» flvplayer-chrome.exe
Overview
Analysis
File Details
Downloads (105)

flvplayer-chrome.exe

VASSANA KONGSOONGNERN

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application flvplayer-chrome.exe by VASSANA KONGSOONGNERN has been detected as adware by 10 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. The file has been seen being downloaded from mpdotrk.com and multiple other hosts.

File name:

Publisher:

VASSANA KONGSOONGNERN (signed and verified)

MD5:

a5bdd4698ffbef6fc6ab8cf5ae6b4cbc

SHA-1:

270d0c8b3ec68cfbc58f4d0f7eef5a08c5330713

SHA-256:

b7b1987d0784f0f096667ab752d0a0c4831586c8a58deb73ae376bbbf8489450

Scanner detections:

10 / 68

Status:

Adware

Explanation:

Bundles a number of adware programs in the installer.

Analysis date:

12/27/2024 6:20:15 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic

2015.0.3246

Dr.Web

Adware.Downware.8319

9.0.1.0362

ESET NOD32

NSIS/TrojanDownloader.Adload.AA

8.10934

G Data

NSIS.Application.Adload

14.12.24

K7 AntiVirus

Adware

13.188.14468

Kaspersky

not-a-virus:AdWare.NSIS.Yontoo

14.0.0.2727

Panda Antivirus

Generic Suspicious

14.12.28.01

Reason Heuristics

PUP.VASSANAKONGSOONGNERN.Q

14.12.28.13

Sophos

CoolMirage

4.98

VIPRE Antivirus

CoolMirage Ltd

36146

File size:

74.5 KB (76,248 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\downloads\flvplayer-chrome.exe

Digital Signature

Signed by:

VASSANA KONGSOONGNERN

Authority:

Thawte, Inc.

Valid from:

10/5/2014 8:00:00 PM

Valid to:

10/6/2015 7:59:59 PM

Subject:

CN=VASSANA KONGSOONGNERN, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

7E630B1125BFC2AAB3F8750B7348F18B

File PE Metadata

Compilation timestamp:

12/5/2009 5:50:46 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

1536:4QpQ5EP0ijnRTXJD560qCzlTllqUnTenyI03AOsE:4QIURTXJD57QUnhvAA

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Entropy:

7.1862

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file flvplayer-chrome.exe has been seen being distributed by the following 50 URLs.

http://mpdotrk.com/mt/.../ &subid1=u6c355b3254a5c7e184ea3713f2

http://mpdotrk.com/mt/.../ &subid1=11480643181420160095

http://mpdotrk.com/mt/.../ &subid1=u6213486a54a409ec7797c7dca3

http://mpdotrk.com/mt/.../ &subid1=11606594111420041169

http://mpdotrk.com/mt/.../ &subid1=uadafdf2f543dd98231ae371ecf

http://mpdotrk.com/mt/.../ &subid1=12043671551420414141

http://mpdotrk.com/mt/.../ &subid1=u4356594b547a7c558cfbe2e4f4

http://mpdotrk.com/mt/.../ &subid1=12861957301420448134

http://mpdotrk.com/mt/.../ &subid1=u49b94416544b11875722dbff50

http://mpdotrk.com/mt/.../ &subid1=17454041141420185837

http://installssource.com/.../marmardr2.php?subid=marmarlk&sid=w83FG96E5AEHP6AF05P05F50

http://mpdotrk.com/mt/.../ &subid1=3875757531419966209

http://mpdotrk.com/mt/.../ &subid1=8498548111420343210

http://mpdotrk.com/mt/.../ &subid1=u326f24bb5470b258564b81a2a

http://mpdotrk.com/mt/.../ &subid1=12693354921420149118

http://mpdotrk.com/mt/.../ &subid1=11981632321420023120

http://mpdotrk.com/mt/.../ &subid1=12078542281420102138

http://mpdotrk.com/mt/.../ &subid1=12479929541420053849

http://mpdotrk.com/mt/.../ &subid1=11413856441420159481

http://www.flvxplayerdownload.net/.../mar13.php?subid=marmarlk&sid=dHJ1HGGFIIO81R0H0EL85JAI

http://mpdotrk.com/mt/.../ &subid1=u602954d854a60dd3a7ab8f345

http://mpdotrk.com/mt/.../ &subid1=u468a741854a45e0d2a6e576ca9

http://mpdotrk.com/mt/.../ &subid1=11628938591420451105

http://mpdotrk.com/mt/.../ &subid1=16608719771420047712

http://mpdotrk.com/mt/.../ &subid1=12059728841420356396

http://mpdotrk.com/mt/.../ &subid1=12632011481420433025

http://mpdotrk.com/mt/.../ &subid1=4194068961420340332

http://mpdotrk.com/mt/.../ &subid1=uae64270e54a6489c293edccc62

http://mpdotrk.com/mt/.../ &subid1=16570687751419815376

http://mpdotrk.com/mt/.../ &subid1=18098309721419872788

Latest 30 of 105 download URLs

Remove flvplayer-chrome.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.