home

flashplayerupdate-setup.exe

Mobile Application System Installer

The application flashplayerupdate-setup.exe has been detected as a potentially unwanted program by 8 anti-malware scanners. This is a self-extracting archive and installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from files4.securedownload01.com.
Publisher:
Mobile Application System Installer

Product:
Mobile Application System Installer

Version:
33.7.9.5354

MD5:
c4dd81fa13f4962c6cc18c18f5e38b93

SHA-1:
e42bef0c4bc7b0f5b262c6e62f01ef869a6e0ef6

SHA-256:
5493900ccba1d26d43b2a7f5881795387ac1e24167169cbe718b04332925f244

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
11/23/2024 6:03:41 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160215-2

AVG
Win32/Sality
2015.0.4530

Dr.Web
Win32.Sector.30
9.0.1.05190

ESET NOD32
Win32/Sality.NBA virus
8.0.319.0

F-Prot
W32/Sality.gen2
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Program.DownloadAdmin
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.6460.0

File size:
949.2 KB (971,968 bytes)

Product version:
33.7.9.5354

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\flashplayerupdate-setup.exe

File PE Metadata
Compilation timestamp:
7/21/2014 6:43:22 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:D2MLKmtvPyHu7b8vJAy9pNg4W7HMcKcN+2QHC5k+58:SiKmHyOHoJap7sc/QJX

Entry address:
0xC822

Entry point:
EB, 04, 02, FA, 2C, 70, 68, 57, 4C, B4, 00, 56, 03, C1, C6, C0, 2C, 81, FF, A0, 6F, 00, 00, 76, 05, 8B, FE, 0F, AF, DB, B0, 1F, 84, E4, 18, C8, 33, C8, B7, B7, B3, D7, 85, D1, 2D, 3F, 00, C7, 03, 68, C7, 5B, 90, 00, 68, 73, 41, E5, 00, 81, FE, 73, AF, 00, 00, 70, 06, 0F, BF, C6, 0F, AF, FB, EB, 02, 22, F3, 68, D4, 2A, 45, 00, 50, 8A, DD, F6, C5, 09, E8, 00, 00, 00, 00, 5D, 12, F3, 0B, DE, 68, D6, 35, 05, 00, 68, CD, 4B, 53, 00, 8A, CC, 8D, 0D, D3, 08, E9, A3, 0C, 79, 69, CB, A0, A2, 4A, 19, 43, 0C, 3C, 0F...
 
[+]

Entropy:
7.9620  (probably packed)

Code size:
51.5 KB (52,736 bytes)

The file flashplayerupdate-setup.exe has been seen being distributed by the following URL.

http://files4.securedownload01.com/download/.../dl?bc=1173889&pid=adcash&brand=securedownload01.com&c=FlashPlayer&country=IN&p_tid=20884921111438576803&cb=-1202132662&osName=Windows&osVersion=7&browserName=IE&browserVersion=11&zTmp=1&executable=1191489

Remove flashplayerupdate-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.