home

flashplayerpro.exe

Hotigamama

Perets Smart, TOV

The application flashplayerpro.exe, “Hotigamama Setup ” by Perets Smart, TOV has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.hostingbitspackage.com.
Publisher:
Perets Smart, TOV  (signed and verified)

Product:
Hotigamama

Description:
Hotigamama Setup

MD5:
ef51d6f7b4899c95c87bcad9e69fe9ff

SHA-1:
d497a2e97abca1b32c6ca858332c5536a7cd998d

SHA-256:
c961a453e448f3d8f7f7326e362584d44b1613ddaafbfefd709f9df4c3ace4f2

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/24/2024 4:13:40 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.4

File size:
961.7 KB (984,816 bytes)

Product version:
2.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\flashplayerpro.exe

Digital Signature
Signed by:
Perets Smart, TOV

Authority:
COMODO CA Limited

Valid from:
5/25/2016 5:00:00 PM

Valid to:
5/26/2017 4:59:59 PM

Subject:
CN="Perets Smart, TOV", OU=IT, O="Perets Smart, TOV", STREET="Bud. 8 kv. 60, bul. Lesi Ukrainky", L=Kiev, S=Kiev, PostalCode=01010, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
13E2E656DC165E1ACE084B816FB003FB

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:/5xNeVWGvbCuXHsxFTThsx0axAKMhkllvcAb+HZ:BiWGvDXsxxqxKhkleAK

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8828

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file flashplayerpro.exe has been seen being distributed by the following URL.

http://www.hostingbitspackage.com/qEWDjfMKhzHwjJgEkMC_8izTyZ YX_pzYsns0oRxsquzxCLtVU5pZKlMbz3P7Bk1E4pxauwBRb59XpPsAMYd9ZtGzEp5Z6PHWV4TpwEGmyP3Gtw0NGlWF5qoj7fOI7UqJ4GULhBbyd307o9mybi9txDY_2rfqwiCHhHDHXfYX3BgtFJT_1 TFaezBtcFoM7kUy3u5kORKiTyqg8Fd0NumG7_4lfM4C4l5gCLSOqgD0wUr_mE4WoRhvmIc3FeJJH5d3rYamx_vOrTXtOaBCrm17TLy9V2QZ9U7YVBodOkYLdN B7DoL7qc59N0Ku2UbSFumb74zdcWHLHMEecL3vyArBvT9maxAJd7C8XcXnBsqe4hdrmpEliFpH5XTJyfFpyjbwdGZEPPlX4QUECt6LGerNzljck7Hyg2F0ttE9mmdgYIIEaboJzQTFaJioZnRz_VtsNHha2MZFqvMhF2oKYNXznvH4JzcjJn5bpOZdskpwhcOkZzh8pBfrabrG_sGR79TdsxRHaDm7JksuxGSgEyGf YZ7Kv2ywkGaVP23CLj3cqB81AaaDL0TAmf_hS IdXdNjfgkO5ez8OxvTkjecGHM8i7GB01e_iUiXQkJAIszsHU9nswWBN3EFG8tSmJxrzdDGmxO84Nu8Zpx5ve6lEbCTC rxDU1_mr HDLRyb1hz6s KKJcC4Rj CSJjZNiYxm9ohp ZRXRj9A3UHgF8lCEaoyxjlCZrqDP_ KpCo1rSOMetskctgpKOrXy1gtUsSaEoxTbnkHETb1vkswTSdPj2gjl_gspw7PyJxYdhsID2JX3c95uAurBoE27TBr2YiS6HIjLl-GzwAAORtm8 QRt34QeNKWgliEI3qQjZpSCIJdikaF PK_Y7pmOI3gMDtNyNbk3FCFVZqRr_oAXkC

Remove flashplayerpro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.