home

flvplayer4free_setup.exe

Sakysoft s.r.l.

The application flvplayer4free_setup.exe by Sakysoft s.r.l has been detected as a potentially unwanted program by 8 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The setup routine uses the RevenYou.Com Pay Per Install platform (OutBrowse) which bundles additional software offers inclduing toolbars, extensions, PC utilities as well as other PUPs. The file has been seen being downloaded from download2.flvplayer4free.com and multiple other hosts.
Publisher:
Sakysoft s.r.l.  (signed and verified)

MD5:
4da5ca79ae6475dc8c863f98bbaad2c4

SHA-1:
c91528d68e10e2692660b30dd7e7433e63dc5749

SHA-256:
cd3a755a7407c8748ebf991e5f61ac5f487d9b51ac1b1ba5e3010532ac84af95

Scanner detections:
8 / 68

Status:
Potentially unwanted

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Analysis date:
4/19/2024 6:58:26 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.OutBrowse
7.1.1

AVG
Generic
2015.0.3379

Dr.Web
Trojan.Packed.28387
9.0.1.0230

ESET NOD32
Win32/OutBrowse.AD
8.10221

Fortinet FortiGate
Riskware/OutBrowse
8/18/2014

McAfee
Adware-OutBrowse
5600.7035

Reason Heuristics
PUP.Optional.Installer.U
14.8.18.6

VIPRE Antivirus
OutBrowse
32026

File size:
555.6 KB (568,888 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\flvplayer4free_setup.exe

Digital Signature
Signed by:
Sakysoft s.r.l.

Authority:
COMODO CA Limited

Valid from:
6/30/2014 5:30:00 AM

Valid to:
7/1/2015 5:29:59 AM

Subject:
CN=Sakysoft s.r.l., O=Sakysoft s.r.l., STREET=Via Gorghi 6, L=Udine, S=Udine, PostalCode=33100, C=IT

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AC0378721652B1C1535A0BF60A34B3EE

File PE Metadata
Compilation timestamp:
12/6/2009 4:20:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:F+kbncC+iOTMaebOn+OTunvo7nWRxypDimP8pu:F+kh+iOT9eb8XTWyB8Q

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9757

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file flvplayer4free_setup.exe has been seen being distributed by the following 2 URLs.

http://download2.flvplayer4free.com/flvplayer4free_setup.exe

http://r.flvplayer4free.com/flvplayer4free-download.php

Remove flvplayer4free_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.