home

adobe flash player 11.exe

FIRSERIA, S.L.

The setup program uses the Firseria/Solimba AppInstaller (DownloadMR) which is a monetization download manager that bundles additional adware offers, typically by wrapping legitimate applications. The application adobe flash player 11.exe by FIRSERIA, S.L has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.
Publisher:
Frsera·sl  (signed by FIRSERIA, S.L.)

Description:
Dwnld·Mnger

Version:
1.0.0.20

MD5:
8fd689f33430f2b27ebeb8b8087a3d58

SHA-1:
4e64b8a3e119e39624a63314910f90b55a69c9b9

SHA-256:
c2065c595a866833acd4005408aa74bb2cdca8971dcd46357778f0cf0ef7591b

Scanner detections:
25 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 1:50:10 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
Trojan.Strictor
7.1.1

AhnLab V3 Security
PUP/Win32.Firseria
2014.01.04

Avira AntiVirus
Adware/Strictor.48157
7.11.123.132

avast!
Win32:Firseria-A [PUP]
2014.9-140416

AVG
AdInstaller.Firseria
2015.0.3502

Baidu Antivirus
Adware.Win32.FirseriaInstaller
4.0.3.14613

Bkav FE
W32.Clod383.Trojan
1.3.0.4613

Comodo Security
Application.Win32.Solimba.J
18115

Dr.Web
Trojan.DownLoader10.51613
9.0.1.0106

ESET NOD32
Win32/FirseriaInstaller (variant)
8.9250

Fortinet FortiGate
Adware/Firseria
4/16/2014

G Data
Win32.Application.FirseriaInstaller
14.4.22

IKARUS anti.virus
Trojan-Dropper
t3scan.2.2.29

K7 AntiVirus
Trojan
13.175.10735

Kaspersky
not-a-virus:Downloader.Win32.Morstar
14.0.0.4006

Malwarebytes
PUP.Optional.Firseria
v2014.04.16.05

McAfee
Artemis!EF3D4AF1814A
5600.7101

NANO AntiVirus
Trojan.Win32.Morstar.cqhuua
0.28.0.57029

Qihoo 360 Security
Malware.QVM18.Gen
1.0.0.1015

Reason Heuristics
PUP.FIRSERIASL.V
14.8.7.17

Rising Antivirus
PE:PUF.FirseriaInstaller@CV!1.9C54
23.00.65.14414

Sophos
Generic PUA IL
4.96

Trend Micro House Call
TROJ_GEN.R0CBH07LK13
7.2.164

Vba32 AntiVirus
Downloader.Morstar
3.12.24.3

VIPRE Antivirus
DownloadMR
28300

File size:
161.3 KB (165,176 bytes)

Product version:
3.0.23

Copyright:
Copyright © 2013

Original file name:
·install·exe·

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\adobe flash player 11.exe

Digital Signature
Signed by:
FIRSERIA, S.L.

Authority:
Thawte, Inc.

Valid from:
7/23/2013 8:00:00 PM

Valid to:
7/24/2014 7:59:59 PM

Subject:
CN="FIRSERIA, S.L.", OU=IT, O="FIRSERIA, S.L.", L=Badalona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
73C4780FAC0CD497B0778732FB8AF673

File PE Metadata
Compilation timestamp:
11/12/2013 6:07:22 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:pjSkrwevwwuvy6/Dq13YvXZZtLt8gQb6i+w5woutWj/n:oOBvwwFz1ohriYoSK

Entry address:
0x73080

Entry point:
60, BE, 00, 20, 45, 00, 8D, BE, 00, F0, FA, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 1D, 13, 07, 00, 57, 83, C3, 04, 53, 68, 72, 10, 02, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 00, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Entropy:
7.8684  (probably packed)

Code size:
136 KB (139,264 bytes)

Remove adobe flash player 11.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.