» installer_adobe_flash_player_english.exe
Overview
Analysis
File Details
Downloads (82)

installer_adobe_flash_player_english.exe

Astro Delivery (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_adobe_flash_player_english.exe by Astro Delivery (Fried Cookie) has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from freempr9.moredownre.com and multiple other hosts.

File name:

Publisher:

Astro Delivery (Fried Cookie Ltd.) (signed and verified)

MD5:

950e4fbce15968b008b418506e0d7707

SHA-1:

5ad5b88e50d175ef803bec3cfcf94d78a5f9a1aa

SHA-256:

a4cd8c624da4161a55a28d4184bfe284a411bfa55b485192410d7adbbb891522

Scanner detections:

13 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/26/2024 6:29:49 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen7

7.11.188.58

AVG

Generic

2015.0.3282

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.141123

Dr.Web

Trojan.InstallCore.15

9.0.1.0327

ESET NOD32

Win32/InstallCore.RO (variant)

8.10766

Fortinet FortiGate

Riskware/InstallCore

11/23/2014

Malwarebytes

PUP.Optional.FriedCookie

v2014.11.23.09

McAfee

Artemis!950E4FBCE159

5600.6938

Qihoo 360 Security

Win32/Virus.Adware.94c

1.0.0.1015

Reason Heuristics

PUP.AstroDeliveryFriedCookie.e

14.11.23.9

Sophos

Generic PUA FK

4.98

Trend Micro House Call

Suspicious_GEN.F47V1122

7.2.327

VIPRE Antivirus

InstallCore

35040

File size:

793 KB (812,080 bytes)

Product version:

1.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

Digital Signature

Signed by:

Astro Delivery (Fried Cookie Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

10/21/2014 12:11:59 PM

Valid to:

10/22/2015 12:11:59 PM

Subject:

CN=Astro Delivery (Fried Cookie Ltd.), O=Astro Delivery (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121A99E73962365DC8A4A1F35AD57C59E60

File PE Metadata

Compilation timestamp:

6/20/1992 2:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:jUZwZFpwmHcKbANWeKiowYAhLJqI3PdOGDQ/2fCfZwUB:jq/mHXSRNGI3PdCk+tB

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8901

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 50 URLs.

http://freempr9.moredownre.com/.../download?p=REVENUE&trckid=009806489016062102900

http://clkmon.com/.../sa?cid=11021-200080521016000000&pid=11021&q=????????????????????????????????????????? ??????????? ?

http://clkoffers.com/adServe/.../O8trDVZH3rxEF7R7AtJeQpKMV3XJp0uf2Z6VFLzH9JP9Pt1tXaTTnZZJCxAdeOqU=&src=BANNER

http://clkmon.com/.../sa?cid=11021-500084223321000000&pid=11021&q=tin tuc, tin t?c, tin tuc trong ngay, b?ng d?, th?i trang, cu?i, tintuc, 24h, ti

http://clkmon.com/.../sa?cid=11021-200080502416000000&pid=11021&q=medi-5461013 | Protocol Training Portal

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200068704312000000&pid=11021&q=jeu, 4x4 Soccer

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6RD n4CXKQWgfqP4qimSQWIVVHD8z3/3I2ZfvdZcTWC77fK2 u38qtcIByjeT3MWZrV JJWKX3QnttinG9ZqDvYs70KtU29UlAJsWtMmzQEq 8MJogSMk2vNNLTBZZChgN/.../QqR6gqlaaLYaIry8925TK2pkhU6FifzHUITJjn oJi H9AZDfTqq LlBX0mz pDGdb4dUnrq9iy8Apnze&ui=H4Ck4tXy REvHKvugabZ4oBVNmK1S2tVqOQpE46oq7BV80ogfp8G4O7TeBSYQiOp&src=BANNER

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200185901920000000&pid=11021&q=Lud@k site - Home

http://clkmon.com/.../sa?cid=11021-200097115413000000&pid=11021&q=OJogo,insolito,Not?cias,Insolito

http://clkmon.com/.../sa?cid=PINOYTVPOP&pid=&q=pinoy tv, pinoy tv online, pinoy tv show, pinoytv, pinoy network, filipino chann

http://clkmon.com/.../sa?cid=GBD5-1049887&pid=4082&q=7500, 7500 ????? 7500 ??????????, ?????? hd, ??????2014, ??????7500 ????? 7500 ?

