» installer_adobe_flash_player_english.exe
Overview
Analysis
File Details
Downloads (52)

installer_adobe_flash_player_english.exe

Astro Delivery (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_adobe_flash_player_english.exe by Astro Delivery (Fried Cookie) has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from clkmon.com and multiple other hosts.

File name:

Publisher:

Astro Delivery (Fried Cookie Ltd.) (signed and verified)

MD5:

9f8da35475a9b284c5fecb217ea3c8e7

SHA-1:

709e7cdc4ba5781a5d9cc2885d29feb1bed40081

SHA-256:

35076bcd6d9670916a8f2f0fe149174ebf0d5c7aaabd1fd148e71ad214c578a6

Scanner detections:

15 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/26/2024 7:15:17 PM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen9

7.11.189.144

AVG

Generic

2016.0.3242

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.1512

Comodo Security

ApplicUnwnt

20231

Dr.Web

Trojan.InstallCore.15

9.0.1.02

ESET NOD32

Win32/InstallCore.RZ (variant)

9.10800

Fortinet FortiGate

Riskware/InstallCore

1/2/2015

K7 AntiVirus

Unwanted-Program

13.186.14174

Malwarebytes

PUP.Optional.InstallCore

v2015.01.02.09

McAfee

Artemis!9F8DA35475A9

5600.6898

Qihoo 360 Security

Win32/Virus.Adware.f22

1.0.0.1015

Reason Heuristics

PUP.AstroDeliveryFriedCookie.e

15.1.2.9

Sophos

Generic PUA HA

4.98

Trend Micro House Call

Suspicious_GEN.F47V1126

7.2.2

VIPRE Antivirus

InstallCore

35246

File size:

1004 KB (1,028,104 bytes)

Product version:

1.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

Digital Signature

Signed by:

Astro Delivery (Fried Cookie Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

10/21/2014 3:11:59 PM

Valid to:

10/22/2015 3:11:59 PM

Subject:

CN=Astro Delivery (Fried Cookie Ltd.), O=Astro Delivery (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121A99E73962365DC8A4A1F35AD57C59E60

File PE Metadata

Compilation timestamp:

6/20/1992 5:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:yZvuC/1yomyWAdd0zcIk75qaJpNo7zSkFp5woi:ytX/1y5yfAcb75rpoztpwH

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9284

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 50 URLs.

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500082018722000000&pid=11021&q=???? ???? ????,???? ??? ????,??? ?????,?? ?????,??? ????,???? ?????,???????,????

http://clkmon.com/.../sa?cid=11021-200080521016000000&pid=11021&q=?? Us-Series ??????? | ????????????? : series.Upyim.com - Part 3

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500172304618000000&pid=11021&q=Juegosi chat group - juegos de chat para ni?os de 13 a 18 barbie juegos gratis

http://clkdeals.com/adServe/adClick?ai=e78pZMpPz6TNeMzzCoTgsFxq6XlejuwLUeZm//XUclnUMtBXY0bH70 V8x1pWRUrVX/9Yz7FBC S 3sFNWpfP73292vTmVMGt8xjTa7/nCEqDHloDn/PBUSI/pF9ocZk/ulLuuUzZJ Dg7EFkSMKGUmf 3e5gxFSe6o7L48tCQfw671/6BW/nohcUk/.../on4bYwagiF1k2VY37AsT2AewDMRlDug0DrZiZnW6HvXWGA0AzMiK8J1c&src=BANNER

http://clkmon.com/.../sa?cid=ST2WPOPII&pid=&q=live, live stream, stream, streaming, watch, livestream, online, video

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500082018719000000&pid=11021&q=????? ???????? ??????? ??????? ????????

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118821016000000&pid=11021&q=?????????????????????????????????????????????????????????? ?????????????????????

http://clkmon.com/.../sa?cid=11021-500214304923000000&pid=11021&q=list_640px.jpg (640?480)

http://clkmon.com/.../sa?cid=11021-200170012721000000&pid=11021&q=Real Time Unicode Converter

http://clkmon.com/.../sa?cid=GBD5-1049887&pid=4082&q=TARAD.com, ????????? ?????????????? (382) ?????????????????? ????????? ?????

http://clkmon.com/.../banners?pid=15867&cid=BRSU&action=r

http://clkmon.com/.../sa?cid=11021-200212804322000000&pid=11021&q=AdnetWork !

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200179804419000000&pid=11021&q=kto, chaine de tv kto, regarder kto, kto en direct, kto en live, kto streaming,

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118821015000000&pid=11021&q=??????????????? - 4shared.com ???????????? - 1

http://clkmon.com/.../sa?cid=11021-200133601318000000&pid=11021

http://clkmon.com/.../sa?cid=11021-200208213423000000&pid=11021&q=webssearches

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118821015000000&pid=11021&q=??????????????????????

http://clkmon.com/.../sa?cid=GBD5-3263570&pid=4082&q=???????, ???????????, ????, ?????????, ???????????

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200179810619000000&pid=11021&q=Gerna G, Lilleri D, Furione M, Baldani F. Management of human cytomegalovirus infection in transplantation: validation of virological cut-offs for preemptive therapy and immunological cut-offs for production. New Microbiol 2011; 34:229–54.

http://clkmon.com/.../sa?cid=GBD5-1049854&pid=4082&q=j?t?kok, online, j?t?k, ingyen, 9999, flash, ingyenes

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118821015000000&pid=11021&q=Longdo, map, online, Bangkok, Thailand, collaborative, ????????????????????????

http://clkmon.com/.../sa?cid=GBD5-3239544&pid=4082&q=.:: ????????????????????????? ???????????? ???????????????? ????? ?????????????

http://freempr9.jrcaaa.com/down.php?p=REVENUE&trckid=003767484016275014188

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500082021022000000&pid=11021

http://clkmon.com/.../sa?cid=JAEWINTER_21625_1&pid=&q=You’re all Surrounded ?????? 5 ?????? | Jae Winter

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118806415000000&pid=11021&q=Mawaly.com | ????? ???? ???????? ????? ?? ????? ???? ???? ????? ?????? ???? ???

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200179806419000000&pid=11021&q=??????,??????,?????,?????????,??????,?????,???????,???????

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500082006420000000&pid=11021&q=???????, ???, ???, ???, ??? ???, ??? ??, ???, ???, ????? ???, ??? ???, ??? ???

http://clkmon.com/.../sa?cid=11021-200217318722000000&pid=11021&q=saudia > Welcome to Saudi Arabian Airlines

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200167316119000000&pid=11021

Latest 30 of 52 download URLs

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.