adobe_flash_setup.exe

flash setup

OOO ELEKTRO-KOD

The application adobe_flash_setup.exe by OOO ELEKTRO-KOD has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from safe.soft2download.website and multiple other hosts.
Publisher:
OOO ELEKTRO-KOD  (signed and verified)

Product:
flash setup

Version:
1.0.0.0

MD5:
910ff6f6c3e96882a7fb30db38d4e885

SHA-1:
74ae80418dce1f0b9ce970bfe6a22a44ae14f876

SHA-256:
e7ce8c25f8da55c298efd0de2ee18b1388222d6597cda024dab7f644240c259a

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/1/2024 6:45:38 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.OOOELEKT.Installer (M)
16.4.23.15

File size:
187.1 KB (191,568 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © 2016

Original file name:
Flash.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\adobe_flash_setup.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
6/8/2015 2:00:00 AM

Valid to:
6/8/2016 1:59:59 AM

Subject:
CN=OOO ELEKTRO-KOD, O=OOO ELEKTRO-KOD, STREET="109428,GOROD MOSKVA,,,,ULITsA IBRAGIMOVA,35, 2,I KOMN.14,", L=Moscow, S=Moscow, PostalCode=109428, C=RU

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00D1727DFA82A3E28C73A633A65CE817E4

File PE Metadata
Compilation timestamp:
4/16/2016 7:08:46 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:joaUUotCKTEHyXxKbdtMUeTkHHRAzQ4IbLHhxy/jJdurUh1T/WLwA6Fw0:jJRotCgEHyAb0QUQ7hxyLur+YMF/

Entry address:
0xC35E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.3814

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
41 KB (41,984 bytes)

The file adobe_flash_setup.exe has been seen being distributed by the following 40 URLs.

http://safe.soft2download.website/dl.php?zhrj=ZVDFIoOsWnhVuPXYduCWR0GR5RS6waXiaGhIyH7yuxE.&cid=31285503431461447051&conversion_id=14614470566963&app_id=4&lp_id=1594&v=tribat&stub_id=305&v_id=OlGq3NBbngBeLwla6S2vdQYTw2OogB-RQXvmYGzefdk.&lpp=*-*-*

http://safe.soft2download.website/dl.php?gwzter=ZVDFIoOsWnhVuPXYduCWR0GR5RS6waXiaGhIyH7yuxE.&cid=31052349601461585333&conversion_id=14615853861436&app_id=4&lp_id=1600&v=tribat&stub_id=305&v_id=42Iet4fHQ6C65Qm9h2o1i_IMF8RH64g05gw5XKPCzgQ.&lpp=No match

http://newsoft12.freesearch4u.website/dl.php?vgfsdv=GGV_Pu71bPhU1fj6-XpWEl_dWmYEEwvaFUfmluMZi4I.&cid=8&sid=[SUB_ID]&conversion_id=14615397107104&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=cpzDpb16wUlIYi1fHdXPeJPSUqfh4tUZbaMW8RPUOcE.&lpp=*-*-*

http://safe.soft2download.website/dl.php?gwzter=V6ggtPSfPBnjgGPLPRg1F8RvkCX3npdk8pUvwP5LaCY.&cid=18348312171461587313&conversion_id=14615873206234&app_id=4&lp_id=1594&v=tribat&stub_id=305&v_id=kuC12lH6hl4PO195v_MA_KBQxb5Al51iBVKvbcwNZ-M.&lpp=*-*-*

http://safe.soft2download.website/dl.php?zhrj=JEZUCP9ythHm1KfOKYRUzQJerVL6zvgzPdolGyU62F0.&cid=174758780346&conversion_id=14614458803073&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=HwmLR1uxdm0s49fBfglP7yA4FonV7dShr4LXuo7S1ZY.&lpp=*-*-*

http://safe.soft2download.website/dl.php?gwzter=E8AeT_i_eNx1fVDaFVIiw5vdn2LPPK_lhvVy7iBWfEw.&cid=MzAwNyMxMjEwMiM5NzIjMjA2Njd8MjgyMzU5fEJSfDN8MXx8WlhCdFlXUnpYM2RwWkhSbypOekk0flkyZyp-ZEhvKkxUTX5ZMnhwWTJzKn5kR0Z5U1dRKlpYQnRZV1J6TFRrM05UTTFPVEZoTXpOaVl6TXlNRGhoWkRsaE9ETTBZMlE0WkRVNU1tVXdMVGN5T0hnNU1BflpYQnRZV1J6WDJobGFXZG9kQSpPVEF-Y21WeGRXVnpkRkpsWmcqYUhSMGNEb3ZMM2QzZHk0MGMyaGhjbVZrTG1OdmJTOXlZWEl2VW5CMGVESnNPRkF2VUZKSFYwVkNTUzVvZEcxc35kQSpNVFEyTVRZeE1EYzBNVFEwTnd-ZGcqTVF-Y21WeGRXVnpkRlZ5YkEqYUhSMGNEb3ZMMlZ3YjIxaFpITXlMalJ6YUdGeVpXUXVZMjl0TDJGa2N6OTJQVEVtYTJWNVBUYzBObU16TURKaU9EWXdPR0UyWmpNNVkyVXpaV0ZrWW1SaE56UmxOakl4Sm5SaGNrbGtQV1Z3YjIwdE56UTJZek13TW1JNE5qQTRZVFptTXpsalpUTmxZV1JpWkdFM05HVTJNakVtWTBsa2N6MG1ZV1J6UTJGdGNHRnBaMjVMWlhrOU1UUTJNVFl4TURjME1EY3lNU1pqYUQwbVkyeHBZMnM5Sm5SNlBTMHpKblE5TVRRMk1UWXhNRGMwTVRFek9DWnlaWEYxWlhOMFZYSnNQV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3VOSE5vWVhKbFpDNWpiMjBsTWtaeVlYSWxNa1pTY0hSNE1tdzRVQ1V5UmxCU1IxZEZRa2t1YUhSdGJDWnlaWEYxWlhOMFVtVm1QV2gwZEhBbE0wRWxNa1lsTWtaM2QzY3V

http://safe.soft2download.website/dl.php?gwzter=2IoEeC7_3Qqcv4ZGCdA_8-hpaDsMjH5dIUOAGEfjnpw.&cid=909483881461611232&conversion_id=14616112349484&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=WWS7gzIqTwqfVWlyOukwIhynmCg87Mm1vPY8AqQ_cDg.&lpp=*-*-*

http://safe.soft2download.website/dl.php?gwzter=V6ggtPSfPBnjgGPLPRg1F8RvkCX3npdk8pUvwP5LaCY.&cid=14672684071461585742&conversion_id=14615857436232&app_id=4&lp_id=1379&v=tribat&stub_id=305&v_id=EAyGE-TatNgcHrtns8WRmHIs3K8LaktrE1cN61DfJm8.&lpp=*-*-*

http://futureupdates.applicationtechnica.tech/dl.php?dsaf=GGV_Pu71bPhU1fj6-XpWEl_dWmYEEwvaFUfmluMZi4I.&cid=8&sid=[SUB_ID]&conversion_id=14615428933763&app_id=4&lp_id=1362&v=tribat&stub_id=305&v_id=GlLAN2Ge0lHx7xMUMnB5Mnfq79vbIh7lEJQGDBmXQAc.&lpp=*-*-*

Latest 30 of 40 download URLs

Remove adobe_flash_setup.exe - Powered by Reason Core Security