» installer_adobe_flash_player_english.exe
Overview
Analysis
File Details
Downloads (78)

installer_adobe_flash_player_english.exe

Astro Delivery (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application installer_adobe_flash_player_english.exe by Astro Delivery (Fried Cookie) has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from clkmon.com and multiple other hosts.

File name:

Publisher:

Astro Delivery (Fried Cookie Ltd.) (signed and verified)

MD5:

77204ce949116847a6f38ba1d1502674

SHA-1:

cd4249f5ab10bd04cbf92aa53c59c1819a2536c2

SHA-256:

0261c0ed641ce9caaff113aa506b0d57b9e795ba9fb06124d962d7684aa62b49

Scanner detections:

9 / 68

Status:

Adware

Explanation:

Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

4/25/2024 8:25:08 AM UTC (today)

Scan engine

Detection

Engine version

Avira AntiVirus

ADWARE/InstallCore.Gen9

7.11.189.0

AVG

Generic

2015.0.3278

Baidu Antivirus

Adware.Win32.InstallCore

4.0.3.141126

Dr.Web

Trojan.InstallCore.15

9.0.1.0330

ESET NOD32

Win32/InstallCore.RZ (variant)

8.10785

K7 AntiVirus

Unwanted-Program

13.186.14150

Qihoo 360 Security

Win32/Virus.Adware.f22

1.0.0.1015

Reason Heuristics

PUP.AstroDeliveryFriedCookie.e

14.11.26.18

VIPRE Antivirus

InstallCore

35148

File size:

1004 KB (1,028,104 bytes)

Product version:

1.5

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Common path:

C:\users\{user}\downloads\installer_adobe_flash_player_english.exe

Digital Signature

Signed by:

Astro Delivery (Fried Cookie Ltd.)

Authority:

GlobalSign nv-sa

Valid from:

10/21/2014 9:11:59 AM

Valid to:

10/22/2015 9:11:59 AM

Subject:

CN=Astro Delivery (Fried Cookie Ltd.), O=Astro Delivery (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121A99E73962365DC8A4A1F35AD57C59E60

File PE Metadata

Compilation timestamp:

6/19/1992 11:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:cZvuC/1yomyWAdd0zcIk75qaJpNo7zSkFp5woi:ctX/1y5yfAcb75rpoztpwH

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file installer_adobe_flash_player_english.exe has been seen being distributed by the following 50 URLs.

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500150404919000000&pid=11021&q=Search

http://clkmon.com/.../sa?cid=11021-200241312723000000&pid=11021&q=Central Bank of Sri Lanka - Economic Indicators

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200155101321000000&pid=11021&q=facebook

http://clkmon.com/.../sa?cid=11021-200212810022000000&pid=11021&q=Lowongan Kerja, Lowongan Kerja November, Lowongan Kerja 2014, Lowongan Kerja BAN

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200124122520000000&pid=11021&q=????? ????? ??????? - ????? || Kara Para Ask, ??????? ??? ???,??? ???,?????,???,

http://clkmon.com/.../sa?cid=11021-500084223321000000&pid=11021&q=Chi ti?t tin nh?n | 360Game

http://adsafiliados.com.br/9709/.../index.html?key=qp3_qsQ0MzFPDlB2_ZT42JajRRQP0f4yzPrCtldEGus

http://clkmon.com/.../sa?cid=11021-200135910817000000&pid=11021&q=Intesa Sanpaolo, intesa online, banca, banca online, intesasanpaolo, intesasanpa

http://clkmon.com/adServe/.../ foto, baik dengan upload, maupun URL

http://clkmon.com/.../sa?cid=PRIMEWIREPOP&pid=&q=movies, theater releases, watch movies online, watch free movies, free films, on

http://clkdeals.com/adServe/adClick?ai=e78pZMpPz6QeMXzX4UFJNh4zaV 9MImzEQISPIze6SYqnxeHa4/L 9Ig67QrxrwSta85/E5ZjeBK Yq/1X309N40sQ4i8KXRqTX4eYdytOcfqtKQttst1PgQk8H qBnmOJMeicgpyWehTlMtKOoqCIPyB joOsl/TLdXQsBBbufDwzX6imgTkxXvY YSy6fHkG6z2eweOiB55O1Lu5r WNrLs3T9si/6glQzwz KVeG/4il4jsCDCqTEUVthOCJjYCk&ui=G/.../12mUjgLJO6ypQUWEKARrcU0ImaY6ULVxm&src=BANNER

