home

flashplayersetup__6802_i461870883_il31.exe

The application flashplayersetup__6802_i461870883_il31.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.newhdplugin.net a known adware distribution point operated by Wilmaonline LTD..
Version:
1.1.5.89

MD5:
4d375099e07b6f97f0f23f238e8be75a

SHA-1:
184cd3f78a5417ce4d04dd13a1a1aa652c61f5e1

SHA-256:
7c2d7b4117330d435d94505d1cc68d9cdd55b477a2476195ec79a07e958020e1

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/24/2024 6:52:33 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Amonetize.Installer.Installer.Meta (M)
16.7.9.13

File size:
432.5 KB (442,884 bytes)

Product version:
1.1.5.89

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayersetup__6802_i461870883_il31.exe

File PE Metadata
Compilation timestamp:
3/19/2014 12:46:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:lEyLpyI83nqqdeGB1jfRP4Gfz+MX9Mhc8wvdkroZTVMU7wt5aCC:V83nN/fRfz+2Mhc8wVkrWVjEt5G

Entry address:
0x56000

Entry point:
60, E8, 00, 00, 00, 00, 5D, 8B, C5, 81, ED, CE, B2, 01, 20, 2B, 85, 35, BA, 01, 20, 89, 85, 31, BA, 01, 20, B0, 00, 86, 85, 66, BC, 01, 20, 3C, 01, 0F, 85, BC, 01, 00, 00, 83, BD, 61, BB, 01, 20, 00, 74, 33, 83, BD, 65, BB, 01, 20, 00, 74, 2A, 8B, 85, 31, BA, 01, 20, 2B, 85, 61, BB, 01, 20, 8B, 00, 89, 85, 9E, BB, 01, 20, 8B, 85, 31, BA, 01, 20, 2B, 85, 65, BB, 01, 20, 8B, 00, 89, 85, A2, BB, 01, 20, EB, 61, 83, BD, 69, BB, 01, 20, 00, 74, 58, 8B, 85, 31, BA, 01, 20, 2B, 85, 69, BB, 01, 20, FF, 30, 8D, 85...
 
[+]

Packer / compiler:
ASPack v1.08.04

Code size:
229.5 KB (235,008 bytes)

The file flashplayersetup__6802_i461870883_il31.exe has been seen being distributed by the following URL.

http://www.newhdplugin.net/direct-download.html?version=1.1.5.89&ci=6802&capp=FlashPlayer&ti1=ZydXVpZD05ZmVkODkzNi1kYzFhLTRhZjgtOTllNy04ZjI2MmIxMTQyMGQ

Remove flashplayersetup__6802_i461870883_il31.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.