» installer_adobe_flash_player_english.exe
Overview
Analysis
File Details
Downloads (19)

installer_adobe_flash_player_english.exe

Free Software LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_adobe_flash_player_english.exe by Free Software has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the installCore installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from freempr9.jrcaaa.com and multiple other hosts.

File name:

Publisher:

Free Software LLC (signed and verified)

MD5:

062b257a9c360208246662581789ed88

SHA-1:

d89f6c8be0870abd73a6a2c5eb5483ac11c7b21f

SHA-256:

e4c65037ea9a0a6f28d77111b71ac97863cd8ff47c6c4c6b01e09aa540654ae6

Scanner detections:

13 / 68

Status:

Adware

Explanation:

Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

11/5/2024 11:37:06 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen

7.11.197.26

AVG

Generic

2015.0.3250

Dr.Web

Trojan.DownLoad3.35287

9.0.1.0358

ESET NOD32

Win32/InstallCore.SC (variant)

8.10912

Malwarebytes

PUP.Optional.BundleInstaller

v2014.12.24.06

McAfee

Artemis!062B257A9C36

5600.6906

Reason Heuristics

PUP.FreeSoftware.e

14.12.24.18

Sophos

Generic PUA NI

4.98

Trend Micro House Call

Suspicious_GEN.F47V1202

7.2.358

VIPRE Antivirus

Vittalia Installer

35960

File size:

793.5 KB (812,592 bytes)

Product version:

1.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

Digital Signature

Signed by:

Free Software LLC

Authority:

Starfield Technologies, Inc.

Valid from:

8/1/2014 1:08:01 PM

Valid to:

7/22/2015 2:23:49 PM

Subject:

CN=Free Software LLC, O=Free Software LLC, L=Wilmington, S=Delaware, C=US

Issuer:

SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

27DD6AADCC34E6

File PE Metadata

Compilation timestamp:

6/20/1992 1:22:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:fKFTIENy3+ZSijrkfj0NF3I1zG8gnqZuDUYp799Sp:fYUrijrkfjOF41hgq4UYD8

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8869

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 19 URLs.

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=15905650041417539031

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ub4b4dd2e547727918eb6470f15

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=30036069191417505776

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=33727898181417503810

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=15805458951417466227

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u4d6914be536430ca83c482ca8

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=6902570481417539741

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=18562860941417519711

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=33056425751417516649

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=4115457451417467035

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ub3bb25d0546e8e224305dbf920

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31976637321417487783

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31452807831417563072

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31918378491417474805

http://domsem.com.edgesuite.net/installers/out/012010120201203/piid-547d9e0ee05952.00666225/on/2/freesoftstorecom/english/adcash-ddownload/chrome/adobe_flash_player/d/275876e34cf609db118f3d84b799a790/ici/.../na/installer_adobe_flash_player_English.exe

http://freempr9.daderetac.com/down.php?p=ADCASH-DDownload&trckid=uc50232cd50c796108b10c11f4f

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=uc50232cd50c796108b10c11f4f

http://domsem.com.edgesuite.net/installers/out/011300120101202/piid-547cc92b795932.24664029/on/2/freesoftstorecom/english/adcash-ddownload/chrome/adobe_flash_player/d/275876e34cf609db118f3d84b799a790/ici/.../na/installer_adobe_flash_player_English.exe

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=458502501417559573

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.