home

flashplayerpro.exe

Hotigamama

Perets Smart, TOV

The application flashplayerpro.exe, “Hotigamama Setup ” by Perets Smart, TOV has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.flashcleanapplications.com.
Publisher:
Perets Smart, TOV  (signed and verified)

Product:
Hotigamama

Description:
Hotigamama Setup

MD5:
e05d0c34810d3ae2ad25f2dbc92a8835

SHA-1:
c46345824fe7e40841e5b5c3ec46e6c62e56a956

SHA-256:
ca2e86b0f6cca93ec3299f00094b1c1f905fc466d50202222c8e4d9f8ad3759e

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
12/22/2024 10:06:35 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.2

File size:
961.7 KB (984,816 bytes)

Product version:
2.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\flashplayerpro.exe

Digital Signature
Signed by:
Perets Smart, TOV

Authority:
COMODO CA Limited

Valid from:
5/25/2016 5:00:00 PM

Valid to:
5/26/2017 4:59:59 PM

Subject:
CN="Perets Smart, TOV", OU=IT, O="Perets Smart, TOV", STREET="Bud. 8 kv. 60, bul. Lesi Ukrainky", L=Kiev, S=Kiev, PostalCode=01010, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
13E2E656DC165E1ACE084B816FB003FB

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:v5xNeVWGvbCuXHsxFTThsx0axAKMhkllvcAb+HZ:RiWGvDXsxxqxKhkleAK

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8828

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file flashplayerpro.exe has been seen being distributed by the following URL.

http://www.flashcleanapplications.com/9iSHgQK_vEjB0NuFCE25HgSn86N2h50n1P2irvqzrqp8bO3he04c6vZFlFCN96THfV0iBVtf4PkzJrERUQkDsFEYXBiHgQrKWVpX5X_UVo6zfrsxqDv7uYHxUXksfyA4e2n1mY0_kbZ3cSHvbgqCX0GuN0UMXZ7O3zYe4Oix ZX6bF45HIXJrw6JsFdy5Ge1jK kGSyne BnaBMF1pDi4ldBX4Y1wA8rsIjPR28Fhc7s_E8 c9jYjHNHZlgSjLHPRx7sC 51jhjGS0ZxR9uLsAaW ItV0nQCkpWNufvf 1kOfHmkGU3e2lrPVAhBWYN_G6eE Ec7ZrRn2nuzCMFEtXH6tY66FVHDqlXZSWjSqD1db_uWrDE2D12A9wL l9Dw_lbEz02VA3WORRwIOVv A9i1DW85j1bnZichovMK3QGyzjvIF8Cqc7sRM9iiLf50EgSJXHF_mWdmLgTdQ9ffryfVtzjG UkqfWrFgmn_NY7pIxZ4b6tKHBVruPijzUWxXYRuGt6sLhPmph2mpoPb1LkjIV0Or63e9Pkr9vox_D7tAEs8eaJCJE0i5hI_wypTQLfmJiyNuv3Oe2pk9RSlm0QYgIlaWWKdDP9Tl4KtctZp0Mbw3K7mJeKromegKwiejAheWmYPVb62tXBVS7hZk8SLPGckz9GB_g2Ww9oAAbDLfKoVjk1WNRKRPNfO41ASk c2Ccc Q_njP56 IyxdnoRAI9JcyDJe1HJY15hwiMtK7Lr5IibIR0xGgT5TbB8fa PlMf3gTmCamLc_30MsVbpXsEYZDi4MatusuICMm K5YQgEzfiZjcVS ngCykR7 VQ9uxmD-GzwAAORtm8 QRt34QeNKWgliEI3qQjZpSCIJdikaF PK_Y7pmOI3gMDtNyNbk3FCFVZqRr_oAXkC

Remove flashplayerpro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.