home

flashplayerpro_setup.exe

INSTALL THIS

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application flashplayerpro_setup.exe, “Fusion Install ” by INSTALL THIS has been detected as adware by 38 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Fusion Install   (signed by INSTALL THIS)

Product:
Fusion Install

Description:
Fusion Install

Version:
2.4.8.1

MD5:
922cfc0197674d2584ffe25af7903f04

SHA-1:
cf4b125899dc20241bdac3c7e46cd638ba2e5253

SHA-256:
deeacc388944cc50ac25b2d0d7e698c17c6859894eaedba74b3c6cd8d9827537

Scanner detections:
38 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/15/2024 5:37:04 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.IBryte.U
919

Agnitum Outpost
PUA.iBryte
7.1.1

AhnLab V3 Security
PUP/Win32.OptimumInstaller
2014.06.24

Avira AntiVirus
Adware/iBryte.jgr.915
7.11.163.248

avast!
Win32:IBryte-DY [PUP]
2014.9-140730

AVG
Adware AdPlugin
2015.0.3397

Bitdefender
Adware.IBryte.U
1.0.20.1055

Bkav FE
W32.VikesluLTAH.Adware
1.3.0.4959

Clam AntiVirus
Win.Adware.Agent-7183
0.98/19265

Comodo Security
ApplicUnwnt
18969

Dr.Web
Adware.Downware.6099, Adware.iBryte.473
9.0.1.0211

Emsisoft Anti-Malware
Gen:Variant.Adware.iBryte
8.14.07.30.07

ESET NOD32
Win32/AdWare.iBryte.AP application
8.7.0.302.0

Fortinet FortiGate
W32/Zbot.AAN!tr
9/10/2014

F-Prot
W32/DomaIQ.G2.gen
v6.4.7.1.166

F-Secure
Adware.IBryte.U
11.2014-30-07_4

G Data
Adware.IBryte
14.7.24

herdProtect (fuzzy)
variant of setup.exe (Adware)
2014.9.10.11

IKARUS anti.virus
PUA.PremiumInstaller
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.181.12846

Kaspersky
not-a-virus:AdWare.Win32.iBryte
14.0.0.3273

Malwarebytes
PUP.Optional.Optimum
v2014.07.30.07

McAfee
Trojan.Artemis!D06D84983289
5600.7012

MicroWorld eScan
Adware.IBryte.U
15.0.0.633

NANO AntiVirus
Trojan.Win32.Buzus.cywlqp
0.28.0.60475

Norman
Downloader
11.20140910

nProtect
Adware.IBryte.U
14.07.03.01

Panda Antivirus
PUP/iBryte
14.07.30.07

Qihoo 360 Security
Malware.Radar03.Gen
1.0.0.1015

Quick Heal
Adware.iBryte.DK4
9.14.14.00

Reason Heuristics
PUP.Installer.INSTALLTHIS.U
14.7.30.18

Rising Antivirus
PE:Malware.iBryte!6.197B
23.00.65.14728

Sophos
Generic PUA KI
4.98

SUPERAntiSpyware
Adware.OptimumInstaller/Variant
10451

Trend Micro House Call
Suspicious_GEN.F47V0717
7.2.253

Vba32 AntiVirus
AdWare.iBryte
3.12.26.3

VIPRE Antivirus
Optimum Installer
31600

Zillya! Antivirus
Adware.iBryte.Win32.923
2.0.0.1835

File size:
315.3 KB (322,848 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) 2013 Fusion Install

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayerpro_setup.exe

Digital Signature
Signed by:
INSTALL THIS

Authority:
VeriSign, Inc.

Valid from:
10/3/2013 8:00:00 PM

Valid to:
9/20/2014 7:59:59 PM

Subject:
CN=INSTALL THIS, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=INSTALL THIS, L=Kansas City, S=Missouri, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
022C6886F5C72FEED25746F4AC3BA8CE

File PE Metadata
Compilation timestamp:
7/18/2014 5:28:32 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
6144:3riNkJdFZiYiBZNENLrgo2SLhp+bTVU4al63op90:3XL6NENLrtvh2gp90

Entry address:
0x181F5

Entry point:
E8, C2, 8D, 00, 00, E9, 78, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 24, D4, 43, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 84, D0, 43, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63...
 
[+]

Entropy:
6.3861

Code size:
238 KB (243,712 bytes)

The file flashplayerpro_setup.exe has been seen being distributed by the following 4 URLs.

https://install.fusioninstall.com/o/.../flashplayerpro_Setup.exe

http://yourinstaller.com/o/.../flashplayerpro_Setup.exe

http://downloadsinstant.com/.../flashplayerpro?source=marimedia_lightspark-us-ddl-cpa&creative_id=player &adprovider=marimedia&ce_cid=nym1CLKc7OWeoPXcNhACGLnYp6Sx8-2bTiINOTcuOTUuMTc4LjIzNSgBMNOur54F

https://secure-nym.adnxs.com/click?Qu_bT5jl1T-cxCCwcmjRP5zEILByaNE_MWJGSh933T-G-JweGojiPznsiRSbtzdOMg677AHVuTZT18tTAAAAAPUUKgChBgAAdgIAAAIAAAASUAEBBIUGAAAAAQBVU0QAVVNEACwB-gCjgwAAeqcAAgUAAQIAAJIAqCaswwAAAAA./cnd=!EwW6MAiKu5QCEJKghQgYhIoaIAA./referrer=http://www.brainfall.com//clickenc=http://downloadsinstant.com/.../flashplayerpro?source=marimedia_lightspark-us-ddl-cpa&creative_id=player &adprovider=marimedia&ce_cid=nym1CLKc7OWeoPXcNhACGLnYp6Sx8-2bTiINOTcuOTUuMTc4LjIzNSgBMNOur54F

Remove flashplayerpro_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.