home

flashplayerupdate-setup.exe

Mobile Application System Installer

The application flashplayerupdate-setup.exe has been detected as a potentially unwanted program by 9 anti-malware scanners. This is a setup and installation application, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from files4.securedownload01.com.
Publisher:
Mobile Application System Installer

Product:
Mobile Application System Installer

Version:
33.7.9.5354

MD5:
ba8b315319f6fd64886c973b3cb3b977

SHA-1:
ef2ded5a0c5416a14cd7cf136ab261ed403f59be

SHA-256:
726e3503351a5a9ccb45b9dc4ccde3b57aa56b47997e52a3705de7149c95d632

Scanner detections:
9 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 4:30:17 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Sality
160215-2

AVG
Win32/Sality
2015.0.4530

Dr.Web
Win32.Sector.30
9.0.1.05190

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Program.DownloadAdmin
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.6510.0

VIPRE Antivirus
Threat.4721115
47240

File size:
953.2 KB (976,064 bytes)

Product version:
33.7.9.5354

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\flashplayerupdate-setup.exe

File PE Metadata
Compilation timestamp:
7/8/2014 9:57:24 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:QVMLKmtvPyHu7StwReMVKyaqy9pNg4W7HMcfcN+2QHCC9pk3S:2iKmHyOGtMVKZkp7scmQZp5

Entry address:
0xC822

Entry point:
02, DB, F2, C7, C1, 44, 2D, 31, B8, 69, DE, 23, AB, 50, A8, 0F, B6, C6, 85, CB, 74, 01, 4E, 8D, 15, DE, 4B, F7, F9, 25, 22, 38, 23, 22, 32, E8, 86, C8, F2, 50, 85, DE, FE, C4, 80, D8, 86, 5D, 3B, F3, 72, 04, FE, CE, 12, F5, 47, F2, 2B, DB, F6, C1, 08, F7, C7, 23, 60, 4D, AE, 8B, DD, 85, F2, 74, 04, 86, C0, 42, 47, C6, C0, 72, 13, C5, F7, C3, 55, CA, CB, 43, C7, C6, 12, 68, DE, 92, 88, E3, BB, D2, 69, 30, 0F, E8, 20, 00, 00, 00, 70, 08, C6, C7, 6F, 0F, AF, D5, FF, C3, 85, CA, 73, 0A, 89, F5, 10, EF, 81, FB...
 
[+]

Entropy:
7.9619  (probably packed)

Code size:
51.5 KB (52,736 bytes)

The file flashplayerupdate-setup.exe has been seen being distributed by the following URL.

http://files4.securedownload01.com/download/.../dl?bc=1173889&pid=adcash&brand=securedownload01.com&c=FlashPlayer&country=IN&p_tid=20884921111438576803&cb=1079032001&osName=Windows&osVersion=7&browserName=IE&browserVersion=11&zTmp=1&executable=1191465

Remove flashplayerupdate-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.