home

flashplayersetup__2583_i952173949_il1.exe

The application flashplayersetup__2583_i952173949_il1.exe has been detected as a potentially unwanted program by 14 anti-malware scanners. It bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from www.more-files.com and multiple other hosts.
Version:
1.1.5.89

MD5:
854285b87cc14e6c9e1640442992a6f2

SHA-1:
3b7a824318aa189054154d47aa1d05ba8387e985

SHA-256:
68a82bd5f4e0c3dd9aa3d6c76c257eda4b7c475d2581189084fca152b22d67e6

Scanner detections:
14 / 68

Status:
Potentially unwanted

Analysis date:
4/19/2024 11:09:52 AM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
2014.06.28

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.157.114

avast!
Win32:Amonetize-CF [PUP]
2014.9-140707

AVG
BundleApp_r.R
2015.0.3421

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.1477

ESET NOD32
Win32/Amonetize.AW (variant)
8.10011

Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize
14.0.0.3600

Malwarebytes
PUP.Optional.Amonetize
v2014.07.07.01

McAfee
PUP-FBM
5600.7077

Qihoo 360 Security
Win32/Virus.Adware.932
1.0.0.1015

Rising Antivirus
PE:Malware.Adware!6.1890
23.00.65.14705

Sophos
Amonetize
4.98

Trend Micro House Call
TROJ_GEN.R08NH06FQ14
7.2.188

VIPRE Antivirus
Amonetize
30716

File size:
332 KB (339,968 bytes)

Product version:
1.1.5.89

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayersetup__2583_i952173949_il1.exe

File PE Metadata
Compilation timestamp:
6/26/2014 10:33:51 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:6wfgbrnfjZdZdr9FNch6drRBU1Ny1VeHrkFwRun7pjV4AzBKAtCd0W:6wfgv7ZdZV9FNu617U1cNRntjV/Zg/

Entry address:
0x28264

Entry point:
E8, 35, A0, 00, 00, E9, 89, FE, FF, FF, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F, 85, C1, 00...
 
[+]

Entropy:
6.4550

Code size:
237 KB (242,688 bytes)

The file flashplayersetup__2583_i952173949_il1.exe has been seen being distributed by the following 11 URLs.

http://www.more-files.com/allddT.html?myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8812&capp=TvAppMondial&ti1=20yv3X4eLHUKAfFd1BgsOa1x.5oo000.&AMt=1403772681217&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.new-hdplugin.com/direct-download.html?version=1.1.5.89&ci=2583&capp=FlashPlayer&ti1=0081469256108390915

http://www.more-files.com/allddT.html?myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=33185995271403771105&AMt=1403771112179&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.spectrumdownload.com/tdownload.php?s1=b240183823f7c523cb03a9876940df6cc481c12f&t1=1403773148&myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=15500487191403772959&AMt=1403772970051&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.more-files.com/allddT.html?myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=15500487191403772959&AMt=1403772970051&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.spectrumdownload.com/tdownload.php?s1=d2b24125fd0e5af8d6b3763ca6fb1c65f793b60b&t1=1403767737&ref=www.winflashplayer.com&version=1.1.5.89&direct=1&prefix=FlashPlayersetup&campid=4651&ti1=ZmdXVpZD1mMzdjMTIwNS0xNjUwLTRkYWQtYTcyNi1kOGZkM2FlYzNmMmI&iaff1=9982&capp=FlashPlayer

http://www.more-files.com/allddT.html?ref=www.winflashplayer.com&version=1.1.5.89&direct=1&prefix=FlashPlayersetup&campid=4651&ti1=ZmdXVpZD1mMzdjMTIwNS0xNjUwLTRkYWQtYTcyNi1kOGZkM2FlYzNmMmI&iaff1=9982&capp=FlashPlayer

http://www.dd-files.com/get.html?ref=www.winflashplayer.com&version=1.1.5.89&direct=1&prefix=FlashPlayersetup&campid=4651&ti1=ZmdXVpZD1mMzdjMTIwNS0xNjUwLTRkYWQtYTcyNi1kOGZkM2FlYzNmMmI&iaff1=9982&capp=FlashPlayer

http://www.new-hdplugin.com/direct-download.html?version=1.1.5.89&iaff1=9982&ci=4651&capp=FlashPlayer&ti1=ZmdXVpZD1mMzdjMTIwNS0xNjUwLTRkYWQtYTcyNi1kOGZkM2FlYzNmMmI

http://www.spectrumdownload.com/tdownload.php?s1=303296e959724bc8df5dc99abd5a0af6e3ff1d42&t1=1403760787&myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=33989813581403760595&AMt=1403760606950&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.more-files.com/allddT.html?myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=33989813581403760595&AMt=1403760606950&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

Remove flashplayersetup__2583_i952173949_il1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.