home

installer_adobe_flash_player_english.exe

The application installer_adobe_flash_player_english.exe has been detected as a potentially unwanted program by 6 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer, however the file is not signed with an authenticode signature from a trusted source. The file has been seen being downloaded from dk.fileprogdwn.com and multiple other hosts.
MD5:
80f5e874d9fee7d36564a8f29cba8028

SHA-1:
65cb8d492240cadfb17d278d4b733f5500460b69

SHA-256:
dc628fe7f944284f2a510183e0ac8308af5c20a9345d291a893d48805f966806

Scanner detections:
6 / 68

Status:
Potentially unwanted

Analysis date:
5/8/2024 2:18:49 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Trojan.Win32.Addrop
4.0.3.16129

Clam AntiVirus
Win.Adware.Outbrowse-1128
0.98/21511

ESET NOD32
Win32/TrojanDropper.Addrop
10.12463

G Data
NSIS.Adware.Adload
16.1.25

NANO AntiVirus
Trojan.Nsis.Downloader.dqlxfr
0.30.26.3947

VIPRE Antivirus
Trojan.Win32.Generic
44820

File size:
798.3 KB (817,492 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

File PE Metadata
Compilation timestamp:
12/5/2009 10:52:12 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:JQ5oX3Q3OqsRZDdA77xMdUTy3DANCOF8IgIOc/sfenT7i11QGb5SAwSszb+N8:JQ5oe9QZDd2xKYKD3w8I+cp/21/lSAq

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, 1C, 45, 00, E8, F1, 2B, 00, 00, A3, 64, 1B, 45, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 37, 43, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, DB, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, A0, 47, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 2 URLs.

http://dk.fileprogdwn.com/installers/axtan_installers/get.php?ik=tig&ua=chrome&ut=f134532385e10646fdff34fdfd3bc47f&r=3804400&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9vbi8xL2ZyZWVzb2Z0c3RvcmVjb20vZW5nbGlzaC9yZXZlbnVlL2Nocm9tZS9hZG9iZV9mbGFzaF9wbGF5ZXIvZC8yNzU4NzZlMzRjZjYwOWRiMTE4ZjNkODRiNzk5YTc5MC90aWcvbmEvbmEvaW5zdGFsbGVyX2Fkb2JlX2ZsYXNoX3BsYXllcl9FbmdsaXNoLmV4ZQ==&p=RlJFRVNPRlRTVE9SRUNPTQ==&u=L2Rvd25sb2FkLmZyZWVzb2Z0c3RvcmUyLmNvbS9pbnN0YWxsZXJzL291dC8wMDIxMDAwMjExMDAyMTIvcGlpZC01NGRiYTc4MTBlZDQ3Mi4zMjgzOTU5OS9vbi8xL2ZyZWVzb2Z0c3RvcmVjb20vZW5nbGlzaC9yZXZlbnVlL2Nocm9tZS9hZG9iZV9mbGFzaF9wbGF5ZXIvZC8yNzU4NzZlMzRjZjYwOWRiMTE4ZjNkODRiNzk5YTc5MC90aWcvbmEvbmEvaW5zdGFsbGVyX2Fkb2JlX2ZsYXNoX3BsYXllcl9FbmdsaXNoLmV4ZQ==&loop=1&aa=on/1/freesoftstorecom//&MI=65&JB=37&CI=30&CC=49&EH=95&KA=65&EA=91&MA=12&CE=66&AJ=23&s=6583609722393692715781116075147896257239478847019587798306920710336059907881582541211141844915959554555234492656878992176568163019574108548713491380598255171483330740

http://dk.fileprogdwn.com/installers/axtan_installers/get.php?ik=tig&ua=chrome&ut=570b9f216168ac09fb511ab9bd5a30d1&loop=1&r=4593000&x=L2hvbWUvZG93bl9jcm9ucy9wdWJsaWNfaHRtbC9pbnN0YWxsZXJzL291dC9vbi8xL2ZyZWVzb2Z0c3RvcmVjb20vZW5nbGlzaC9yZXZlbnVlL2Nocm9tZS9hZG9iZV9mbGFzaF9wbGF5ZXIvZC8yNzU4NzZlMzRjZjYwOWRiMTE4ZjNkODRiNzk5YTc5MC90aWcvbmEvbmEvaW5zdGFsbGVyX2Fkb2JlX2ZsYXNoX3BsYXllcl9FbmdsaXNoLmV4ZQ==&u=L2Rvd25sb2FkLmZyZWVzb2Z0c3RvcmUyLmNvbS9pbnN0YWxsZXJzL291dC8wMDIxMDAwMjExMDAyMTIvcGlpZC01NGRiYjQxN2Q5MmExMS44NTU1MTYyMC9vbi8xL2ZyZWVzb2Z0c3RvcmVjb20vZW5nbGlzaC9yZXZlbnVlL2Nocm9tZS9hZG9iZV9mbGFzaF9wbGF5ZXIvZC8yNzU4NzZlMzRjZjYwOWRiMTE4ZjNkODRiNzk5YTc5MC90aWcvbmEvbmEvaW5zdGFsbGVyX2Fkb2JlX2ZsYXNoX3BsYXllcl9FbmdsaXNoLmV4ZQ==&p=RlJFRVNPRlRTVE9SRUNPTQ==&aa=on/1/freesoftstorecom//&IM=48&HG=46&CD=83&EH=38&KB=3&IF=23&FK=36&CI=80&KE=19&DC=70&s=78622856336970697429674414642819672958581288358090057498863155022328187305240059054894781196609931759480905010915405983092763756822870961472564015503913189555147434521

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.