flashplayer_v.85831173c.exe

Awimba LLC

This is the Tuguu DomaIQ download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application flashplayer_v.85831173c.exe by Awimba has been detected as adware by 23 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Awimba LLC  (signed and verified)

MD5:
f024901771a83113ec124cd9f3aef5a2

SHA-1:
bec6f32e54b50c07dfd724cf6f45cf38a3b28f32

SHA-256:
8a6d7b363d9974f04d212fd5a1a7f66826e2cc1d80170bc617e3ce4fdd34e394

Scanner detections:
23 / 68

Status:
Adware

Explanation:
Uses the InstallIQ download installer to bundle various adware offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/5/2024 5:51:20 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Generic.585214
887

Agnitum Outpost
PUA.DomaIQ
7.1.1

Avira AntiVirus
APPL/DomaIQ.Gen
7.11.126.180

avast!
Win32:PUP-gen [PUP]
2014.9-140831

AVG
MalSign.Skodna
2015.0.3365

Baidu Antivirus
Adware.Win32.DomaIQ
4.0.3.14831

Bitdefender
Application.Generic.585214
1.0.20.1215

Comodo Security
UnclassifiedMalware
17661

Dr.Web
Adware.W3i.29
9.0.1.0243

ESET NOD32
Win32/DomaIQ
8.9329

Fortinet FortiGate
W32/DomaIQ.C
8/31/2014

F-Secure
Application.Generic.585214
11.2014-31-08_1

G Data
Application.Generic.585214
14.8.24

IKARUS anti.virus
AdWare.DomaIQ
t3scan.2.2.29

K7 AntiVirus
Unwanted-Program
13.175.10940

Malwarebytes
Adware.DomaIQ
v2014.08.31.01

McAfee
Artemis!EC989276E8AA
5600.7021

MicroWorld eScan
Application.Generic.585214
15.0.0.729

Norman
Obfuscated.gen!r
11.20140831

Panda Antivirus
Suspicious file
14.08.31.01

Reason Heuristics
PUP.Awimba.W
14.8.31.13

Sophos
DomainIQ pay-per install
4.97

VIPRE Antivirus
DomaIQ
25720

File size:
562.2 KB (575,720 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
TUGUU DomaIQ Setup (using Nullsoft Install System)

Common path:
C:\users\{user}\downloads\flashplayer_v.85831173c.exe

Digital Signature
Signed by:

Authority:
GoDaddy.com, Inc.

Valid from:
12/18/2012 5:12:06 PM

Valid to:
12/18/2013 5:12:06 PM

Subject:
CN=Awimba LLC, O=Awimba LLC, L=wilmington, S=DE, C=US

Issuer:
SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
0423F035F20DC9

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:KFQA5ZJcPAhteYG+mKG+1CpZSkvhYoT0fM:KFdvgCG+OzhYmWM

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file flashplayer_v.85831173c.exe has been seen being distributed by the following 13 URLs.

http://yads.zedo.com/ads2/c?a=1491065;x=2317;g=171;c=1856000356,1856000356;i=1;n=1856;s=98;1=8;2=1;tg=1367144472;vr=3;m=451;w=1;p=6;h=1714596;f=1721937;b=10;u=ComtTxZc7c8z0MQT6omwX52T~051112;z=0.714817868403463;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://yads.zedo.com/ads2/c?a=1515922;x=2317;g=172;c=1856000389,1856000389;i=1;n=1856;s=130;1=8;2=1;tg=1367090408;vr=3;m=54;w=38;p=6;h=1714596;f=1755999;b=10;u=q4R2EwrODR8AAC@4In0AAAAD~021612;z=0.29207499463254827;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=14

Remove flashplayer_v.85831173c.exe - Powered by Reason Core Security