home

installer_adobe_flash_player_english.exe

Astro Delivery (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_adobe_flash_player_english.exe by Astro Delivery (Fried Cookie) has been detected as adware by 6 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from freempr9.jrcaaa.com and multiple other hosts.
Publisher:
Astro Delivery (Fried Cookie Ltd.)  (signed and verified)

MD5:
8e52a496be0f597dc0a94ed7fb18432d

SHA-1:
48e72f240ebb9e2705ce124b8a51e4305e808aa2

SHA-256:
f7cdc5922467daecdc6fd93ab878cf8990e393a4f8f564e133521fb0e1584ca2

Scanner detections:
6 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/5/2024 11:35:07 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/InstallCore.Gen9
7.11.188.238

AVG
Generic
2015.0.3273

Dr.Web
Trojan.InstallCore.15
9.0.1.0336

K7 AntiVirus
Unwanted-Program
13.185.14134

Reason Heuristics
PUP.AstroDeliveryFriedCookie.e
14.12.2.3

VIPRE Antivirus
InstallCore
35142

File size:
1004 KB (1,028,104 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

Digital Signature
Signed by:
Astro Delivery (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
10/21/2014 3:11:59 PM

Valid to:
10/22/2015 3:11:59 PM

Subject:
CN=Astro Delivery (Fried Cookie Ltd.), O=Astro Delivery (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121A99E73962365DC8A4A1F35AD57C59E60

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:LZvuC/1yomyWAdd0zcIk75qaJpNo7zSkFp5woi:LtX/1y5yfAcb75rpoztpwH

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9284

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 47 URLs.

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ubc35e5d253647626504f08699c

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=16978534081417058443

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=18993039321417244396

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=30440194911417060055

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=29822375111417201641

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=28753580521417142314

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31441984971417098228

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=6909853001417254138

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31576957781417258439

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=29538565271417197127

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=28754495251417189617

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=33158052421417192440

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=198946391417141825

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=25491625411417185164

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u5d0cd9675435537d375152b658

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=8253081441417143528

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=37547185801417231174

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=20884202481417143762

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=28692241891417107270

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=37547102341417190475

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=17015936351417158356

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u6eab4aa7544014cb8064b2b253

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=7016218211417176334

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=28752587471417019257

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=16978713911417184678

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=19910192261417059730

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=uc4ced1b753b49d3635f16018e7

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u7c7973435365cb038b76956aed

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=33996656501417019947

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=28693602231417113372

Latest 30 of 47 download URLs

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.