home

flashplayerpro-setup.exe

Recode

The application flashplayerpro-setup.exe by Recode has been detected as adware by 20 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from files4.mirror4.net and multiple other hosts.
Publisher:
Recode  (signed and verified)

MD5:
f17a3ebfa74cbaba51a59f2cbc0df946

SHA-1:
62d3a6409d79a528db099b9ef8253d5d25fa89e6

SHA-256:
a43956e6b4acdf2af2e59a3abaf733456abcf6ae007addd3aa7e76bd3045b2aa

Scanner detections:
20 / 68

Status:
Adware

Analysis date:
4/25/2024 11:31:47 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.OCK
897

Avira AntiVirus
Adware/Agent.OCK.8
7.11.168.222

avast!
Adware-OH [Adw]
140813-1

AVG
Generic
2015.0.3375

Bitdefender
Adware.Agent.OCK
1.0.20.1170

Clam AntiVirus
Win.Adware.Agent-6650
0.98/19299

Comodo Security
Application.Win32.Agent.OCK
19277

Dr.Web
Adware.Downware.2220
9.0.1.05190

Emsisoft Anti-Malware
Adware.Agent.OCK
8.14.08.22.11

ESET NOD32
Win32/DownloadAdmin.G potentially unwanted application
7.0.302.0

F-Secure
Adware.Agent.OCK
11.2014-22-08_6

G Data
Adware.Agent.OCK
14.8.24

Malwarebytes
PUP.Optional.FlashPro
v2014.08.22.11

MicroWorld eScan
Adware.Agent.OCK
15.0.0.702

NANO AntiVirus
Riskware.Win32.Downware.crgjbr
0.28.2.61721

nProtect
Adware.Agent.OCK
14.08.22.01

Reason Heuristics
PUP.Installer.Recode.U
14.8.21.22

Sophos
Download Admin
4.98

VIPRE Antivirus
Threat.4150696
32210

Zillya! Antivirus
Backdoor.PePatch.Win32.37877
2.0.0.1898

File size:
789.1 KB (808,064 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flashplayerpro-setup.exe

Digital Signature
Signed by:
Recode

Authority:
VeriSign, Inc.

Valid from:
2/12/2014 7:00:00 PM

Valid to:
2/12/2017 6:59:59 PM

Subject:
CN=Recode, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Recode, L=SAN FRANCISCO, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
7A8465407089FE62D3D2ABC37BC0C4B1

File PE Metadata
Compilation timestamp:
6/22/2012 2:07:51 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:2xpJ/xOJ5iQ/817fkZZ3Yzboo9RM6RS3r8Qksh0+vhd00hx+9BWEXS3BNmL:Cppxs5iQ/817L0o9q6RSg0d0YJEi3BNw

Entry address:
0x333B

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, B0, 73, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, C0, 70, 40, 00, 53, FF, 15, 88, 72, 40, 00, 6A, 08, A3, B8, 3C, 42, 00, E8, 2C, 25, 00, 00, 53, 68, 60, 01, 00, 00, A3, C0, 3B, 42, 00, 8D, 44, 24, 38, 50, 53, 68, 43, 74, 40, 00, FF, 15, 64, 71, 40, 00, 68, 38, 74, 40, 00, 68, C0, 33, 42, 00, E8, 1D, 24, 00, 00, FF, 15, BC, 70, 40, 00, 50, BF, 00, 90, 42, 00, 57, E8, 0B, 24, 00, 00...
 
[+]

Entropy:
7.4585

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file flashplayerpro-setup.exe has been seen being distributed by the following 2 URLs.

http://files4.mirror4.net/dl-esi-template?exe=122&site=1&sig=19&exehash=6tfmqr5gqgqxgadkr5tyfcblbe&filename=flashplayerpro-setup.exe&length=296&data=____MA0002NODEBY29tcGxldGUrdXJsOmh0dHA6Ly9zZXJ2aWNlLmRvd25sb2FkYWRtaW4uY29tL2luc3RhbGw_cz1DSFpQUCZ2YXJpYXRpb249c2VjdXJlJnNlY3VyZT10cnVlJmJyYW5kPXRyZWFzdXJlYWRzLmNvbSZwaWQ9dHJlYXN1cmVhZHMmYWlkPWNocm9tZSZiYz05ODc0NzEmY291bnRyeT1VUyZwX3RpZD0xYjM1MWZiNS0xYTc4LTQ5NzEtODcyOC0yN2NiNzI3ZWUwMjIm0272BIG-B

http://files5.mirror4.net/dl?bc=987471&a=&aid=chrome&source=CH-ZPP&p_tid=1b351fb5-1a78-4971-8728-27cb727ee022&variation=secure

Remove flashplayerpro-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.