home

flashplayersetup__6145_i688494405_il126.exe

The application flashplayersetup__6145_i688494405_il126.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. The file has been seen being downloaded from fra1.ib.adnxs.com.
Version:
1.1.7.40

MD5:
03884f4f0b8da5c0b6280031bf8e9aed

SHA-1:
aab8eb46f750ad275e999a7da2fd76a7926bb242

SHA-256:
2969947a62da003f9e2642ff0ab998626bdfb89aefc615374bf912c94db38e7d

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
4/24/2024 11:33:31 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Amonetize.Installer.Installer.Meta (M)
16.5.29.11

File size:
483.3 KB (494,943 bytes)

Product version:
1.1.7.40

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\flashplayersetup__6145_i688494405_il126.exe

File PE Metadata
Compilation timestamp:
5/17/2014 8:00:45 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:kO9zxfJjLRxnvNTC9w/n2wzgMClJluDQqhI3fK9v8w1b6XDW:RJjLRxRzgnluaKR1qa

Entry address:
0x58000

Entry point:
60, E8, 00, 00, 00, 00, 5D, 8B, C5, 81, ED, CE, B2, 01, 20, 2B, 85, 35, BA, 01, 20, 89, 85, 31, BA, 01, 20, B0, 00, 86, 85, 66, BC, 01, 20, 3C, 01, 0F, 85, BC, 01, 00, 00, 83, BD, 61, BB, 01, 20, 00, 74, 33, 83, BD, 65, BB, 01, 20, 00, 74, 2A, 8B, 85, 31, BA, 01, 20, 2B, 85, 61, BB, 01, 20, 8B, 00, 89, 85, 9E, BB, 01, 20, 8B, 85, 31, BA, 01, 20, 2B, 85, 65, BB, 01, 20, 8B, 00, 89, 85, A2, BB, 01, 20, EB, 61, 83, BD, 69, BB, 01, 20, 00, 74, 58, 8B, 85, 31, BA, 01, 20, 2B, 85, 69, BB, 01, 20, FF, 30, 8D, 85...
 
[+]

Packer / compiler:
ASPack v1.08.04

Code size:
236.5 KB (242,176 bytes)

The file flashplayersetup__6145_i688494405_il126.exe has been seen being distributed by the following URL.

http://fra1.ib.adnxs.com/click?OOS0J2uBlj-VGf83-q2SP6jGSzeJQeQ_lRn_N_qtkj845LQna4GWP4Dku0_3BYJa8zGUu1m2HmAZwXdTAAAAAMvYKACTBwAAdgIAAAIAAAC-DcYAa1cGAAAAAQBVU0QAVVNEACwB-gDSDAAAMMsAAgUAAQIAAJAAmyhhOAAAAAA./cnd=!9QXuNgickcwBEL6bmAYY664ZIAE./referrer=http://www.e-bebek.com/firsat-bu-firsat?instock=1/clickenc=http://.../direct-download.html?version=1.1.7.40&epu=no&ci=6145&capp=FlashPlayer&ti1=fra1CPPj0Nyby62PYBACGIDJ7_30voHBWiINODguMjMxLjkxLjE4MCgBMJmC35sF&ti2=PMZ&ti3=2676939

Remove flashplayersetup__6145_i688494405_il126.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.