home

pobierz_adobe_flash_player_dla_firefox__v21.0.0.197.exe

Mep

The application pobierz_adobe_flash_player_dla_firefox__v21.0.0.197.exe, “Mep Setup ” has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.bulkbundlebest.com and multiple other hosts.
Product:
Mep

Description:
Mep Setup

Version:
3.8.2.4

MD5:
2b8d810a7e99d4e20378175f032d5220

SHA-1:
d6dda4f490c0946718a4a72cfbe27c6384551282

SHA-256:
449e7b7bdbbc82bc3d88e537687e8ba782303aa71c4163d6d59eb94bcdf897cb

Scanner detections:
4 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/27/2024 6:46:53 PM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.InstallCore.1903
9.0.1.05190

ESET NOD32
Win32/InstallCore.AFO.gen potentially unwanted application
8.0.319.0

Reason Heuristics
PUP.InstallCore.EST (M)
16.3.23.13

VIPRE Antivirus
Threat.4150696
47848

File size:
1 MB (1,076,920 bytes)

Product version:
4.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:mWNe1PqOjjTc8OfvNGnIFdkO1T2fP8kmhcLnBgfDZZPi3DKmxAIwetKQuR:mM+ZjX+vNa0kcTf5EnYDZc3DKLIwmKF

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file pobierz_adobe_flash_player_dla_firefox__v21.0.0.197.exe has been seen being distributed by the following 8 URLs.

http://www.bulkbundlebest.com/WVl6OTRQWGRpYjBrbE1rWmFiVnBrZGpWdGFYVWxNa1prU1VOR1VESkdjMnhMYTBwR2N6bFBiRTFwUjNaaVdXc3hTM1F3SlRORUptTTlOVmxHUVVGNFowNTBNMHhGYUc5b2NVRkhURTVVV1cwNVNIcE1jVkJ1VDBSdVpuSkJVRUV6UmtaWFNHeFZVbmx1U2s1VVRGWnBOMmQwVGtOS2RIbFZSMlZZY1hoTGVXNUtaRFJCV1RCUVlsbFhUalJSUmxsT0pUSkdNa1I0VFVobFZsUTBUelk0TjBFbE1rWk5TMUJOY0ZONFIxTjBURkZXYUU1cFJWRklkVGxRYmxWb0ptUnZkMjVzYjJGa1FYTTljRzlpYVdWeWVsOUJaRzlpWlY5bWJHRnphRjl3YkdGNVpYSmZaR3hoWDJacGNtVm1iM2hmWDFZeU1TNHdMakF1TVRrM0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1cGJuTjBZV3hyYVM1d2JDVXlSZz09

http://www.bulkbundlebest.com/WVl6OTRQVGx3UW5oeFFXa3pWMWhtSlRKR2FqQlFTWG81UVRONFZ6SnZlRzgyVVZWcU5UUTFkMjlyVUZGYVRsQkhRU1V6UkNaalBVcGtXbTVYTWtoUmEySkRRV2xxZGxOeVJWbDRTMVZwVEhOeGNVWWxNa0pQTURrbE1rSjJhbnA1Y0dOUU16SklhV1JyYVZneE1YTlJUVmRTUW5SSGNXOUdTRzlpTUdWU1JrSnNObTFpT1Vjd09GRndkRVZQZDJzMWJYaFJPSG8wVWxrbE1rWmlRMlE1YUNVeVFubGhRakJRZGtveGQxcEpNbmN5YlZsMVVTVXlRbEZ5YWtrMmVGTm5iaVprYjNkdWJHOWhaRUZ6UFhCdlltbGxjbnBmUVdSdlltVmZabXhoYzJoZmNHeGhlV1Z5WDJSc1lWOW1hWEpsWm05NFgxOVdNakV1TUM0d0xqRTVOeTVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VhVzV6ZEdGc2Eya3VjR3dsTWtZPQ==

http://www.bulkbundlebest.com/WVl6OTRQV3haWjFNek1DVXlRbWhoZDNaRWFHd3pTMEpYTVhaNlQwVlljV3h1ZDNaQ1NFeHVWbU15UzFKclZ5VXlRbTl2SlRORUptTTlkM2hvWVVreWVuaFBTSGdsTWtKMFZHOXlPVzB3ZGxJelFtMUVTbU51WmpCdU4wdEdaSFkyWWswd1ZUUnphemhNYVd4UmFWVmFkVWxaWjJObGJYRkxNa0Z3VTNsRk55VXlRbWw2WTIwNVpWcGxTWE1sTWtZM1IySlNWVUU1TlcxNVVUbDRjM2xPY1d4aGFIUktVVEZsWjJKdU1XcENiSFkwY0hCc1ZIVndiMGRZVVVkMlFsVW1aRzkzYm14dllXUkJjejF3YjJKcFpYSjZYMEZrYjJKbFgyWnNZWE5vWDNCc1lYbGxjbDlrYkdGZlptbHlaV1p2ZUY5ZlZqSXhMakF1TUM0eE9UY3VaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtbHVjM1JoYkd0cExuQnNKVEpH

