home

flashplayerpro.exe

Hotigamama

Perets Smart, TOV

The application flashplayerpro.exe, “Hotigamama Setup ” by Perets Smart, TOV has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.hostingbitspackage.com.
Publisher:
Perets Smart, TOV  (signed and verified)

Product:
Hotigamama

Description:
Hotigamama Setup

MD5:
ecb2b7d7d7510a8390df718794cbf9c4

SHA-1:
90c88d1e541a9c2a05b224d0529c10b231bfa5f2

SHA-256:
a4fe214f3ee86ba7306c639756f6a0e24fcdce865b450551d869cc02c154f9c5

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/23/2024 12:44:32 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore (M)
16.8.11.2

File size:
961.7 KB (984,816 bytes)

Product version:
2.8

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\flashplayerpro.exe

Digital Signature
Signed by:
Perets Smart, TOV

Authority:
COMODO CA Limited

Valid from:
5/25/2016 9:00:00 PM

Valid to:
5/26/2017 8:59:59 PM

Subject:
CN="Perets Smart, TOV", OU=IT, O="Perets Smart, TOV", STREET="Bud. 8 kv. 60, bul. Lesi Ukrainky", L=Kiev, S=Kiev, PostalCode=01010, C=UA

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
13E2E656DC165E1ACE084B816FB003FB

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:05xNeVWGvbCuXHsxFTThsx0axAKMhkllvcAb+HZ:6iWGvDXsxxqxKhkleAK

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file flashplayerpro.exe has been seen being distributed by the following URL.

http://www.hostingbitspackage.com/ei4FgvvoUjmVU6SO4Z5sbh_dRduTi5WKSgSq6dkgNdnJIlqLCX2o_PgsPleGTTDC1isTK0RUJy_yaGlaFhoWFPlJR08XLxVZPQckpoXvZ3URSic7Gpy9X1frDQvoxThxjGhN1O3ENrUC1HfaU2QKTXtkXNpWhXNHgOVQo yR2ccLQv4hID5rVQs2aBKq1AK6elM8hYQhsLsv2Ojk1S6u3vzQ7kQfF9CNzWOlzd8q50usZDXhBoELTjRSrxbjNwef0GQW5cR7gqf37ezOW5hf0TiIUNdPEwAA9z9Z4wXs U6JFoGxVfRH MFeZ3ihw1_EKC4ACXo4o7bu9RYEljahN83sVxV_75tUMoPoNTApzN573s nOExvhPBPg6ULoO4BocTLhR8aossnlOUqUgmLHEoGFAYAq1rYnASzfOveYfci0FnZXAJZjJZDjVOGC6KNdImOzYqFS2FNDiVum6 BP7hzXuWjxT6GZQC9mVTBiCPCq6VK_YeIx5KbHqbOy4DS4pTkC9m4qyzOgClWeuxO M KNJC9y_CGQX7hn_tkHHfCD_2aLToNTrWGy NGWaL 8uGhs0cs5V3jq5mMBYDivIzxG8GsrXHYAD1QnbL3fTEAstDyfsRIrf9ZXgAtBILFb_jABbXkSDKqUk12Rd6_uPEnJngWSpn6FvdF0s_hLs4VQvt4cEeCq TFE31NsH45vQRT2UFqoXL0d4Ycj1CaSlUj2IHzePgck8eqpv8QHgEGXkS5C7vP6iT0KJC3oO1UY3 K8z6LpOYtSXchXN4Tlh6uk4kqBB5uL74OhpV_VFcoSJCpY5tqkG_NeaQOxkSz347vXBG8-GzwAAORtm8 QRt34QeNKWgliEI3qQjZpSCIJdikaF PK_Y7pmOI3gMDtNyNbk3FCFVZqRr_oAXkC

Remove flashplayerpro.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.