home

adobe_flash_player-37726893.exe

Zen Bros Media

The application adobe_flash_player-37726893.exe by Zen Bros Media has been detected as a potentially unwanted program by 5 anti-malware scanners. The file has been seen being downloaded from intva31.keyboardnetworks.info and multiple other hosts.
Publisher:
Zen Bros Media  (signed and verified)

MD5:
9beb0fb8c1007904eeec1d3e5d5f8079

SHA-1:
046753a42cf1d2e28e34bebedda306ac506598cb

SHA-256:
54f6ce03aaa86de62a1d5b18b9aecf92d6eb023ef157e86a537aedc3aff27577

Scanner detections:
5 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Analysis date:
5/20/2024 5:30:28 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Helper
2016.05.17

Dr.Web
Trojan.Vittalia.10462
9.0.1.05190

IKARUS anti.virus
Trojan.Win32
t3scan.2.0.9.0

Reason Heuristics
PUP.DownloadAdmin.ZenBrosM (M)
16.5.17.23

Rising Antivirus
Malware.Generic!rk0JAmC3ED@5 (Thunder)
23.00.65.16515

File size:
471.3 KB (482,568 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_flash_player-37726893.exe

Digital Signature
Signed by:
Zen Bros Media

Authority:
GoDaddy.com, Inc.

Valid from:
3/8/2016 5:12:43 PM

Valid to:
3/8/2017 5:12:43 PM

Subject:
CN=Zen Bros Media, O=Zen Bros Media, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
00DA69A0BD854BB554

File PE Metadata
OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
3.0

CTPH (ssdeep):
12288:/ThKd6hIaNYLNcYM4+Q3sMnMbI7cRFUJ6DNF99GIR6v:/VKd62AYJcYM4+Q3sMMbIIRFUJ6DNF9S

Entry address:
0x4C6E0

Entry point:
C6, 05, 70, D2, 44, 00, 00, B9, 00, 00, 46, 00, BA, 04, 00, 46, 00, B8, B0, F6, 44, 00, E8, 65, FF, FF, FF, E8, 70, FF, FF, FF, B8, 90, F6, 44, 00, E8, 16, 4B, FC, FF, C3, 00, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, FF, FF, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.7060

Code size:
301.8 KB (309,024 bytes)

The file adobe_flash_player-37726893.exe has been seen being distributed by the following 22 URLs.

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37796453&ephemeral=1&filename=adobe_flash_player.exe&cb=-1600239620&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37884548&ephemeral=1&filename=adobe_flash_player.exe&cb=1612327832&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37739066&ephemeral=1&filename=adobe_flash_player.exe&cb=1445229278&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37783428&ephemeral=1&filename=adobe_flash_player.exe&cb=1501888972&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37880586&ephemeral=1&filename=adobe_flash_player.exe&cb=284301839&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37906513&ephemeral=1&filename=adobe_flash_player.exe&cb=-1803245435&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37794193&ephemeral=1&filename=adobe_flash_player.exe&cb=1160132845&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37892936&ephemeral=1&filename=adobe_flash_player.exe&cb=1224210019&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37847815&ephemeral=1&filename=adobe_flash_player.exe&cb=-1836538709&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.processortalk.info/dl-pure/1202331/.../?bc=1202331&checksum=42064736&ephemeral=1&filename=adobe_flash_player.exe&cb=-646385675&hashstring=FUgDMzP5AyVq&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37830816&ephemeral=1&filename=adobe_flash_player.exe&cb=-1283124918&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37776104&ephemeral=1&filename=adobe_flash_player.exe&cb=-1145518779&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37899726&ephemeral=1&filename=adobe_flash_player.exe&cb=951579574&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37814983&ephemeral=1&filename=adobe_flash_player.exe&cb=1320366681&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37824061&ephemeral=1&filename=adobe_flash_player.exe&cb=-207909072&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37880212&ephemeral=1&filename=adobe_flash_player.exe&cb=-1536578839&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37828276&ephemeral=1&filename=adobe_flash_player.exe&cb=1738287939&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37756421&ephemeral=1&filename=adobe_flash_player.exe&cb=832478978&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37795026&ephemeral=1&filename=adobe_flash_player.exe&cb=1025145941&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37824720&ephemeral=1&filename=adobe_flash_player.exe&cb=-404777880&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37892152&ephemeral=1&filename=adobe_flash_player.exe&cb=-1277023041&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

http://intva31.keyboardnetworks.info/dl-pure/1202331/.../?bc=1202331&checksum=37845196&ephemeral=1&filename=adobe_flash_player.exe&cb=1786059018&hashstring=gVT1lo1YojGU&usefilename=true&executableroutePath=1202485&stub=true

Remove adobe_flash_player-37726893.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.