home

install_flashplayer11x64_mssd_aih_installer.exe

install_flashplayer11x64_mssd_aih_installer

WebSys, s.r.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application install_flashplayer11x64_mssd_aih_installer.exe, “install_flashplayer11x64_mssd_aih_installer Setup” by WebSys, s.r.o has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Adobe Flash Player but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
windows7download.com  (signed by WebSys, s.r.o.)

Product:
install_flashplayer11x64_mssd_aih_installer

Description:
install_flashplayer11x64_mssd_aih_installer Setup

Version:
1,18,0,2810

MD5:
673c2fd2942366a4e48b618f312b975a

SHA-1:
467b1e1bc505222647a51c36d633359b99f51352

SHA-256:
7de4c7119dfcfdd789b512ee215d2f757fd2ef3b3877f1c953e14bb935cacf16

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore monetization platform to install additional offers that might include adware.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 9:45:52 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.WebSyssro.Installer (M)
15.12.20.7

File size:
361.6 KB (370,328 bytes)

Product version:
1,18,0,2810

Copyright:
Copyright © 2012

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\install_flashplayer11x64_mssd_aih_installer.exe

Digital Signature
Signed by:
WebSys, s.r.o.

Authority:
COMODO CA Limited

Valid from:
3/20/2013 8:00:00 PM

Valid to:
3/21/2015 7:59:59 PM

Subject:
CN="WebSys, s.r.o.", O="WebSys, s.r.o.", STREET=Namestie sv. Martina 9, L=Holíč, S=SK, PostalCode=908 51, C=SK

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00DD73B25D7DEDED24BD3E70AEEA691C96

File PE Metadata
Compilation timestamp:
8/14/2012 9:05:18 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
7.10

CTPH (ssdeep):
6144:gsl12U1csNzbGkVQoM4cMQwzwvKHHNcvhpFA6HNKMPpQpvGImbvrWO:gsl12U1hPq2AwzwyHHWv3FA6HN7PcO1x

Entry address:
0x1000

Entry point:
55, 8B, EC, 81, EC, 18, 04, 00, 00, 53, 56, 57, BE, A4, 30, 40, 00, 8D, BD, E8, FB, FF, FF, A5, A5, A5, 6A, 7E, 66, A5, 59, 33, C0, 8D, BD, F6, FB, FF, FF, F3, AB, 66, AB, BB, 04, 01, 00, 00, 53, 8D, 85, E8, FB, FF, FF, 50, FF, 15, 5C, 30, 40, 00, 66, 83, A5, F0, FD, FF, FF, 00, 33, C0, B9, 81, 00, 00, 00, 8D, BD, F2, FD, FF, FF, F3, AB, 66, AB, 8D, 85, F0, FD, FF, FF, 50, 8D, 85, E8, FB, FF, FF, 50, C7, 45, F8, FD, FF, FF, FF, E8, 0F, 01, 00, 00, 84, C0, 59, 59, 74, 15, 8D, 75, F8, 8D, BD, F0, FD, FF, FF...
 
[+]

Entropy:
7.9175

Developed / compiled with:
Microsoft Visual C++

Code size:
7.5 KB (7,680 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.