» flashplayer_v.138381227c.exe
Overview
Analysis
File Details
Downloads (32)

flashplayer_v.138381227c.exe

TUGUU SL

The Tuguu download and install manager uses the DomalIQ installer to bundle additional adware offers such as toolbars and browser extensions during the setup process. This software distributes modified installers which are not the same as the original distributed by the author. The application flashplayer_v.138381227c.exe by TUGUU SL has been detected as adware by 16 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

TUGUU SL (signed and verified)

MD5:

43a9fa0168bb87c0e7f0df5f106be3f3

SHA-1:

3b8a1f793062fc9f4db2396e65b64581a557ab24

SHA-256:

f99b964fb04ef86bc710814d0c52a9e7028a43f0bf3f43769c841850dc8d5f2c

Scanner detections:

16 / 68

Status:

Adware

Explanation:

Uses the InstallIQ download installer to bundle various adware offers.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/18/2024 9:22:06 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

APPL/DomaIQ.Gen

7.11.123.198

avast!

NSIS:DomaIQ-C [PUP]

2014.9-140512

Bkav FE

W32.Clod3ba.Trojan

1.3.0.4613

Comodo Security

ApplicUnwnt

17564

Dr.Web

Adware.W3i.29

9.0.1.0132

ESET NOD32

Win32/DomaIQ

8.9256

IKARUS anti.virus

AdWare.DomaIQ

t3scan.2.2.29

K7 AntiVirus

Trojan

13.175.10750

Malwarebytes

PUP.FakeFlash.Domaiq

v2014.05.12.11

McAfee

Artemis!43A9FA0168BB

5600.7132

Norman

Suspicious_Gen4.ERZRG

11.20140512

Panda Antivirus

Adware/MultiToolbar

14.05.12.11

Reason Heuristics

PUP.TUGUUSL.X

14.8.7.18

Sophos

Generic PUA CF

4.96

Vba32 AntiVirus

Trojan.MSIL.Crypt

3.12.24.3

VIPRE Antivirus

DomaIQ

25150

File size:

420.4 KB (430,440 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup (using Nullsoft Install System)

Common path:

C:\users\{user}\downloads\flashplayer_v.138381227c.exe

Digital Signature

Signed by:

TUGUU SL

Authority:

GoDaddy.com, Inc.

Valid from:

5/3/2013 6:24:02 PM

Valid to:

5/3/2014 6:24:02 PM

Subject:

CN=TUGUU SL, O=TUGUU SL, L=Adeje, S=Santa Cruz de Tenerife, C=ES

Issuer:

SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

2776B257979F9A

File PE Metadata

Compilation timestamp:

12/5/2009 10:50:46 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

6144:1s6FOqwaSFIXscLWe8s+KcTXwWvthiMp5G5RuJjmz1B2XTfXrVm4La:xFzscLWLs9GPiMp5G5IJjMB2XTfwMa

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Entropy:

7.9399

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file flashplayer_v.138381227c.exe has been seen being distributed by the following 32 URLs.

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1748656Za1511074Zg171Zw1Zm451Zc1856000315,1856000315Zs106Zi3ZZ&PubID=2&__tc=1368827729.77

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1799922Za1563631Zg171Zw1Zm104Zc1856000463,1856000463Zs143Zi1ZZ&PubID=2&__tc=1368814308.4

http://yads.zedo.com/ads2/c?a=1490641;x=2317;g=49;c=1856000389,1856000389;i=0;n=1856;s=130;1=8;2=4;tg=1369090005;vr=4;m=2;w=33;p=6;h=1714596;f=1721773;b=10;u=MeFC0AoBABYAAGkeU74AAAAF~100612;z=0.9680056102417024;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://yads.zedo.com/ads2/c?a=1490641;x=2317;g=49;c=1856000389,1856000389;i=0;n=1856;s=130;1=8;2=4;tg=1369080619;vr=4;m=11;w=28;p=6;h=1714596;f=1721773;b=10;u=lQFgUZ5S1TqUPpU@BG0XWIyf~040613;z=0.6599831605488298;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://yads.zedo.com/ads2/c?a=1522577;x=2317;g=27;c=1856000355,1856000355;i=0;n=1856;s=123;1=8;2=21;tg=1368933085;vr=3;m=90;w=8;p=6;h=1714596;f=1760229;b=10;u=2YyXUZG421qqFi0z300qcJtI~051813;z=0.9189934089953405;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=11

