home

installflashplayer__8497_i1409098242_il30.exe

ITL-GROUP LLC

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application installflashplayer__8497_i1409098242_il30.exe by ITL-GROUP has been detected as adware by 18 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
ITL-GROUP LLC  (signed and verified)

Version:
1.1.5.26

MD5:
8c6988f3ad98e5651ba675d4b20e352b

SHA-1:
30294183d60e9347eb4294e65ad373579e8be237

SHA-256:
ba2d8e66c8590f188798272518f3d77a33644ba4c927b14186a1f87c98562608

Scanner detections:
18 / 68

Status:
Adware

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 12:08:04 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Strictor.68509
721

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.188.24

AVG
Generic
2016.0.3199

Bitdefender
Gen:Variant.Adware.Strictor.68509
1.0.20.220

Emsisoft Anti-Malware
Gen:Variant.Adware.Strictor.68509
8.15.02.13.12

ESET NOD32
Win32/Amonetize.BP (variant)
9.10762

Fortinet FortiGate
Riskware/Amonetize
2/13/2015

F-Secure
Gen:Variant.Adware.Strictor.68509
11.2015-13-02_6

G Data
Gen:Variant.Adware.Strictor.68509
15.2.24

K7 AntiVirus
Unwanted-Program
13.185.14098

McAfee
Artemis!8C6988F3AD98
5600.6855

MicroWorld eScan
Gen:Variant.Adware.Strictor.68509
16.0.0.132

Panda Antivirus
Generic Suspicious
15.02.13.12

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Installer.ITLGROUP
15.2.13.12

Sophos
Generic PUA DA
4.98

Trend Micro House Call
Suspicious_GEN.F47V1120
7.2.44

VIPRE Antivirus
Trojan.Win32.Generic
34998

File size:
408.7 KB (418,536 bytes)

Product version:
1.1.5.26

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\installflashplayer__8497_i1409098242_il30.exe

Digital Signature
Signed by:
ITL-GROUP LLC

Authority:
Thawte, Inc.

Valid from:
10/19/2014 8:00:00 PM

Valid to:
10/20/2015 7:59:59 PM

Subject:
CN=ITL-GROUP LLC, O=ITL-GROUP LLC, L=Selyshche Doslidne, S=Selyshche Doslidne, C=UA

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
080AA229F6377F023DF6C8F878AC3719

File PE Metadata
Compilation timestamp:
11/20/2014 1:02:30 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:rHrK0aRz5s56tG4IPtR50MBg7o73mgO4ZLSd1//DKCuhCqgyqnAPCFbI5MV:rHV6tG4qiVgO4ZLS1/7KZh0mCRV

Entry address:
0x257F4

Entry point:
E8, 2E, AC, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 10, A1, E0, F9, 44, 00, 33, C5, 89, 45, FC, 8B, 55, 18, 53, 33, DB, 56, 57, 3B, D3, 7E, 1F, 8B, 45, 14, 8B, CA, 49, 38, 18, 74, 08, 40, 3B, CB, 75, F6, 83, C9, FF, 8B, C2, 2B, C1, 48, 3B, C2, 7D, 01, 40, 89, 45, 18, 89, 5D, F8, 39, 5D, 24, 75, 0B, 8B, 45, 08, 8B, 00, 8B, 40, 04, 89, 45, 24, 8B, 35, 6C, E0, 43, 00, 33, C0, 39, 5D, 28, 53, 53, FF, 75, 18, 0F, 95, C0, FF, 75, 14, 8D, 04, C5, 01, 00, 00, 00, 50, FF, 75, 24, FF, D6, 8B, F8, 89...
 
[+]

Entropy:
6.6836

Code size:
243 KB (248,832 bytes)

The file installflashplayer__8497_i1409098242_il30.exe has been seen being distributed by the following 4 URLs.

http://softwarefreeupdates.net.pl/installer.php?aff=13&subaff=27&downloadurl=http://fpdownload.macromedia.com/get/flashplayer/pdc/.../install_flash_player.exe&exename=install_flash_player.exe&title=Adobe Flash Player&description=Adobe Flash Player"

http://www.later-download.com/download.php?version=1.1.5.26&campid=3687&instid[appname]=Tomodachi Life 3DS Emulator ROM Downloader&instid[appsetupurl]=http://fastmediadownloads.com/download/Prompt-Downloader-1758502411.exe&instid[cmdline]=&instid[appimageurl]=http://.../logo.png&prefix=Tomodachi Life 3DS Emulator RO Downloader&instid[interrupted]=http://.../?cancel&ti1=1758502411&instid[thankyoupage]=http://.../?success

http://myfreedownloadsnow.com/download_direct.php?id=1973&name=Tomodachi Life 3DS Emulator ROM

http://softwarefreeupdates.net.pl/installer.php?aff=666&subaff=300&downloadurl=http://fpdownload.macromedia.com/get/flashplayer/pdc/.../install_flash_player.exe&exename=install_flash_player.exe&title=Adobe Flash Player&description=Adobe Flash Player"

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.