home

flashplayersetup__4121_i512924423_il8.exe

The executable flashplayersetup__4121_i512924423_il8.exe has been detected as malware by 1 anti-virus scanner. The program is a setup application that uses the Amonetize Downloader installer, however the file is not signed with an authenticode signature from a trusted source. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars. The file has been seen being downloaded from ams1.ib.adnxs.com and multiple other hosts.
Version:
1.1.1.72

MD5:
9dcf4f64e3bf61da0789c399a0f47694

SHA-1:
52c13977b29bfd2251ec039831284180fbb3fede

SHA-256:
5ff8fc61aa7a42c78dd9e425cc70bb63ac7ce93df00d72e97e945e56b44b5ce0

Scanner detections:
1 / 68

Status:
Malware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 1:56:32 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Threat.Win.Reputation.IMP
16.1.5.4

File size:
343 KB (351,232 bytes)

Product version:
1.1.1.72

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayersetup__4121_i512924423_il8.exe

File PE Metadata
Compilation timestamp:
3/31/2014 9:54:40 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:MtXyzLSmXqhNYRZQn+kqBuUJSdTdRe/MSYpO9Epo10AfIm3LFMBK:MtXyzLSqqhQZQn+k6uUc95Oupo13fKB

Entry address:
0x29BD1

Entry point:
E8, C6, 97, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F...
 
[+]

Code size:
244.5 KB (250,368 bytes)

The file flashplayersetup__4121_i512924423_il8.exe has been seen being distributed by the following 5 URLs.

http://ams1.ib.adnxs.com/click?XYsWoG01mz9dixagbTWbP2iR7Xw_NeY_XYsWoG01mz9dixagbTWbP1tLbByVIQBhXJ9uTd_LL14CvzlTAAAAABRoIwB2AgAAdgIAAAIAAADpIdEA3q4FAAAAAQBVU0QAVVNEANgCWgCq4AAAPdkAAgQCAQIAAIwAJCPX0wAAAAA./cnd=!9AbhQAiH_dMBEOnDxAYY3t0WIAQ./referrer=http://www.diziizlehdfull.net/karagul-39-bolum-izle-28-mart-2014.html/clickenc=http://.../direct-download.html?version=1.1.1.72&ci=5561&capp=FlashPlayer&ti1=ams1CNy-uuv0-_KXXhACGNuWsePRsoiAYSINNzguMTY2Ljk2LjE4NCgBMIL-5pkF&ti2=2320404&ti3=${APN}

http://adk2trk.cpmrocket.com/event/click/0/ojNIaiWG_FMq2BjISCDDyfGVk3JHF1R3oOgiiy22hHJRwDRblLbz33NlOQ67Lb79zuU_lOAWEvy03XxFFBPD1k-qPzEQK_br9-tMBaMQHOroXfAZJ4iHOlRvIVFhHcdHZX2bJC_LQ-SqeQGl7uw0fuz2q-uKTyvvlBBG12atOz-oqhSxAYZxPGDEQlZ-iQGLtq82ggjyfpnVwbuceBKu4jHLL-5Cvzz3wAE4_4k9OGG4Tgu70CbcQVw18FQyiRJ9XY-ezbkaQdW_W3U5zBYx3bR_Hx07IxLjw4P4EIeR9lAngIMUzVaULlSRPCvRsRDl8BNxdpBzKIJVy7PhoK4Vycg4lMJXQhD1DqBQ5rqZdXVYE85h8dEf3Ngl-EDKag/.../

http://www.installpath.com/dd/alldd.html?myref=www.newhdplugin.com&version=1.1.1.72&prefix=FlashPlayerSetup&campid=5560&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=nym1CJj37tzNgebBQhACGP6E1pqYsuGUASIOMTkwLjE1Ny42NS4xNzgoATDUmeiZBQ..&capp=FlashPlayer&ti2=2239572&ti3=${APN}&AMt=1396313328887&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://adk2trk.cpmrocket.com/event/click/0/snJ8DvNwtkw-R7Jkb2LY6zaf0yHZCMc26_9kkEaU73pAuc21b3ZkcJefkci4Pn6-NmwZ3DAT5dDRGrFf1de2c868FHskRtSocvwQxFZ2hU4POVnmBvw2SInQsnoqcHAtMsXQKYwc6bJd8lnag7WQLGEanjFfkRBnCU-uCzKLtkn0fUwuNG0va2qZ77T4xtS7qKydi5cGHUrSekV6APwjuJfnAOReSt4-Y3XP-Kj1VjwRZExy46N52r-NmcAugg4_dzs4WdonSY9pW81KQUSZabtoFj4jBhr6KeAxymQlbd0gzhqazbxpfLTXodeuYpW4Mp52gyQmYxDPpj2Aug-HtH3i0snBWHnHMEFuFgP_qgtWpbRTw5n4RIIqLMk3wA/.../

http://adk2trk.cpmrocket.com/event/click/0/vyUgBwmdh7vWy_H7imaIA7DfgOsUgcRJm9I1m-yqNeBebo21JPB-taL5nYu3r0tSyppHaS5bPdmyTGcDo0wLL7gaqncRlPmu4gn-H4rVZ8K1o_DIUU41WRCrGegdAvKorrNGjjFRKE9cULbb3jtyJw56CqDn75aIuAmhmdvEcbsRoJrMCAuEZ2CizubbCy6q5Y6F_pFhtKKI6OUdy-dmB96qV9roNZekffH0ZPX3Nc94HwWuHzUbaMWsq9XJ2D6OV-CMzxoywBlK33dQkHqHuT2gk5wVxbJctavgDJLxfJGX_vS_hcHmbxpMviKJkZsyk_rsPCH_uuL9j7hvkqUo4Ja7fY2cz0OI_05MCOJAKLDTR7fuWcoOsvdEO1PJ1A/.../

Remove flashplayersetup__4121_i512924423_il8.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.