home

flashplayersetup__2583_i907248079_il1.exe

Amonetize ltd.

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application flashplayersetup__2583_i907248079_il1.exe by Amonetize ltd has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Amonetize ltd.  (signed and verified)

Version:
1.1.5.89

MD5:
6e13a68ad3ccfa97ce2f173a6d15c349

SHA-1:
9b9ad9975ed54d50d3aefdb86732794d737d3831

SHA-256:
928738fc2a1be45b666b289e10bbb68c3c98b0058a6c6f578faaa039606e6fb0

Scanner detections:
26 / 68

Status:
Adware

Explanation:
This setup file is a re-distribution of the original program that bundles various adware offers during installation including toolbars and browser search extensions.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/26/2024 6:20:33 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.Amonetize.L
779

Agnitum Outpost
PUA.Amonetize
7.1.1

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.07.09

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.159.108

avast!
Win32:Amonetize-BX [PUP]
2014.9-141218

AVG
BundleApp_r.R
2015.0.3257

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.141218

Bitdefender
Application.Bundler.Amonetize.L
1.0.20.1760

Bkav FE
W32.NovakoP.Trojan
1.3.0.4959

Comodo Security
ApplicUnwnt
18811

Dr.Web
Adware.Downware.4919
9.0.1.0352

Fortinet FortiGate
Riskware/Amonetize
12/18/2014

F-Secure
Application.Bundler.Amonetize
11.2014-18-12_5

IKARUS anti.virus
PUA.Amonetize.BD
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.180.12657

Malwarebytes
PUP.Optional.Amonetize
v2014.12.18.07

McAfee
PUP-FBM
5600.6913

MicroWorld eScan
Application.Bundler.Amonetize.L
15.0.0.1056

NANO AntiVirus
Riskware.Win32.Amonetize.dbnvwp
0.28.0.60698

Panda Antivirus
Trj/CI.A
14.12.18.07

Qihoo 360 Security
Win32/Trojan.Adware.37e
1.0.0.1015

Reason Heuristics
PUP.Installer.Amonetizeltd.f
14.12.18.7

Sophos
Amonetize
4.98

Trend Micro House Call
TROJ_GEN.R0CBC0EFT14
7.2.352

Trend Micro
TROJ_GEN.R0CBC0EFT14
10.465.18

VIPRE Antivirus
Amonetize
31100

File size:
336.5 KB (344,608 bytes)

Product version:
1.1.5.89

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayersetup__2583_i907248079_il1.exe

Digital Signature
Signed by:
Amonetize ltd.

Authority:
Thawte, Inc.

Valid from:
3/19/2013 5:30:00 AM

Valid to:
6/19/2015 5:29:59 AM

Subject:
CN=Amonetize ltd., O=Amonetize ltd., L=Raanana, S=Alberta, C=IL

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
235E7B2F1D4E0152189F6381E2BA8C97

File PE Metadata
Compilation timestamp:
6/19/2014 10:33:22 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:7bO2nhdysW3/nExG47VZUB4hjKMSNed8ZXRlf5zxYHHxyqOzlK0yCpHu8Z0wL:7bO2hMsW3vEY47Vy4hji/fJxYHcqbUTV

Entry address:
0x27ED4

Entry point:
E8, 34, A0, 00, 00, E9, 89, FE, FF, FF, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00...
 
[+]

Entropy:
6.4866

Code size:
236 KB (241,664 bytes)

The file flashplayersetup__2583_i907248079_il1.exe has been seen being distributed by the following URL.

http://www.spectrumdownload.com/tdownload.php?s1=dd8a6adc63a14cb5969bf9026510d949cffc6b9a&t1=1403162440&myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=6088602491403162227&AMt=1403162243462&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

Remove flashplayersetup__2583_i907248079_il1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.