home

adobe_flash_player.exe

Internet

OOO Advert M

The application adobe_flash_player.exe, “Internet Setup ” by OOO Advert M has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from maintainpc.whensoftisupdated.net.
Publisher:
Program App Internet   (signed by OOO Advert M)

Product:
Internet

Description:
Internet Setup

MD5:
940177840f92f80d7e45237c789c1427

SHA-1:
1f0dab0b441e34b010c1152a5dc983499f856e0a

SHA-256:
8539582498dc6ec60ba210bc99e605a3f048f2f4fbfb12eee5ca25db7c8a55e9

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/7/2024 10:25:30 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OOOAdvertM.Installer (M)
16.1.29.20

File size:
970.4 KB (993,736 bytes)

Product version:
1.2.7

Copyright:
Internet Soft

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\adobe_flash_player.exe

Digital Signature
Signed by:
OOO Advert M

Authority:
COMODO CA Limited

Valid from:
4/16/2015 7:00:00 AM

Valid to:
4/16/2016 6:59:59 AM

Subject:
CN=OOO Advert M, O=OOO Advert M, STREET="ul. Vodnikov, d. 11 str. 2 of. 8", L=Moscow, S=Moscow, PostalCode=125362, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00A58E0827319014EEF1D32265A6B3710B

File PE Metadata
Compilation timestamp:
6/20/1992 5:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:pz2iPlJswIOyFsgPXnvLns0fsf0zHcQDG5OKfiAhTGMwZ:pqanN4jjBU8TcipKfJtGMwZ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9309

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file adobe_flash_player.exe has been seen being distributed by the following URL.

http://maintainpc.whensoftisupdated.net/dl.php?conversion_id=14318102705125&app_id=4&lp_id=376&v=ico&stub_id=240&v_id=Qs4mQm1XrN7npHZsM55H1sVWydh14Fz3marKYbyllSU.&pcl=IIBjkLnsfnr6ZmlwKXWAGo1_aO-uL_4TkdGJxsAv1oE.&CLICK_ID=fj-F84slXURRhaXsLz_KtubLXl52tRHEeam--JtYNgfCWnswslkdug99EVcNwV_p-8ExRdHl7kj-1aof4aNuNijxZmnpiSIUMYQcwRMyks2SLA10aYrKEuZxu6VxDKA2GgkptsR3ArgBFWORbrVJQQ2bWtpWDYsVol35KyCOgamJ41sOLDNEfZq2nOz7VDW6aETz1cTupPmI8KACcP7vOzcE4DP73prI6LzD7Bt2GTQM4NKbC1HqzGWxrDdADMVBa10T2heYrsyEbqmMho37qscBM5O6K-mJ9oRr1G0BJEYgKyI2OsxjEMUtrP-suX1cCV_3aRRByltV6KZcSlTXZ38o2yAjzfUxJf0hxWvbP8HpGyh_2qMIfB2cT6RLEob8bOpcpbeZ_KGON9PkcBbSQdKAGqZ5AyDPf2ERbxCJZogcAbNB6dY7V9iL5cM3yyg

Remove adobe_flash_player.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.