home

flash.exe

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from paoeosclp0b0qpdqcc.adddveer.com and multiple other hosts.
MD5:
8e013328be4a57f51ed762bfb1abf0eb

SHA-1:
f7bd8a16da4f04ecd60f56fdec5e99f82059f12c

SHA-256:
0ce32956a037420f0be19606358f4a006dd25d44d893db7546ae77bed1518d92

Scanner detections:
3 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
4/23/2024 10:07:01 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Malware-gen
2014.9-140512

Qihoo 360 Security
HEUR/Malware.QVM06.Gen
1.0.0.1015

Trend Micro House Call
TROJ_GE.3AC9AE20
7.2.132

File size:
1.4 MB (1,419,206 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\flash.exe

File PE Metadata
Compilation timestamp:
12/5/2009 11:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
24576:Sl+3nnoiUZCCC3ocBuTZGLOGg28KthdRx+01EDzbHWa6pQhpn5UYtam:PnoHhLkm45wKthdn+0+fbHWaySpngm

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file flash.exe has been seen being distributed by the following 50 URLs.

http://paoeosclp0b0qpdqcc.adddveer.com/.../xz.php?ii=dTk5NVMyOTBiOTMyRTkwM00yOTVGNjE2&id=22&a=50393&l=xh

http://uygbk3kktee.adddveer.com/.../xz.php?ii=ZDI0MlA5MTR6MTMxUzE3MUMzN1M4MTE=&id=22&a=41213&l=xh

http://jyhakmaqocnzriy.adddveer.com/.../xz.php?ii=cjI0OVkzMzVpNjg4UzI4M0gzODhSMTAy&id=22&a=41213&l=xh

http://vdj1hxq8hlzrbc.adddveer.com/.../xz.php?ii=YzI4OVoyODdlODhVMjE3SzM4M0s1Mjc=&id=22&a=41213&l=xh

http://8bshgwjlt5.adddveer.com/.../xz.php?ii=azUzOVI0OGc5NzNaNTkwUTIwNlg1MDc=&id=22&a=41213&l=xh

http://zrpvmuywxm1r.adddveer.com/.../xz.php?ii=dzYxMEU5OTRnNzA0VjQ5MVo5MTRSNjY0&id=22&a=41213&l=xh

http://j7xxc6q5vlg.adddveer.com/.../xz.php?ii=czM0M0I3MDJvNzI1Sjg1N0EzNDhVNjk3&id=22&a=41213&l=xh

https://doc-0c-74-docs.googleusercontent.com/docs/securesc/ha0ro937gcuc7l7deffksulhg5h7mbp1/saapr08te6294nis0k211g73lqhi0o3a/1400342400000/10462124777546911848/.../0B-FHAiRn2jUqLVYtUmQ4enRINzg?h=16653014193614665626&e=download

http://pcdzyfzisayer4.adddveer.com/.../xz.php?ii=eDM2NUwyODZ6MzA2RjM3MlM5OTZVMzEx&id=22&a=41213&l=xh

http://dsripjvawiyvnhn9.adddveer.com/.../xz.php?ii=dTcyM1g0Nzd0MzBQODU2VzY1OVo2NjM=&id=22&a=46608&l=xh

http://l9wjfanydf54ccrk.adddveer.com/.../xz.php?ii=aTUzNlI0NTFrNDE4TzMwMUE1NjNONTk0&id=22&a=41213&l=xh

http://kb61ze2h2yiu.adddveer.com/.../xz.php?ii=eTg1OEo2MjZvNjVKODcxTjQxTDcwNw==&id=22&a=41213&l=xh

http://granijcxlay.adddveer.com/.../xz.php?ii=eDU3M1M0MzlqMTc3RTk4RzExNVA2OTU=&id=22&a=41213&l=xh

http://4kwkpmemqordixgs.adddveer.com/.../xz.php?ii=YTI4OEM3NDZjMzM2RzMwOEoyNTFIOTU5&id=22&a=41213&l=xh

http://ejszshvzp.adddveer.com/.../xz.php?ii=azU4NkQ3MjV5NTUwTDQ0MVk2MThQMjAz&id=22&a=41213&l=xh

http://v48d6tdysvc.adddveer.com/.../xz.php?ii=cjY4OUk5NTNyNTc0QTc4NE03OTBJODkx&id=22&a=41213&l=xh

http://vbnbbiqas.adddveer.com/.../xz.php?ii=dDU0N08xMDB3OTA4UTM0ME4zMTVXMzIw&id=22&a=44228&l=xh

http://axklgkwbuudjtzzi.adddveer.com/.../xz.php?ii=czM0MkU1NDRqMTIzTzQ4TDk2M0UzMTk=&id=22&a=46608&l=xh

http://g3o8guoaewpozxr.adddveer.com/.../xz.php?ii=ejczOUYxMzVrNzgxSzg2OE03MzZIOTg=&id=22&a=44483&l=xh

http://mvo4hmsrxxrjscda.adddveer.com/.../xz.php?ii=ZTgzM1c4ODB6NDAyVDY5OVI4ODhUMjc1&id=22&a=41213&l=xh

http://lra03x3tgp9wol.adddveer.com/.../xz.php?ii=YzIxNVcyMHcyNDZCOTI1SDM0TzgwNw==&id=22&a=41213&l=xh

http://0osffuajy.adddveer.com/.../xz.php?ii=dDYyMFM5OTNoNzI3VDUzM0cyNjdIOTYz&id=22&a=41213&l=xh

http://k3jiwjcwufqtce7sux.adddveer.com/.../xz.php?ii=bzI4NVoyN2s0ODFZODc1RjUxMFc0ODE=&id=22&a=41213&l=xh

http://0jsmyyn87.adddveer.com/.../xz.php?ii=ajczOU82ODNyNTUyQjYyM0I4NTNTOTk1&id=22&a=46608&l=xh

http://phoehbxet.adddveer.com/.../xz.php?ii=aDYxMlQ1ODdtNDMxUzM1RTMzM0k4NzA=&id=22&a=44483&l=xh

http://nr7m8zhimq.adddveer.com/.../xz.php?ii=ZTcxMVozNzhnNjU0VTE3NUU5NzJCMzYy&id=22&a=41213&l=xh

http://oasmh5qjnhzk.adddveer.com/.../xz.php?ii=eDcyMEQ4ODdnNDc4STE4M1Y0OE82MDk=&id=22&a=47604&l=xh

http://0e6j0itwlg.adddveer.com/.../xz.php?ii=czk0OUk2OXY4MzRZNzI2TTE1NlIyNzI=&id=22&a=46608&l=xh

http://e9e5rplcr.adddveer.com/.../xz.php?ii=bzg5NVM1MTF1OTc2VTI3M1IzOTBBMzc1&id=22&a=41213&l=xh

http://2hnbvk4n.adddveer.com/.../xz.php?ii=YTc2NlkxNzFrMjA4TjgwOUs4NDZLMjQw&id=22&a=46608&l=xh

Latest 30 of 60 download URLs

Scan flash.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.