» flash_player_pro_setup.exe
Overview
Analysis
File Details
Downloads (1)

flash_player_pro_setup.exe

Safe Down

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application flash_player_pro_setup.exe, “Premium Installer ” by Safe Down has been detected as adware by 32 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. This program installs potentially unwanted software on your PC at the same time as the software you are trying to install, without adequate consent. It is also typically executed from an Internet Explorer cache folder. The file has been seen being downloaded from install.oinstaller9.com.

File name:

Publisher:

Premium Installer (signed by Safe Down)

Product:

Premium Installer

Description:

Premium Installer

Version:

2.4.8.1

MD5:

9402e89067f1c5301a92051b0718ba31

SHA-1:

4b5f0c5aef49dfa45008f3cbcdc8dabfbf87d4f5

SHA-256:

f7ccfed6578f8bb1616f428aaa75f72ceb05de800c9de51066450ffa82d93c5d

Scanner detections:

32 / 68

Status:

Adware

Explanation:

This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/19/2024 5:17:32 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Application.Bundler.25

387

Agnitum Outpost

PUA.Agent

7.1.1

AhnLab V3 Security

PUP/Win32.Downloader

2014.11.10

Avira AntiVirus

Adware/iBryte.bxou

7.11.183.220

avast!

Win32:Adware-gen [Adw]

2014.9-160114

AVG

Adware AdPlugin

2017.0.2865

Bitdefender

Gen:Variant.Adware.Graftor.159721

1.0.20.70

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Adware.Ibryte-6261

0.98/19664

Comodo Security

Application.Win32.AgentCV.HWYE

20035

Dr.Web

Adware.iBryte.493

9.0.1.014

Emsisoft Anti-Malware

Gen:Variant.Application.Bundler.25

8.16.01.14.01

ESET NOD32

Win32/Adware.iBryte.BO application

10.7.0.302.0

Fortinet FortiGate

W32/Zbot.AAN!tr

1/14/2016

F-Prot

W32/A-512ed8f8

v6.4.7.1.166

F-Secure

Riskware.Gen:Variant.Application.Bundler

11.2016-14-01_5

G Data

Gen:Variant.Adware.Graftor.159721

16.1.24

IKARUS anti.virus

not-a-virus:AdWare.iBryte

t3scan.1.8.3.0

K7 AntiVirus

Adware

13.185.13943

Kaspersky

not-a-virus:AdWare.Win32.iBryte

14.0.0.820

Malwarebytes

PUP.Optional.OptimunInstaller

v2016.01.14.01

McAfee

Program.IBryte-FRK

5600.6521

MicroWorld eScan

Gen:Variant.Adware.Graftor.159721

17.0.0.42

NANO AntiVirus

Riskware.Win32.IBryte.dgrber

0.28.6.62995

Norman

Gen:Variant.Application.Bundler.25

11.20160114

nProtect

Trojan-Clicker/W32.iBryte.74096

14.11.06.01

Quick Heal

TrojanDownloader.Badur.A5

1.16.14.00

Reason Heuristics

PUP.Adknowledge.SafeDown.Bundler (M)

16.1.14.1

Sophos

PUA 'iBryte Optimum Installer'

5.10

Vba32 AntiVirus

AdWare.iBryte

3.12.26.3

VIPRE Antivirus

Threat.4778314

34232

Zillya! Antivirus

Adware.iBryte.Win32.3001

2.0.0.1977

File size:

79.4 KB (81,264 bytes)

Product version:

2.4.8.1

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Adknowledge Fusion

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\flash_player_pro_setup.exe

Digital Signature

Signed by:

Safe Down

Authority:

COMODO CA Limited

Valid from:

3/18/2014 1:00:00 AM

Valid to:

3/19/2015 12:59:59 AM

Subject:

CN=Safe Down, O=Safe Down, STREET="4600 Madison Ave., FL 10", L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00FA71459C161D5D538F7612ACFBFBB680

File PE Metadata

Compilation timestamp:

11/10/2014 10:00:25 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

768:xaAnxxYusYx2j2Lschi8uqRqU/JYM5wOe9W3eUZjwyDOJJubclo8Jw:vxxYui2zi++DO26P9Ai

Entry address:

0x6211

Entry point:

E8, 42, 05, 00, 00, E9, 36, FD, FF, FF, CC, FF, 25, F8, 71, 40, 00, 6A, 14, 68, 58, A4, 40, 00, E8, B2, 00, 00, 00, FF, 35, 34, D4, 40, 00, 8B, 35, D8, 71, 40, 00, FF, D6, 59, 89, 45, E4, 83, F8, FF, 75, 0C, FF, 75, 08, FF, 15, D4, 71, 40, 00, 59, EB, 67, 6A, 08, E8, A2, 05, 00, 00, 59, 83, 65, FC, 00, FF, 35, 34, D4, 40, 00, FF, D6, 89, 45, E4, FF, 35, 30, D4, 40, 00, FF, D6, 59, 59, 89, 45, E0, 8D, 45, E0, 50, 8D, 45, E4, 50, FF, 75, 08, 8B, 35, C0, 71, 40, 00, FF, D6, 59, 50, E8, 65, 05, 00, 00, 89, 45... 
[+]

Code size:

24 KB (24,576 bytes)

The file flash_player_pro_setup.exe has been seen being distributed by the following URL.

https://install.oinstaller9.com/o/.../Flash_Player_Pro_Setup.exe

Remove flash_player_pro_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.