http://yads.zedo.com/ads2/c?a=1490641;x=2317;g=49;c=1856000389,1856000389;i=0;n=1856;s=130;1=8;2=4;tg=1368964611;vr=4;m=11;w=28;p=6;h=1714596;f=1721773;b=10;u=u7FfT068phof654EvzmWOMTE~031312;z=0.7040179198194285;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://yads.zedo.com/ads2/c?a=1511020;x=2317;g=27;c=1856000382,1856000382;i=0;n=1856;s=129;1=8;2=1;tg=1368937430;vr=3;m=60;w=1;p=6;h=1714596;f=1748648;b=10;u=AC0zAQoBADQAAF926vIAAAAT~081110;z=0.6917100476380699;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=1

http://yads.zedo.com/ads2/c?a=1556387;x=7181;g=172;c=1856000456,1856000456;i=0;n=1856;s=103;1=8;2=1;tg=1369083340;vr=2;m=6;w=12;p=6;h=1714596;f=1795024;b=10;u=aVUvkAoAADQAAHWtILYAAACV~061911;z=0.2317165449969255;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=12

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.142262109c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../825.74.110.087abf5d

http://cp.tuguu.com/.../download.php?p=825&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1443059027&_cc=GB&asdd=1&_qs=ClickID=ZZf1799922Za1563631Zg171Zw1Zm330Zc1856000463,1856000463Zs143Zi1ZZ&PubID=2&__tc=1368956674.64

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1799922Za1563631Zg171Zw1Zm330Zc1856000463,1856000463Zs143Zi1ZZ&PubID=2&__tc=1368956674.64

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.144976131c

http://yads.zedo.com/ads2/c?a=1564924;x=7181;g=81;c=1856000456,1856000456;i=0;n=1856;s=103;1=8;2=5;tg=1369083895;vr=1;m=4;w=78;p=6;h=1714596;f=1800564;b=10;u=PNuCke@NRMqIFtb2Rh261w**~051713;z=0.7990854938165067;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=12

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.140321584c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.085d2330

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.140320324c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.085d1e44

http://cp.tuguu.com/.../download.php?p=857&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1353609071&_cc=ES&asdd=1&_qs=ClickID=ZZf1721773Za1490644Zg49Zw28Zm11Zc1856000389,1856000389Zs130Zi3ZZ&PubID=5

http://tc.nicdls.com/tracking/a/.../ClickID=ZZf1721773Za1490644Zg49Zw28Zm11Zc1856000389,1856000389Zs130Zi3ZZ&PubID=5

http://yads.zedo.com/ads2/c?a=1490644;x=2317;g=49;c=1856000389,1856000389;i=3;n=1856;s=130;1=8;2=4;tg=1368908689;vr=3;m=11;w=28;p=6;h=1714596;f=1721773;b=10;u=1UgAUZc@M5PRhqIJc99oTcXK~012313;z=0.7812976517817645;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=5

http://yads.zedo.com/ads2/c?a=1492309;x=2317;g=49;c=1856000355,1856000355;i=0;n=1856;s=123;1=8;2=4;tg=1369120356;vr=3;m=11;w=28;p=6;h=1714596;f=1722550;b=10;u=UeFkTtlXOdMRj0cob9h1XAqQ~090511;z=0.9699535191541154;ainfo=;k=http://tc.nicdls.com/tracking/a/.../ClickID=%z&PubID=11

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.137339906c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../825.74.110.082fa402

http://cp.tuguu.com/.../download.php?p=825&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1346139081&_cc=NL&asdd=1&_qs=ClickID=ZZf1799963Za1563828Zg123Zw10Zm2Zc1856000463,1856000463Zs143Zi2ZZ&PubID=2&__tc=1368822518.53

http://cp.tuguu.com/pasarela/affp/.../ClickID=ZZf1799963Za1563828Zg123Zw10Zm2Zc1856000463,1856000463Zs143Zi2ZZ&PubID=2&__tc=1368822518.53

http://dls.nicdls.com/p/151/FlashPlayer/321/.../V.144262184c

http://cp.nicdls.com/pasarela/doma/dls.nicdls.com/p/151/FlashPlayer/321/.../857.74.110.08994428

http://cp.tuguu.com/.../download.php?p=857&_so=1&_bw=3&_sv=6.1&_bv=26.0&_ip=1558310985&_cc=DE&asdd=1&_qs=ClickID=ZZf1719920Za1488451Zg41Zw7Zm1Zc1856000355,1856000355Zs123Zi0ZZ&PubID=5

http://tc.nicdls.com/tracking/a/.../ClickID=ZZf1719920Za1488451Zg41Zw7Zm1Zc1856000355,1856000355Zs123Zi0ZZ&PubID=5

Latest 30 of 32 download URLs

Remove flashplayer_v.138381227c.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.