» adobeflashplayer.exe
Overview
Analysis
File Details
Downloads (1)

adobeflashplayer.exe

SafeInstaller

InstallX, LLC

This is the InstallX/InstallIQ download manager and installer that will bundle offers during setup for additional PUPs and other unwanted software. The application adobeflashplayer.exe by InstallX has been detected as adware by 37 anti-malware scanners. The program is a setup application that uses the InstallIQ Installation Manager installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

SafeInstall, LLC (signed by InstallX, LLC)

Product:

SafeInstaller

Description:

Safe Installer

Version:

1.0.72.0

MD5:

6891534bd44dc63c68f29ce31e8fc6d9

SHA-1:

1f8e89f08ca850143c56e3c720589dff521e0522

SHA-256:

385d40ed7d5664ec4b54fdbbbfc5861746d81f2f515c82336fb051e9878a8dad

Scanner detections:

37 / 68

Status:

Adware

Explanation:

Uses the InstallIQ (by InstallX) software bundler that may include toolbars and other browser extensions offers.

Description:

This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:

5/19/2024 10:33:16 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.InstallIQ.J

396

AhnLab V3 Security

PUP/Win32.SoftPulse

2015.02.28

Avira AntiVirus

APPL/InstallIQ.Gen4

7.11.212.236

avast!

Adware-CLU [PUP]

2014.9-160104

AVG

Adware BundleApp

2017.0.2874

Baidu Antivirus

Adware.Win32.InstallIQ

4.0.3.1614

Bitdefender

Application.Bundler.InstallIQ.J

1.0.20.20

Bkav FE

W32.HfsAdware

1.3.0.6379

Comodo Security

Application.Win32.InstallIQ.B

21237

Dr.Web

Adware.Downware.9946

9.0.1.04

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.Graftor.155902

8.16.01.04.07

ESET NOD32

Win32/InstallIQ.A potentially unwanted application

10.7.0.302.0

Fortinet FortiGate

Riskware/InstallIQ

1/4/2016

F-Prot

W32/InstallIQ.A.gen

v6.4.7.1.166

F-Secure

Application.Bundler.InstallIQ

11.2016-04-01_2

G Data

Win32.Application.InstallIQ

16.1.25

IKARUS anti.virus

PUA.InstallIQ

t3scan.1.8.6.0

K7 AntiVirus

Unwanted-Program

13.1915114

Kaspersky

not-a-virus:Downloader.NSIS.Agent

14.0.0.866

Malwarebytes

PUP.Optional.SafeInstall.A

v2016.01.04.07

McAfee

Artemis!3C6665E215C2

5600.6530

MicroWorld eScan

Application.Bundler.InstallIQ.J

17.0.0.12

NANO AntiVirus

Riskware.Win32.Searcher.csnymk

0.30.8.659

Norman

Gen:Variant.Application.Bundler.Graftor.155902

11.20160104

nProtect

Trojan.Downloader.JRJW

15.04.23.01

Panda Antivirus

Trj/Genetic.gen

16.01.04.07

Qihoo 360 Security

HEUR/QVM41.1.Malware.Gen

1.0.0.1015

Quick Heal

Downloader.NSIS.g1c (Not a Virus)

1.16.14.00

Reason Heuristics

PUP.InstallX.SafeInstall.Installer (M)

16.1.4.19

Rising Antivirus

PE:Trojan.Win32.Generic.174C4940!390875456

23.00.65.16102

Sophos

InstallQ

4.98

Total Defense

Win32/Tnega.RKeJbRB

37.1.62.1

Trend Micro House Call

Suspicious_GEN.F47V0220

7.2.4

Trend Micro

TROJ_GEN.F0C2C00KP14

10.465.04

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

3.12.26.3

VIPRE Antivirus

Threat.4783689

38552

Zillya! Antivirus

Downloader.Agent.Win32.240015

2.0.0.2115

File size:

2 MB (2,117,144 bytes)

Product version:

1.0.72.0

Original file name:

safeinstall.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

InstallIQ Installation Manager

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\adobeflashplayer.exe

Digital Signature

Signed by:

InstallX, LLC

Authority:

DigiCert Inc

Valid from:

3/20/2014 8:00:00 PM

Valid to:

4/8/2015 8:00:00 AM

Subject:

CN="InstallX, LLC", O="InstallX, LLC", L=Sartell, S=Minnesota, C=US

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0F4D188192318D28510FC886CBB855E6

File PE Metadata

Compilation timestamp:

2/9/2015 12:29:11 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

CTPH (ssdeep):

49152:YvlwvmA2vDTXj5lppfNH5DlhsZCTBVOxbFBjumo:YvQmAy5lDnsZ/bFFuZ

Entry address:

0x5772A

Entry point:

E8, E3, 3B, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 00, 70, 54, 00, E8, 20, 2C, 00, 00, E8, B0, 3D, 00, 00, 0F, B7, F0, 6A, 02, E8, 76, 3B, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 57, 35, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8... 
[+]

Entropy:

7.1535

Code size:

1.1 MB (1,102,848 bytes)

The file adobeflashplayer.exe has been seen being distributed by the following URL.

http://dl2.vip0installer.com/download/Base/471500/.../adobeflashplayer.exe

Remove adobeflashplayer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.