» flashplayer-setup.exe
Overview
Analysis
File Details

flashplayer-setup.exe

Flash Player

IDEAS SAAS SOLUTIONS LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application flashplayer-setup.exe, “Setup Launcher Unicode ” by IDEAS SAAS SOLUTIONS has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Nom de votre société (signed by IDEAS SAAS SOLUTIONS LLC)

Product:

Flash Player

Description:

Setup Launcher Unicode

Version:

1.00

MD5:

f19944cc4311cf5e6aa5ab8f94736b86

SHA-1:

351ad27a47f28f1895c5879427f98cd985ff3c53

SHA-256:

21f29c88b27039a21346e013c987af0bb6a468e89fc3e6bd4a37d621ed4a43ff

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 11:43:27 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore.IDEASSAASSOLUTIONS.Installer (M)

16.1.10.20

File size:

12.4 MB (12,969,032 bytes)

Product version:

1.00

Original file name:

Setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore

Language:

French (France)

Common path:

C:\users\{user}\downloads\flashplayer-setup.exe

Digital Signature

Signed by:

IDEAS SAAS SOLUTIONS LLC

Authority:

Thawte, Inc.

Valid from:

12/17/2012 1:00:00 AM

Valid to:

12/18/2013 12:59:59 AM

Subject:

CN=IDEAS SAAS SOLUTIONS LLC, O=IDEAS SAAS SOLUTIONS LLC, L=WILMINGTON, S=DELAWARE, C=US

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

0CA4874D28263695E883DBFEC171D375

File PE Metadata

Compilation timestamp:

9/22/2009 6:59:30 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

196608:5Byx6++t2H99EJ5uJ9rRMBnbja6Y2/WxvzYHPGd3fIo6CjDemHmYwzIa8U92uYD:L4SIJ3U1/Wx7Tdf6CnHmYwzIFUcD

Entry address:

0x56683

Entry point:

55, 8B, EC, 6A, FF, 68, F8, 7E, 47, 00, 68, 60, 72, 45, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 58, 53, 56, 57, 89, 65, E8, FF, 15, 7C, 61, 47, 00, 33, D2, 8A, D4, 89, 15, 30, 87, 49, 00, 8B, C8, 81, E1, FF, 00, 00, 00, 89, 0D, 2C, 87, 49, 00, C1, E1, 08, 03, CA, 89, 0D, 28, 87, 49, 00, C1, E8, 10, A3, 24, 87, 49, 00, 6A, 01, E8, 44, 3E, 00, 00, 59, 85, C0, 75, 08, 6A, 1C, E8, C2, 00, 00, 00, 59, E8, D9, 1A, 00, 00, 85, C0, 75, 08, 6A, 10, E8, B1, 00, 00, 00, 59, 33, F6, 89, 75... 
[+]

Developed / compiled with:

Microsoft Visual C++ v6.0

Code size:

465.5 KB (476,672 bytes)

Remove flashplayer-setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.