flvplayersetup-5r22jk7.exe

Somoto Ltd.

Somoto uses a monetization platform known as the 'Better Installer' to provide the ability of 3rd party developers to bundle various adware packages through an affiliate pay-per-install program. The application flvplayersetup-5r22jk7.exe, “Powered by BetterInstaller” by Somoto has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the Somoto BetterInstaller installer. Includes the Somoto BetterInstaller, an adware installer that will bundle offers for additional third party applications, mostly adware toolbars, with legitimate softare and may be installed without adequate user consent.
Publisher:
Somoto Ltd.  (signed and verified)

Description:
Powered by BetterInstaller

Version:
2.1.0.0

MD5:
986082830caefdec2ad8a9935e3aea06

SHA-1:
69ea95a7b15337ef72e63ca8725dd88608016536

SHA-256:
e3abf2bb7958ea752b081c44d42bed7bfd196cc14a0eefddcb74f002d1be7158

Scanner detections:
26 / 68

Status:
Adware

Explanation:
Uses the Somoto 'BetterInstaller' to bundle additional (unwanted) software during install without adequate consent.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/24/2024 4:24:25 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.SomotoBetter.A
1115

Avira AntiVirus
APPL/Somoto.Gen2
7.11.125.70

avast!
Win32:Somoto-F [PUP]
2014.9-140116

AVG
AdInstaller.Somoto
2015.0.3593

Bitdefender
Adware.SomotoBetter.A
1.0.20.80

Bkav FE
W32.Clodb34.Trojan
1.3.0.4613

Clam AntiVirus
Adware.Somoto-1
0.98/18155

Comodo Security
Application.Win32.Somoto.A
17612

Dr.Web
Adware.Downware.1184
9.0.1.016

Emsisoft Anti-Malware
Backdoor.Win32.Agent
8.14.01.16.03

ESET NOD32
Win32/Somoto
8.9291

Fortinet FortiGate
Adware/Fam.NB
1/16/2014

F-Prot
W32/SomotoBetterInstaller.A
v6.4.7.1.166

F-Secure
Adware.SomotoBetter.A
11.2014-16-01_5

G Data
Adware.SomotoBetter
14.1.24

K7 AntiVirus
Unwanted-Program
13.175.10837

Kaspersky
not-a-virus:Downloader.NSIS.Agent
14.0.0.4459

Malwarebytes
PUP.Optional.Somoto
v2014.01.16.03

MicroWorld eScan
Adware.SomotoBetter.A
15.0.0.48

NANO AntiVirus
Trojan.Win32.Agent.cruvhh
0.28.0.57029

nProtect
Adware/W32.Agent.167448
14.01.14.02

Reason Heuristics
PUP.BetterInstaller.Somoto.W
14.8.7.17

Sophos
Somoto BetterInstaller
4.96

SUPERAntiSpyware
Adware.Somoto/Variant
10843

Vba32 AntiVirus
Downloader.Agent
3.12.24.3

VIPRE Antivirus
BetterInstaller
25448

File size:
163.5 KB (167,448 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Somoto BetterInstaller

Common path:
C:\users\{user}\downloads\flvplayersetup-5r22jk7.exe

Digital Signature
Signed by:

Authority:
COMODO CA Limited

Valid from:
9/20/2011 3:00:00 AM

Valid to:
9/20/2014 2:59:59 AM

Subject:
CN=Somoto Ltd., O=Somoto Ltd., STREET=PO Box 58096, L=Tel Aviv, S=--, PostalCode=61580, C=IL

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00841D099D16B738F34172FEEFE1D2574F

File PE Metadata
Compilation timestamp:
12/17/2010 12:14:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.56

CTPH (ssdeep):
3072:G22ihA0m3BJf0A3XsYUQtGwcKsK89uy3hXx1ICWLS5JDG4qeb71aqrm:5A0m3T0A3XTaXd9rpmMGm7QL

Entry address:
0x39AC

Entry point:
55, 89, E5, 57, 56, 53, 81, EC, 7C, 01, 00, 00, E8, 97, 46, 00, 00, 83, EC, 0C, 68, 01, 80, 00, 00, E8, 42, 43, 00, 00, 6A, 00, E8, AB, 46, 00, 00, 6A, 08, A3, 88, 4C, 42, 00, E8, B1, 28, 00, 00, 6A, 00, 68, 60, 01, 00, 00, A3, 38, 4D, 42, 00, 8D, 85, 90, FE, FF, FF, 50, 6A, 00, 68, A4, A2, 40, 00, E8, F0, 45, 00, 00, 83, EC, 0C, 68, A5, A2, 40, 00, 68, 68, 4D, 42, 00, E8, EF, 2A, 00, 00, 83, C4, 18, E8, FE, 42, 00, 00, 52, 52, 50, 68, 00, D0, 42, 00, E8, DA, 2A, 00, 00, 57, 6A, 00, E8, 39, 42, 00, 00, 83...
 