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6S1Q7oxOCF/BzekPvPrc6Glps5OgCOYA5O3fRSiJSPF 0LnS4xNDgGVBU5YSFd992Dz w9kc0E/5sgDRoHLNm9VdzQZUzBoOzze57RyCEI38qXO8dw4s/cvDEDiscQPvKzz2PmEsunx5Bus9 nsHjogeeTtS7ua/ljaxi3sNClcjNpRsxJBcj7CYdtz4dVuNnHltFbYTgiY2ApA==&ui=CuHXvtlQnvWDvY4uCgylLoBVNmK1S2tVmTIMbcPs0ioLrLP/.../ZloGKfAaoqz&src=BANNER

http://clkmon.com/.../sa?cid=11021-200170012721000000&pid=11021&q=samsung galaxy note 3

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6SAENF35gz4ssd416ALnTKZLQPKLf5v2FXKeNCeW6WwEuWQ8tZIKBpvR3cD71MdG4gt e3jipE CYK/u5RGuC89Nf6blEZlGJBTPtMEAS7J5yzLw6fNJCBprW9m1B/fGRInJxOjJMYUV1T2z tlE8oDD1x0 x8J9WsoyqHYLbpHosPjrvX/.../7M42VMi22qa4O8MoC42fRjbK0kdu9uQs=&ui=LgojofvMMp527b90es twFY37AsT2AewDMRlDug0DraGmOBM0zmutKpLk3GpbHZo&src=BANNER

http://clkmon.com/.../sa?cid=11021-200080521017000000&pid=11021&q= ETV Channel

http://clkmon.com/.../sa?cid=11021-200225500023000000&pid=11021&q=Events

http://clkmon.com/.../sa?cid=MK1VIOOZCOPOP&pid=&q=catching fire

http://clkmon.com/.../sa?cid=11021-500080515221000000&pid=11021&q=gobierno, impuestos, declaraciones, licitaciones, tipo de cambio, SAT, inpc, ha

http://freempr8.moredownre.com/.../download?p=REVENUE&trckid=008483072016032441241

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500167316219000000&pid=11021&q= Her er Kom igjen og dans.

http://clkmon.com/.../banners?pid=15867&cid=SU1&action=r

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200082021013000000&pid=11021&q=???????????,

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6QpiwBq5Er/rR4zaV 9MImzEQISPIze6SYqnxeHa4/L 9Ig67QrxrwSta85/E5ZjeBK Yq/1X309N40sQ4i8KXRqTX4eYdytOcfqtKQttst1PgQk8H qBnmOJMeicgpyWehTlMtKOoqCIPyB joOsl/TLdXQsBBbufDwzX6imgTkxXvY YSy6fHkG6z2eweOiB56dBMFaZEqMoKwWcH55acyZQsOF /xNroJ5 6ruP2NfM9GkVr7TITGsc&ui=Y0YoChd8HkKZSZHgQMxGUPbWwvziNp/.../yYbk5hyR9gzN81iVu&src=BANNER

http://clkmon.com/.../sa?cid=11021-200212804322000000&pid=11021&q=mystartsearch

http://clkmon.com/adServe/.../PAT

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6TK1oGB2qDSLYXbZElX0xTRo73INcXQ6CaPz6SCXqHhhhNecs 9vJK1CqFL MM4wNWB XdqzSt QzUY5W7rRK/VMDvSwKO4ccdEWvvjx4u3eW5VeNErFSBBfHrzzYqbBLS05I1G3iBKB/Q==&ui=xJ21I1dxBl7khd/.../B &src=BANNER

http://clkmon.com/.../sa?cid=11021-200033921023000000&pid=11021&q=BB Cream, ???????, ???, base, ????????, ??????? ??????????? ?????

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6TWZEaZboedZN6UbMbFaHWD0ovKG7y7HDN5MAFx6 YkM7JLQuNmboXSdB1r3csYO6/a i3a4bMP5Zgatbs4iji04vM6Fylv6q6zALrTYUYHkmqZ/12k/.../VuNZ2VdKBbsuOuaql bFSRq Cya3C4jggfBl2YMkMlT4MEx4r YgA9P9FiKIBbS FaaIo=&ui=5fCTeKnbHUt3oNHTONjEXlY37AsT2AewGas9GgwJ bBcxHZcTsKeD2mM2WohYkEG&src=BANNER

http://clkoffers.com/adServe/adClick?ai=e78pZMpPz6RD n4CXKQWgeqAsiH6LRaWuZp7 uK5yvo07E Dx44B6N7uoq4LdvYw4D 0DOYEGFOV 9F48/ofCom8UjTPVX15VIQ3 AExKVfLznGyCX2L1/5X0Xjz h8Ki4iWA3xgwjbz8gY6DrJf0y3V0 LAQW7nw8aJmB7pECsvuH9fE/QqR6gqlaaLYaIry8925TK2pkhU5lUpU7GBY/.../12mUjgLJO6yraRhS4MyzhuXRzgrCKJoLi&src=BANNER

http://clkmon.com/.../sa?cid=11021-200212806123000000&pid=11021&q=chat, messagerie, dialogue en direct, messages, messagerie, petites annonces, ba

Latest 30 of 82 download URLs

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.