http://www.bulkbundlebest.com/WVl6OTRQVEV3YlVZNU1tZDVRVlZpYjBGR04zbFhSVlpMZUZveGFrWlNOMkoyVEhKak4ycEljRGRwWmtwWlZGVWxNMFFtWXoxeGVGVkVSMWh1VmpSNFIxSTJWMEZHUWtOWFVVZHFWeVV5UmxaUk4yMTFaREJSUm05UGFsZE5Ra1p6TlRsR1JGVlhjRFYxTUdsdlRVSmllbVkwU25Wd1R5VXlRbTlCTTJJelluaFRNV1phVFZnd1dWWlpRV3BYVVdWNlYySjFlVWN6TlhKdFJWWlRlWEZoUjJoRFJFZ3lObEppYm1oT2NUUm9NVm96UTIxaFRUUTBOakltWkc5M2JteHZZV1JCY3oxd2IySnBaWEo2WDBGa2IySmxYMlpzWVhOb1gzQnNZWGxsY2w5a2JHRmZabWx5WldadmVGOWZWakl4TGpBdU1DNHhPVGN1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QzZDNMbWx1YzNSaGJHdHBMbkJzSlRKRw==

http://www.bulkbundlebest.com/c?x=3wFrNppKnYkzR6bB1EN20vQecbYnZsJPkFRPF1LvBNM=&c=a865ngZDx3wuwDCFDXE39YIPR2K/3FbSS5pit4mpEXJxdpO61uerzS6UdzJVbuTBfY Z6w9xVI5vW7wLj3/3zW/3MbxIwbku5V1/Tdyot71ml5bKNaPu2yZJZSgIUw0X&downloadAs=pobierz_Adobe_flash_player_dla_firefox__V21.0.0.197.exe&fallback_url=http://.../

http://www.bulkbundlebest.com/WVl6OTRQV1ozYjBsblVIWllTa01sTWtaNlMyaHFVVXhGTkhoUVNXcEZTM0J0WW1acFNDVXlRa2hHVkZOVFoxbDJjamhKSlRORUptTTlTakJLZW1SUWJWTmhUbE51V25sUWNVMDNXa2xEZVRad0pUSkdPSFIzVDFKM1UweDZaVE00U1VocU1UQlBUMk5XYTNNbE1rSlFVbXhMYlc1V1RISlFWMUJQV2t0WllrTlpSME5CUnpjMk1ETXpkSE5NWW1FelJYbG1TMk5aVlVoNlNpVXlSbGRhWmxoNmIyOWFaa1pwZVhOb1JtZ2xNa0pqV1RKTVMxVnBVMjQxUjFKVFowRjRTeVprYjNkdWJHOWhaRUZ6UFhCdlltbGxjbnBmUVdSdlltVmZabXhoYzJoZmNHeGhlV1Z5WDJSc1lWOW1hWEpsWm05NFgxOVdNakV1TUM0d0xqRTVOeTVsZUdVbVptRnNiR0poWTJ0ZmRYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VhVzV6ZEdGc2Eya3VjR3dsTWtZPQ==

http://www.bulkbundlebest.com/WVl6OTRQVGRJZDJGRWRqbG1ZVEZDTVZZbE1rWnViVkJMVWpOWlZVSjJNSFU0TXpOc0pUSkdUVFpwWmlVeVFrSkdOVTFPTmtFbE0wUW1ZejFNZURWVmJuRTVaMDFVV25ZMVR6ZHZaWEV6U3pGRmMwUk1WSGREY1haUVJUWmpiRzFuV1d4eU5IVmhjMW95VTFremRXOW5jRkZLVFRCS016TjJXRTFrSlRKR0pUSkdOMUEzVm5aRFprUnBZMDlGUVdSQ1kzSTJPQ1V5UmtST1EyMUVSRlpqYTFwV1RWa2xNa0l4YTNSUFRXaHZja1pVZFRZM1psWklKVEpHV1VsT0pUSkNObTR6VGtwVWRpWmtiM2R1Ykc5aFpFRnpQWEJ2WW1sbGNucGZRV1J2WW1WZlpteGhjMmhmY0d4aGVXVnlYMlJzWVY5bWFYSmxabTk0WDE5V01qRXVNQzR3TGpFNU55NWxlR1VtWm1Gc2JHSmhZMnRmZFhKc1BXaDBkSEFsTTBFbE1rWWxNa1ozZDNjdWFXNXpkR0ZzYTJrdWNHd2xNa1k9

http://www.bulkbundlebest.com/WVl6OTRQWGxIU1haRWEwRjRRbWRaTnpWNVlWbFJKVEpDZVdaWE1VZzViMDFzYm5NbE1rSXdXazVuU2pnMVYyeHhWV3hCSlRORUptTTlZbU5vY2twaWNtYzNlWHBWU0dWMlRrUXlkMnhQZUdGcVFrbFJWVkJWZWtFbE1rWk5TVXRuV25aSVpHWlZlV0puTXpabVNVTjFjblpIV0doa1lsWkRRbmhxVG0xTVJHTkxVMGMzYjJWRmRtZFBRMWhzUjFjemJFeEtkMGRyWjNkbFFVMVpjWEZSYTNRelpWSmxZVzVCUW1OU2VHOURKVEpDWVZCNVYxa2xNa0pvYkZCWllrZ21aRzkzYm14dllXUkJjejF3YjJKcFpYSjZYMEZrYjJKbFgyWnNZWE5vWDNCc1lYbGxjbDlrYkdGZlptbHlaV1p2ZUY5ZlZqSXhMakF1TUM0eE9UY3VaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDNkM0xtbHVjM1JoYkd0cExuQnNKVEpH

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.