home

flashplayersetup__6595_i519481793_il111.exe

The application flashplayersetup__6595_i519481793_il111.exe has been detected as a potentially unwanted program by 9 anti-malware scanners. The program is a setup application that uses the Amonetize Downloader installer, however the file is not signed with an authenticode signature from a trusted source. The setup program bundles adware offers using the Amonetize, a Pay-Per-Install (PPI) monetization and distribution download manager. The software offerings provided are based on the PC's geo-location at the time of install. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Version:
1.1.5.89

MD5:
d1a48593b02ef22f3632188fde10a0ca

SHA-1:
4dd1ef380b48d2a5a213c53a8211d59d45bebda0

SHA-256:
3f144cd33c0327d242413c4112b80abd7baae833fe5335887eedc40f5342b66f

Scanner detections:
9 / 68

Status:
Potentially unwanted

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 12:51:38 PM UTC  (today)

Scan engine
Detection
Engine version

AhnLab V3 Security
PUP/Win32.Amonetiz
14.04.03

Avira AntiVirus
ADWARE/Adware.Gen2
7.11.140.226

avast!
Win32:Amonetize-AM [PUP]
2014.9-140403

Baidu Antivirus
Adware.Win32.Amonetize
4.0.3.1443

ESET NOD32
Win32/Amonetize.AJ (variant)
8.9629

Kaspersky
not-a-virus:HEUR:AdWare.Win32.Amonetize
14.0.0.4073

Malwarebytes
PUP.Optional.Amonetize.A
v2014.04.03.10

Reason Heuristics
Threat.Win.Reputation.IMP
14.4.6.20

Sophos
Amonetize
4.98

File size:
344 KB (352,256 bytes)

Product version:
1.1.5.89

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Amonetize Downloader

Common path:
C:\users\{user}\appdata\local\temp\flashplayersetup__6595_i519481793_il111.exe

File PE Metadata
Compilation timestamp:
4/2/2014 4:36:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:w7fcIoTFmlLKwmaJDScSpWBkfYOqj2eVQCdMYdobmGymyvHXELXIBZL:w7fcIKF8LK0JDScSp2kf1pC5oSGymyJf

Entry address:
0x29E11

Entry point:
E8, C6, 97, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, CC, 53, 56, 8B, 44, 24, 18, 0B, C0, 75, 18, 8B, 4C, 24, 14, 8B, 44, 24, 10, 33, D2, F7, F1, 8B, D8, 8B, 44, 24, 0C, F7, F1, 8B, D3, EB, 41, 8B, C8, 8B, 5C, 24, 14, 8B, 54, 24, 10, 8B, 44, 24, 0C, D1, E9, D1, DB, D1, EA, D1, D8, 0B, C9, 75, F4, F7, F3, 8B, F0, F7, 64, 24, 18, 8B, C8, 8B, 44, 24, 14, F7, E6, 03, D1, 72, 0E, 3B, 54, 24, 10, 77, 08, 72, 07, 3B, 44, 24, 0C, 76, 01, 4E, 33, D2, 8B, C6, 5E, 5B, C2, 10, 00, 57, 8B, C6, 83, E0, 0F, 85, C0, 0F...
 
[+]

Entropy:
6.4359

Code size:
245.5 KB (251,392 bytes)

The file flashplayersetup__6595_i519481793_il111.exe has been seen being distributed by the following 21 URLs.

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=32010282711396485096

http://www.hdplugindownload.com/direct-download.html?version=1.1.5.89&iaff1=9982&ci=4651&capp=FlashPlayer&ti1=ZzdXVpZD1jY2Q3YTg5ZC0yNzZjLTRiNmItODgwOS1mNDM0ZDU5ZTgzNjg

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=31542828291396466489

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=866901631396471034

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=6946897131396453275

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=18685402661396464808

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=29891124381396476833

http://www.hdplugindownload.com/direct-download.html?version=1.1.5.89&iaff1=9982&ci=4651&capp=FlashPlayer&ti1=ZmdXVpZD05Y2NiZGMwYy1kNmY0LTQyMmQtODlmMy1jZTQ4MDk5ZjVmY2E

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=33213108541396456662

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=uc9dcf38652bdff7d9ffe52e39

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=17718413681396481097

https://secure-nym.adnxs.com/click?0dA_wcWKqj8Lk07J3vekP5HtfD81XvA_C5NOyd73pD_Q0D_BxYqqP5oh7dEuKpIELb0MOKzgvF2AqDxTAAAAAF5pGQDNBwAAdgIAAAIAAADDjssAMzQEAAAAAQBVU0QAVVNEACwB-gDmxAAA0rQAAQUCAQIAAIgA8Cpv6wAAAAA./cnd=!egYGPgj6oc0BEMOdrgYYs-gQIAE./referrer=apps.facebook.com/clickenc=http://.../direct-download.html?version=1.1.5.89&ci=7343&capp=FlashPlayer&ti1=nym1CK36ssDDlbjeXRACGJrDtI_txYrJBCINMTkxLjE3Ni42My4zNCgBMIDR8pkF&ti2=PMZ&ti3=1665374

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=u29e1309a507b2e638869b42d08

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=31308165461396453088

http://clkmon.com/.../sa?cid=CRSRDR-200069123000000000&q=printer; embedded web server; internet services;

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=14979548481396458166

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=19451872661396459532

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=20577963141396497125

http://www.gofordownload.com/download.php?myref=www.newhdplugin.net&version=1.1.5.89&prefix=FlashPlayerSetup&campid=6741&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=13832461851396470487&capp=FlashPlayer&AMt=1396468580949&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.gofordownload.com/download.php?myref=www.newhdplugin.net&version=1.1.5.89&prefix=FlashPlayerSetup&campid=6930&instid[appname]=FlashPlayer&instid[appsetupurl]=https://launchpad.net/lightspark/trunk/lightspark-0.5.3/ download/Lightspark-0.5.3-win32.exe&instid[appimageurl]=http://www.tsxnrey.com/i/White Smoke Inc/.../150x150_v1Logo.jpg&prefix=FlashPlayer&ti1=lax1COT4rbLHmYe4NhACGNeG2caaqJjTTiIPMTYyLjIwMy4xNjQuMTg0KAEw8suzmQU.&capp=FlashPlayer&AMt=1395451448237&AMh=7fn2b4gxIWmb09igS84d2Ie2zMXUjQgM3KAUfCzDKPbVydo5QZMSwcespsmVBC1AtdCH3iBb48loOaw3

http://www.gofordownload.com/download.php?version=1.1.5.89&prefix=FlashPlayerSetup&campid=6595&capp=FlashPlayer&ti1=7042472661396470312

Remove flashplayersetup__6595_i519481793_il111.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.