home

flash5-trialfr.exe

Flash

Macromedia

This is a setup program which is used to install the application. The file has been seen being downloaded from www.emjcd.com and multiple other hosts.
Publisher:
Macromedia

Product:
Flash

Version:
5

MD5:
3bc8864e1b1d104a9d8a7d962a69733d

SHA-1:
6e176aa6dfdd37be2e1cb10555881c135ecdd0dd

SHA-256:
e7c44f88b5a910fe286b161513e9b7e6b851f5e5d55b0d1276260465a79930fa

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
4/16/2024 3:09:54 PM UTC  (today)

Scan engine
Detection
Engine version

Comodo Security
Heur.Suspicious
19509

File size:
22.4 MB (23,470,237 bytes)

Product version:
5

Original file name:
stub32i.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

File PE Metadata
Compilation timestamp:
3/27/2000 8:09:58 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
393216:YQTM1fOeKZVDrkFwNwcVP2aoYsG0rpeFqbxxNtjd991QjzWMpM5QWXh/QL4Y+P2:YoMtjyrWYessG0rpeMbnN7991QF6QaeJ

Entry address:
0x83F7

Entry point:
55, 8B, EC, 6A, FF, 68, 10, 23, 41, 00, 68, 30, B5, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, E8, 21, 41, 00, 33, D2, 8A, D4, 89, 15, 30, 53, 41, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 2C, 53, 41, 00, C1, E1, 08, 03, CA, 89, 0D, 28, 53, 41, 00, C1, E8, 10, A3, 24, 53, 41, 00, 33, F6, 56, E8, E0, 00, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, B0, 00, 00, 00, 59, 89, 75, FC, E8, 11, 2F, 00, 00, FF, 15, EC, 21, 41, 00, A3, E4, 68, 41, 00, E8...
 
[+]

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
68 KB (69,632 bytes)

The file flash5-trialfr.exe has been seen being distributed by the following 8 URLs.

http://www.emjcd.com/cr122dlutD/lsx/A9GDEGEH/B9GEHGD/9/B99H99GFFACEBBBCEH/GFmoGHkBHlDkAAnDHBDFAH9CGC9jjECA?f=cGD7=3FFB%PW%Ob%ObzAI97Awz.8wyDA80z4w.yA8%ObBGx%Ob17wE3%Ob0Ez%Ob17wE3R-FD4w7bD.0J0<y5A!Ix3I-2ASOS0L<3FFB://III.6CLK15.yA8:UM/y74y6-OMTRUTQ-NMTQRTRU<<c<3FFB://III.MN90F.yA8/AGF47E/F070y3wD20D/I49zAIE/iG7F480z4w/AGF47E_49F0D90F/.../F070TQRU.3F87<

http://cj.dotomi.com/p979hz76P/z5A/ONURSUSV/PNUSVUR/N/N/N?g=exuo=kwwsm%5I%5Igrzqordg.pdfurphgld.frp%5Isxe%5Iiodvk%5Ihvg%5Iiodvk8-wuldoIu.h0h<<kwws://zzz.nt21im.frp:B3/folfn-53A8BA7-43A78A8B<<J<kwws://zzz.34qhw.frp/rxwlov/whohfkdujhu/zlqgrzv/Pxowlphgld/rxwlov_lqwhuqhw/.../whohA78B.kwpo<

http://www.emjcd.com/8g104gv32N/v16/KJQNOQOR/LJQORQN/J/LJJRJJQPPKMOLLLMOR/wLQwJtvyRNRLKKxNRLvtKRJMQMJtRwyw?k=b0xr=nzzv%9G%8L%8Lju2trugj.sgixuskjog.ius%8Lv0h%8Llrgyn%8Lkyj%8LlrgynB-zxogrLx.k3k<ipu!2hn2-D1s5CFy<nzzv://222.qw54lp.ius:E6/iroiq-86DBEDA-76DABDBE<<M<nzzv://222.67tkz.ius/u0zory/zkrkingxmkx/2otju2y/S0rzoskjog/u0zory_otzkxtkz/.../zkrkDABE.nzsr<

http://cj.dotomi.com/gi104xdml3/dkp/21856869/3186985/1/1/1?l=n41v=r33z%DK%CP%CPny6xvykn.wkm1ywonsk.myw%CPz4l%CPpvk2r%CPo2n%CPpvk2rF-31skvP1.o7o<<r33z://666.u098pt.myw:IA/mvsmu-CAHFIHE-BAHEFHFI<<Q<r33z://666.ABxo3.myw/y43sv2/3ovomrk1qo1/6sxny62/W4v3swonsk/y43sv2_sx3o1xo3/.../3ovoHEFI.r3wv<

http://download.macromedia.com/pub/flash/.../flash5-trialFr.exe

http://www.emjcd.com/pe122lnwvF/nuz/CBIFGIGJ/DBIGJIF/B/F0Co5EAEEBIIACEGHGEGEBIKHEAIx/nDpKqHoJEFFFCCpEJDJBGnDHBlqpBJml?c=yKHB=7JJF%Ta%Sf%Sf3EMDBE03.C02HEC4380.2EC%SfFK1%Sf5B0I7%Sf4I3%Sf5B0I7V-JH80BfH.4N4<29E!M17M-SRSFWUV<7JJF://MMM.AGPO59.2EC:YQ/2B82A-SQXVYXU-RQXUVXVY<<g<7JJF://MMM.QRD4J.2EC/J4B4270H64H/M8D3EMI/mKBJ8C4380/EKJ8BI_8DJ4HD4J/.../XUVY.7JCB<

http://www.apmebf.com/gj117cy65O/y49/NMTQRTRU/OMTRUTQ/M/M/M?w=gDA4=0CC8%MT%LY%LYw7F647tw.5tvA75xw1t.v75%LY8Du%LYy4tB0%LYxBw%LYy4tB0O-CA1t4YA.xGx<<0CC8://FFF.39IHy2.v75:RJ/v41v3-LJQORQN-KJQNOQOR<<Z<0CC8://FFF.JK6xC.v75/Cx4xv0tAzxA/F16w7FB/fD4C15xw1t/7DC14B_16CxA6xC/.../QNOR.0C54<

http://www.kqzyfj.com/click-2075874-10745758?url=http://download.macromedia.com/pub/flash/.../flash5-trialFr.exe

Scan flash5-trialfr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.