[+]

Entropy:
7.6024

Code size:
28.5 KB (29,184 bytes)

The file flvplayersetup-5r22jk7.exe has been seen being distributed by the following 46 URLs.

http://www.down1oads.com/.../FLVPlayerSetup-dFAxCXJ.exe

http://www.down1oads.com/.../VideoPlayer-cpDT7PL.exe

http://www.down1oads.com/.../FLVPlayerSetup-72fXsvK.exe

http://www.down1oads.com/.../VideoPlayer-fTOxAha.exe

http://www.down1oads.com/.../FLVPlayerSetup-92oNBzK.exe

http://download.softiglu.com/nlp/j/smb/.../dl?p1=downloadlink&p3=1&datetime=20130907_1559&utm_source=smb&utm_medium=affiliate&utm_campaign=downloadlink&translate=en&tracking_percent=100&timestamp=1378569580&__cookie=__utma=1.1617867638.1378569581.1378569581.1378569581.1; __utmb=1.2.10.1378569581; __utmc=1; __utmz=1.1378569581.1.1.utmcsr=smb|utmccn=downloadlink|utmcmd=affiliate|utmcct=vlc

http://download.softiglu.com/nlp/j/smb/.../dl?p1=downloadlink&p3=1&datetime=20130922_1354&utm_source=smb&utm_medium=affiliate&utm_campaign=downloadlink&translate=en&tracking_percent=100&timestamp=1379858048&__cookie=__utma=25677224.1634330226.1379858052.1379858052.1379858052.1; __utmb=25677224.0.10.1379858052; __utmc=25677224; __utmz=25677224.1379858052.1.1.utmcsr=smb|utmccn=downloadlink|utmcmd=affiliate|utmcct=vlc; __utma=25677224.1634330226.1379858052.1379858052.1379858052.1; __utmb=25677224.1.10.1379858052; __utmc=25677224; __utmz=25677224.1379858052.1.1.utmcsr=smb|utmccn=downloadlink|utmcmd=affiliate|utmcct=vlc&__cookie=__utma=25677224.1634330226.1379858052.1379858052.1379858052.1; __utmb=25677224.0.10.1379858052; __utmc=25677224; __utmz=25677224.1379858052.1.1.utmcsr=smb|utmccn=downloadlink|utmcmd=affiliate|utmcct=vlc; __utma=25677224.1634330226.1379858052.1379858052.1379858052.1; __utmb=25677224.1.10.1379858052; __utmc=25677224; __utmz=25677224.1379858052.1.1.utmcsr=smb|utm

http://download.softiglu.com/nlp/g/smb/.../dl?p1=downloadlink&p3=1&datetime=20130903_1750&utm_source=smb&utm_medium=affiliate&utm_campaign=downloadlink&translate=en&tracking_percent=100&timestamp=1378230640&__cookie=__utma=1.1409195699.1378230555.1378230555.1378230555.1; __utmb=1.4.10.1378230555; __utmc=1; __utmz=1.1378230555.1.1.utmcsr=smb|utmccn=downloadlink|utmcmd=affiliate|utmcct=vlc

http://download.softiglu.com/nlp/g/smb/.../dl?p1=downloadlink&p3=1&datetime=20130811_1243&utm_source=smb&utm_medium=affiliate&utm_campaign=downloadlink&translate=en&tracking_percent=100&timestamp=1376225006

http://download.softiglu.com/nlp/j/smb/.../dl?p1=downloadlink&p3=1&datetime=20130916_2019&utm_source=smb&utm_medium=affiliate&utm_campaign=downloadlink&translate=en&tracking_percent=100&timestamp=1379362752&__cookie=__utma=1.1757771418.1379366328.1379366328.1379366328.1; __utmb=1.2.10.1379366328; __utmc=1; __utmz=1.1379366328.1.1.utmcsr=smb|utmccn=downloadlink|utmcmd=affiliate|utmcct=vlc

Latest 30 of 46 download URLs

Remove flvplayersetup-5r22jk7.exe - Powered by Reason Core Security