home

flvplayer-chrome.exe

VASSANA KONGSOONGNERN

This is the setup program for CoolMirage, a potentially unwanted program (PUP) that display ads on the computer. The application flvplayer-chrome.exe by VASSANA KONGSOONGNERN has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup installer will bundle multiple adware offers during download and setup (based on the user's geographical location) including toolbars, extensions and coupon utilities. The file has been seen being downloaded from www.flvxplayerdownloads.com and multiple other hosts.
Publisher:
VASSANA KONGSOONGNERN  (signed and verified)

MD5:
c9fe0ea0cce5a6c32c26a612bc8c40bc

SHA-1:
b6f683f4ec28cfe27286a2c55b95e1a32a718e6a

SHA-256:
ec571bbc647fb74280505a2ef8b1f8c1e9954505d4c633489bc529e9e3c45221

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Bundles a number of adware programs in the installer.

Analysis date:
11/24/2024 7:32:31 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3282

Dr.Web
Adware.Downware.8319
9.0.1.0326

ESET NOD32
NSIS/TrojanDownloader.Adload.AA
8.10758

K7 AntiVirus
Adware
13.185.14085

Kaspersky
not-a-virus:AdWare.NSIS.Yontoo
14.0.0.2907

Reason Heuristics
PUP.VASSANAKONGSOONGNERN.Q
14.12.16.10

VIPRE Antivirus
CoolMirage Ltd
34982

File size:
67.4 KB (69,064 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\flvplayer-chrome.exe

Digital Signature
Signed by:
VASSANA KONGSOONGNERN

Authority:
Thawte, Inc.

Valid from:
10/5/2014 8:00:00 PM

Valid to:
10/6/2015 7:59:59 PM

Subject:
CN=VASSANA KONGSOONGNERN, OU=Individual Developer, O=No Organization Affiliation, L=Phuket, S=Phuket, C=TH

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
7E630B1125BFC2AAB3F8750B7348F18B

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:BQpQ5EP0ijnRTXJUvGLAkXaB4WNZpR6iFoSy:BQIURTXJn8kXS48ZpR6KoSy

Entry address:
0x323C

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00...
 
[+]

Entropy:
7.2478

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file flvplayer-chrome.exe has been seen being distributed by the following 50 URLs.

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wQBOKQABMIH7U96G0AJK9P3U

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wK1M4TUSJ2M4JK6G0B1VFL6M

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wOA9FBIL6S97Q26G0VB6J1BE

http://www.xflv-player.com/.../mar7.php?subid=marmarlk&sid=wB8LBPO301MITHMFGJGSHJCK

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wDVGPKC3TFPETE5G09ODAG6O

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wFMR0I0RANQAQG5GG7I9RI4A

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wJ5IPS8ESR916D6G0UH8FS6K

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wVA1RMVBEFHSSI5G0KL5A93A

http://installssource.com/.../marmardr2.php?subid=marmarlk&sid=wNMQC95A2KHO13BFG5O54U58

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wP39LVK9KA2TRE5G0LI6R4GC

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wJMKNDDVPTO4476G03758K9S

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wVIDQ36A0FMVFA6G0Q0QHM8K

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wC5SGPI8BE9TIC6GGE6R5C3U

http://www.xflv-player.net/.../mar8.php?subid=marmarlk&sid=wKI774AVKVB134NFGEDFHL84

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wEUSMSMFTMGS9V5GGUQJDPAC

http://www.flvxplayerdownload.net/.../mar13.php?subid=marmarlk&sid=wJSD4N0EFNSUIE0G01ELDNBU

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=w1VUG9VM5L1CDB6GG11T11FI

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wGQKMEMSEBVA3F5G01J7KJ10

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wJDD2UDV0CFSVE6G0BKQ3DC2

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wNEBJNVAAUU6AC6G0NFOA63U

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wLH1PIGCQUEGFC6G0NOLC68C

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=w39CUQLSUCMU1A6G02VTTS7S

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wMOH34BKPU98II5GGN8KLJH6

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wILL6RQKETVCKM5GGCDK4QCE

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wIJ1FRGTFH7GE16GG3IM53JD

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wUQTB1TQ1E9AJE5G0KC529CU

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wCGDENU0TJKU696G0SSFOK64

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wQQFP56A1JBQK36GG81NU7MO

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=w9TPUA9D5V2EBF5G0QN1NFQE

http://www.flvxplayerdownloads.com/.../mar14.php?subid=marmarlk&sid=wHUV3DF3MJQMB46GGV3Q7E6I

Latest 30 of 53 download URLs

Remove flvplayer-chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.