:

ad811fa735032a75cb8efbdac683a0556af16e07

SHA-256:

6c55cdc1f75078a3ca1ab1263552fc04c18c719afbdc7e7d5cb78da283161606

Scanner detections:

21 / 68

Status:

Adware

Explanation:

Uses the InstallIQ download installer to bundle various adware offers.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/25/2024 4:08:32 PM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.DomaIQ

7.1.1

Avira AntiVirus

APPL/DomaIQ.Gen

7.11.122.188

avast!

NSIS:DomaIQ-C [PUP]

2014.9-140806

Bkav FE

W32.Clode5f.Trojan

1.3.0.4613

Comodo Security

ApplicUnwnt

17523

Dr.Web

Adware.W3i.29

9.0.1.0218

Emsisoft Anti-Malware

Gen:Variant.Adware.Graftor.111772

8.14.08.06.10

ESET NOD32

Win32/DomaIQ

8.9506

Fortinet FortiGate

W32/Crypt.AALD!tr

8/6/2014

herdProtect (fuzzy)

variant of flashplayer_v.134432620c.exe (Adware)

2014.9.28.21

IKARUS anti.virus

AdWare.DomaIQ

t3scan.2.2.29

K7 AntiVirus

Trojan

13.174.10656

Malwarebytes

PUP.FakeFlash.Domaiq

v2014.08.06.10

McAfee

Artemis!8081A62A8030

5600.7046

Norman

Suspicious_Gen4.ERZRG

11.20140806

Panda Antivirus

Adware/MultiToolbar

14.08.06.10

Qihoo 360 Security

HEUR/Malware.QVM06.Gen

1.0.0.1015

Reason Heuristics

PUP.TUGUUSL.X

14.8.7.18

Sophos

Generic PUA CF

4.96

Vba32 AntiVirus

TScope.Trojan.MSIL

3.12.24.3

VIPRE Antivirus

DomaIQ

24910

File size:

420.3 KB (430,368 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup (using Nullsoft Install System)

Common path:

C:\users\{user}\downloads\flashplayer_v.136127643c.exe

Digital Signature

Signed by:

TUGUU SL

Authority:

GoDaddy.com, Inc.

Valid from:

5/3/2013 7:24:02 PM

Valid to:

5/3/2014 7:24:02 PM

Subject:

CN=TUGUU SL, O=TUGUU SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2776B257979F9A

File PE Metadata

Compilation timestamp:

12/5/2009 11:50:46 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:5Foq3JAVBTRRFW829bI5uT2XoLfPfmjUXJCwk:5FosJwLW829bhi+PmjUMwk

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file flashplayer_v.136127643c.exe has been seen being distributed by the following 19 URLs.

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1799949Za1563747Zg171Zw1Zm451Zc1856000462,1856000462Zs143Zi0ZZ&PubID=99&__tc=1368735996.45

http://yads.zedo.com/ads2/c?a=1515924;x=2317;g=172;c=1856000389,1856000389;i=1;n=1856;s=130;1=8;2=1;tg=1368760973;vr=3;m=30;w=8;p=6;h=1714596;f=1755999;b=10;u=Ufj1UJcYwTdTWSRVxDl9LyQ2~011613;z=0.7432017666242369;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=14

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1799920Za1563614Zg172Zw11Zm95Zc1856000463,1856000463Zs143Zi1ZZ&PubID=2&__tc=1368659721.11

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.135143204c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.080e1f24

http://cp.tuguu.com/.../download.php?p=857&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1483244774&_cc=GB&asdd=1&_qs=ClickID=ZZf1746666Za1507316Zg171Zw1Zm475Zc1856000373,1856000373Zs128Zi1ZZ&PubID=12

http://tc.nicdls.com/tracking/a/.../ClickID=ZZf1746666Za1507316Zg171Zw1Zm475Zc1856000373,1856000373Zs128Zi1ZZ&PubID=12

http://yads.zedo.com/ads2/c?a=1507316;x=7181;g=171;c=1856000373,1856000373;i=1;n=1856;s=128;1=8;2=1;tg=1368748449;vr=3;m=475;w=1;p=6;h=1714596;f=1746666;b=10;u=HsOZVjd7Q72KsyglSYyBtQ**~042613;z=0.5513244336167492;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=12

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.135133584c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.080df990

http://cp.tuguu.com/.../download.php?p=857&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1483244774&_cc=GB&asdd=1&_qs=ClickID=ZZf1746666Za1507318Zg171Zw1Zm475Zc1856000373,1856000373Zs128Zi0ZZ&PubID=12

http://tc.nicdls.com/tracking/a/.../ClickID=ZZf1746666Za1507318Zg171Zw1Zm475Zc1856000373,1856000373Zs128Zi0ZZ&PubID=12

http://yads.zedo.com/ads2/c?a=1507318;x=7181;g=171;c=1856000373,1856000373;i=0;n=1856;s=128;1=8;2=1;tg=1368748216;vr=3;m=475;w=1;p=6;h=1714596;f=1746666;b=10;u=HsOZVjd7Q72KsyglSYyBtQ**~042613;z=0.3845720464139474;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=12

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.134329575c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.0801b4e7

http://cp.tuguu.com/.../download.php?p=857&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1092681476&_cc=US&asdd=1&_qs=ClickID=ZZf1755999Za1515922Zg172Zw11Zm155Zc1856000389,1856000389Zs130Zi2ZZ&PubID=14

http://tc.nicdls.com/tracking/a/.../ClickID=ZZf1755999Za1515922Zg172Zw11Zm155Zc1856000389,1856000389Zs130Zi2ZZ&PubID=14

http://yads.zedo.com/ads2/c?a=1515922;x=2317;g=172;c=1856000389,1856000389;i=2;n=1856;s=130;1=8;2=1;tg=1368727104;vr=3;m=155;w=11;p=6;h=1714596;f=1755999;b=10;u=80FQNgoBADQAAEG6PGEAAABF~030813;z=0.5290461128389305;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=14

http://yads.zedo.com/ads2/c?a=1491054;x=2317;g=49;c=1856000389,1856000389;i=0;n=1856;s=130;1=8;2=4;tg=1368781370;vr=2;m=11;w=28;p=6;h=1714596;f=1721773;b=10;u=UeFkTtlXOdMRj0cob9h1XAqQ~090511;z=0.03985320008326343;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

Remove flashplayer_v.136127643c.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.