» flashplayersetup__2583_i981470230_il6.exe
Overview
Analysis
File Details
Downloads (7)

flashplayersetup__2583_i981470230_il6.exe

Install Path Ltd

This is the Amonetize download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application flashplayersetup__2583_i981470230_il6.exe by Install Path has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.

File name:

Publisher:

Install Path Ltd (signed and verified)

Version:

1.1.5.89

MD5:

fbf9b7b73ee94786e80f4a1bf4ef4dd1

SHA-1:

fdbdfe085f2c3fd2cf3dff193659e5e2b0e2ddb8

SHA-256:

9ca057aaae9d3d4c2ed30bafe0505414ee4223e6b6c661c6db6004b4c15c0e58

Scanner detections:

26 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/26/2024 9:52:21 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Generic.687571

827

Agnitum Outpost

PUA.Amonetize

7.1.1

AhnLab V3 Security

PUP/Win32.Amonetiz

2014.10.18

Avira AntiVirus

ADWARE/Adware.Gen

7.11.179.100

avast!

Win32:Amonetize-ES [PUP]

2014.9-141031

AVG

Generic

2015.0.3305

Baidu Antivirus

Adware.Win32.Amonetize

4.0.3.141031

Bitdefender

Application.Generic.687571

1.0.20.1520

Comodo Security

ApplicUnwnt

19827

Dr.Web

Adware.Downware.5488

9.0.1.0304

ESET NOD32

Win32/Amonetize.BF.gen (variant)

8.10580

Fortinet FortiGate

Adware/Amonetize

10/31/2014

F-Secure

Application.Generic.687571

11.2014-31-10_6

G Data

Application.Generic.687571

14.10.24

K7 AntiVirus

Trojan

13.184.13718

Kaspersky

not-a-virus:AdWare.Win32.Amonetize

14.0.0.3019

McAfee

RDN/Generic PUP.x!cmj

5600.6961

MicroWorld eScan

Application.Generic.687571

15.0.0.912

NANO AntiVirus

Riskware.Win32.Amonetize.dcblyg

0.28.2.62671

Quick Heal

AdWare.Amonetize.r5 (Not a Virus)

10.14.14.00

Reason Heuristics

PUP.Installer.InstallPath.f

14.10.31.5

Sophos

Generic PUA PN

4.98

Trend Micro House Call

Suspicious_GEN.F47V0708

7.2.304

Vba32 AntiVirus

AdWare.Amonetize

3.12.26.3

VIPRE Antivirus

Trojan.Win32.Generic

34010

Zillya! Antivirus

Adware.Amonetize.Win32.68

2.0.0.1958

File size:

325.4 KB (333,240 bytes)

Product version:

1.1.5.89

Original file name:

setup.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Amonetize Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\programs\flashplayersetup__2583_i981470230_il6.exe

Digital Signature

Signed by:

Install Path Ltd

Authority:

COMODO CA Limited

Valid from:

4/30/2014 1:00:00 AM

Valid to:

4/30/2016 12:59:59 AM

Subject:

CN=Install Path Ltd, OU=Install Path Ltd, O=Install Path Ltd, STREET=5 Jabotinsky, L=Ramat Gan, S=(select one), PostalCode=5252006, C=IL

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

11218EE2EBDA2A9FF91D21033208850D

File PE Metadata

Compilation timestamp:

6/24/2014 8:20:57 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

6144:eLaHr6lGYxpTBLrMmmoMhCcsomwi7W523BqCozqYKURA:AamsYxpTe5lfTmwi7z3BqCHYKURA

Entry address:

0xE2F7

Entry point:

E8, BA, 46, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 8B, FF, 55, 8B, EC, 53, 8B, 5D, 08, 83, FB, E0, 77, 6F, 56, 57, 83, 3D, 14, FD, 41, 00, 00, 75, 18, E8, B4, 3D, 00, 00, 6A, 1E, E8, FE, 3B, 00, 00, 68, FF, 00, 00, 00, E8, 97, F6, FF, FF, 59, 59, 85, DB, 74, 04, 8B, C3, EB, 03, 33, C0, 40... 
[+]

Code size:

82 KB (83,968 bytes)

The file flashplayersetup__2583_i981470230_il6.exe has been seen being distributed by the following 7 URLs.

http://www.new-hdplugin.com/direct-download.html?version=1.1.5.89&ci=2583&capp=FlashPlayer&ti1=0081577176541182151

http://www.new-hdplugin.com/direct-download.html?version=1.1.5.89&iaff1=9982&ci=4651&capp=FlashPlayer&ti1=ZjdXVpZD0wZGI5ZDZlZS0wNzEyLTRjMjctODM4NC05MjAyZWMzYzRjYWE

http://www.new-hdplugin.com/direct-download.html?version=1.1.5.89&ci=2583&capp=FlashPlayer&ti1=0081057106539595857

http://www.spectrumdownload.com/tdownload.php?s1=05cb56374d958b7656ae001671e56b6bc512fb84&t1=1404236627&myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=17719304791404236404&AMt=1404236449091&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.more-files.com/allddT.html?myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=17719304791404236404&AMt=1404236449091&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.spectrumdownload.com/tdownload.php?s1=5c14636d85d3fd2bde2873f2c07d856a673f9ace&t1=1404236610&myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=17719304791404236404&AMt=1404236431058&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.more-files.com/allddT.html?myref=www.livesoccer2014.com&version=1.1.5.89&prefix=TVapp&campid=8821&capp=TvAppMondial&ti1=17719304791404236404&AMt=1404236431058&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

Remove flashplayersetup__2583_i981470230_il6.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.