» install_flashplayer.exe
Overview
Analysis
File Details
Downloads (1)

install_flashplayer.exe

Information Technology Systems doo

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install_flashplayer.exe by Information Technology Systems doo has been detected as adware by 13 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore monetization download manager to download additional third party applications that may be unwanted by the user. The installer is marketed through download protals and search ads as the free Adobe Flash Player but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

Information Technology Systems doo (signed and verified)

MD5:

b6d3624e539deed16d86642896724092

SHA-1:

048adde06626a68e32ab9b6bb73e48a7ece2b37e

SHA-256:

525babc5362ed6b1a413a59d052cfe8c92098a840bf727772fa06870569f9c75

Scanner detections:

13 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

4/27/2024 12:45:07 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

Trojan.Injected

7.1.1

Avira AntiVirus

TR/Injector.738840

7.11.175.224

AVG

Generic

2015.0.3335

Dr.Web

Trojan.Packed.28587

9.0.1.05190

ESET NOD32

Win32/Injected.F trojan

7.0.302.0

IKARUS anti.virus

Trojan.Injector

t3scan.1.7.8.0

K7 AntiVirus

Unwanted-Program

13.183.13535

Malwarebytes

PUP.Optional.Installcore

v2014.10.01.07

McAfee

CryptInno

5600.6991

Qihoo 360 Security

Malware.QVM06.Gen

1.0.0.1015

Reason Heuristics

PUP.InformationTechnologySystemsdoo.T

14.10.1.7

Sophos

Install Core Click run software

4.98

VIPRE Antivirus

Threat.4786018

33120

File size:

721.5 KB (738,840 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\install_flashplayer.exe

Digital Signature

Signed by:

Information Technology Systems doo

Authority:

COMODO CA Limited

Valid from:

2/18/2014 12:00:00 AM

Valid to:

2/18/2016 11:59:59 PM

Subject:

CN=Information Technology Systems doo, O=Information Technology Systems doo, STREET=Bulevar Dzordza Vasingtona 60, L=Podgorica, S=Montenegro, PostalCode=81000, C=ME

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00C5C6AC5F85C769596A73A863C86D258C

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:Chvp9BRpy4OIfZzwP8AKmi3YjDkvvKOfm5x5CMG40ahNQcd1QLTz+:ChvrVy4OIxzxLoEvCOfmpU4T1k

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8695

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file install_flashplayer.exe has been seen being distributed by the following URL.

http://debsoft.com/.../getfile.php?id=192163&lp_id=161&dist_id=377&channel=acpopf100&src=ac&cid=15590807391403374097

Remove install_flashplayer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.