» installer_adobe_flash_player_english.exe
Overview
Analysis
File Details
Downloads (25)

installer_adobe_flash_player_english.exe

Free Software LLC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_adobe_flash_player_english.exe by Free Software has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the installCore installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The file has been seen being downloaded from freempr9.jrcaaa.com and multiple other hosts.

File name:

Publisher:

Free Software LLC (signed and verified)

MD5:

e512f6f1b7e4c1d449d78c5505eb7086

SHA-1:

96d6de36c83124d2f95e0105fa191fc5aca98f03

SHA-256:

f7742eefb668693eed3acbcd37a3c619a7e5d0b377f0f96bfd4c2f5dc4524185

Scanner detections:

7 / 68

Status:

Adware

Explanation:

Bundles additional software, mostly toolbars and other potentially unwanted applications using the Vittalia monitization installer.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/20/2024 4:31:26 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Generic

2015.0.3262

ESET NOD32

Win32/InstallCore.SC (variant)

8.10840

Malwarebytes

PUP.Optional.BundleInstaller

v2014.12.13.07

McAfee

Artemis!E512F6F1B7E4

5600.6918

Reason Heuristics

PUP.FreeSoftware.e

14.12.13.7

Trend Micro House Call

Suspicious_GEN.F47V1205

7.2.347

VIPRE Antivirus

Vittalia Installer

35512

File size:

793.5 KB (812,592 bytes)

Product version:

1.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

Digital Signature

Signed by:

Free Software LLC

Authority:

Starfield Technologies, Inc.

Valid from:

8/1/2014 2:38:01 PM

Valid to:

7/22/2015 3:53:49 PM

Subject:

CN=Free Software LLC, O=Free Software LLC, L=Wilmington, S=Delaware, C=US

Issuer:

SERIALNUMBER=10688435, CN=Starfield Secure Certification Authority, OU=http://certificates.starfieldtech.com/repository, O="Starfield Technologies, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

27DD6AADCC34E6

File PE Metadata

Compilation timestamp:

6/20/1992 2:52:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:3KFTIENy3+ZSijrkfj0NF3I1zG8gnqZuDUYp799Sp:3YUrijrkfjOF41hgq4UYD8

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.8869

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 25 URLs.

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=30151794631417834719

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=14632721441417810405

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31572805391417816163

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=6906352821417862426

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ub3fc55e2545e67935b45be9bae

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=892694311417800542

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u5504fed95436bf4a7b1655e8f5

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=28692958941417798574

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=19351213531417797437

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=37547520031417920192

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31582562671417813281

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u699d113c5433c73b2c11ac1322

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ubd2146a65468f5b4221ec76f71

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ub13550155456871069b3c845ce

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=33776350381417838798

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=u29ce8a215475a4ca659d8ae7c2

http://domsem.com.edgesuite.net/installers/out/012050120601207/piid-54829e99c9f166.26736830/on/1/freesoftstorecom/english/adcash-ddownload/chrome/adobe_flash_player/d/275876e34cf609db118f3d84b799a790/ici/.../na/installer_adobe_flash_player_English.exe

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=14141218761417811194

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=6244403741417613513

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31422620521417802449

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=ubacce34d544d5b9e50404cfaeb

http://domsem.com.edgesuite.net/installers/out/012040120501206/piid-5481eff14909e7.16101021/on/1/freesoftstorecom/english/adcash-ddownload/chrome/adobe_flash_player/d/275876e34cf609db118f3d84b799a790/ici/.../na/installer_adobe_flash_player_English.exe

http://freempr9.mutajoreto.com/down.php?p=ADCASH-DDownload&trckid=31356436841417801878

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=31356436841417801878

http://freempr9.jrcaaa.com/down.php?p=ADCASH-DDownload&trckid=25490566731417798636

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.