home

adobe_flash_setup.exe

Astro Network (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application adobe_flash_setup.exe by Astro Network (Fried Cookie) has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Astro Network (Fried Cookie Ltd.)  (signed and verified)

MD5:
541130307a449853eb53f6122e20cb17

SHA-1:
3d0d8810959fb19e2e7e49f43a8927bac17f146b

SHA-256:
6922f9c280da300b7b7b90bf6e47de04fe8edbc35be5712d160a243af8670406

Scanner detections:
15 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
5/4/2024 2:48:17 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

Avira AntiVirus
Adware/InstallCore.760688
7.11.198.70

AVG
Generic
2016.0.3158

Bkav FE
W32.HfsAdware
1.3.0.6379

Comodo Security
Application.Win32.InstallCore.EA
20498

Dr.Web
Trojan.MulDrop5.38502
9.0.1.086

ESET NOD32
Win32/InstallCore.PL potentially unwanted application
9.7.0.302.0

G Data
Win32.Application.InstallCore.DI
15.3.25

herdProtect (fuzzy)
variant of icreinstall_adobe_flash_setup.exe (Adware)
2015.7.1.22

K7 AntiVirus
Trojan
13.188.14468

Malwarebytes
PUP.Optional.AstroNet
v2015.03.27.02

NANO AntiVirus
Riskware.Win32.InstallCore.dmiyja
0.30.8.659

Reason Heuristics
PUP.Installer.InstallCore.Installer
15.3.27.2

Sophos
PUA 'Install Core Click run software'
59

VIPRE Antivirus
Threat.4786018
35418

File size:
742.9 KB (760,688 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\adobe_flash_setup.exe

Digital Signature
Signed by:
Astro Network (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
10/22/2014 7:02:00 AM

Valid to:
10/23/2015 7:02:00 AM

Subject:
CN=Astro Network (Fried Cookie Ltd.), O=Astro Network (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D5280137EC081E84AED06FDD52E337A0

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:sHzpxDH+a8jL4T5kAi2sHLHkL4zZARHhRrXyTT62E7bWL0i2DQ+8v7bczgE1v3t0:sHzDHt8jsxi2sCWAXRr8T62E7A2DQ+8j

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8631

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

Remove adobe_flash_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.