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118821015000000&pid=11021&q=???.1(??????????) ????????????:::

http://clkmon.com/.../banners?tid=IMRANSAQIB_5104_16&action=r

http://clkmon.com/.../sa?cid=11021-500082021023000000&pid=11021&q=???? ????? ????? ??????? ??? ???????? : Sanook.com

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500150417418000000&pid=11021&q=jestem, pokaze, fajna, dob?r, postaci, telefon, wyladowal, popiesci, zmiesci, me

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500082021022000000&pid=11021&q=ZSPM

http://clkmon.com/.../sa?cid=PINOTAMPOP&pid=&q=pinoy tv show, pinoy tambayan, tambayan replay, pinoytambayan, pinoy network, fi

http://clkmon.com/.../rdr.html?pid=373&cid=rjs81_0_CRW_IN&q=&q=Tarak Mehta Ka Ooltah Chashma Jethalaal Sailesh Lodha Champaklal Shweta Bhosle Dilip Joshi Disha Wakani Gurucharan Singh Jennifer Samay Shah Mandar...

http://clkdeals.com/adServe/adClick?ai=e78pZMpPz6TWZEaZboedZKnjdSeydZ5U7jO4lIRAaPXqNI/EbQYY04LiokiJcsPeBhIy9o/VuNZ2 VdKBbsuOucELyCPlq80tu7dBHKprLoGubu44YI3xKnN37TyN4y2wcHPIi9bQfU4=&ui=Nn7vm/.../4Cve 4LdfyPJ0Npevg&src=BANNER

http://clkrev.com/.../banners?tid=WALANGKATULAD_DKTLNK&action=r

http://clkdeals.com/adServe/adClick?ai=e78pZMpPz6QFS7wFhyJT3F4Wo7YEG19B7fHPzXlU2ZNcjrMfyelWJhNecs 9vJK1CqFL MM4wNWB XdqzSt Qzfr3DgKqj8DuO/Q7McWmjiIez L4AZegJyHBInLl/.../0KUnBXn 9 EVa&src=BANNER

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200068715211000000&pid=11021&q=Teziutlán, México

http://clkmon.com/.../sa?cid=11021-200033921023000000&pid=11021&q=??????? ??? ????? ?? ????? mp3 mp3 4shared ?????????????? - 4shared-mp3.org

http://clkdeals.com/adServe/adClick?ai=e78pZMpPz6Q0iQHP78BR56HdwLgoenvFTuVCl5QXnPS4jSQOoX5PXNZyxYUUXxvEAzX8CZ6ddiX0 6LDulS0SNFJUB4cCMpzhDdfKilmZiovBgoFUJk9oNxb25Z24P2rpvitaEXZPV/CM20LIIb0VjMHm Qy6VV/.../1625Bg2gsXo4NnDw29zEw6zE 0pDFLyhs&src=BANNER

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500141210018000000&pid=11021&q=microvolts, micro, volt, volts,free, fun, online, play, video, game, gamer, down

http://clkmon.com/.../sa?cid=11021-500184418722000000&pid=11021&q=?????? ????? ??? ?????? ???????

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-200118821015000000&pid=11021&q=DotNetNuke > ?????????? ( DNN 2.1.2 )

http://clkmon.com/.../sa?cid=11021-200212806123000000&pid=11021&q=bloquer les publicites

http://freempr9.jrcaaa.com/down.php?p=REVENUE&trckid=004603402016334866721

http://clkmon.com/.../sa?cid=SUPER-CRSRDR-500082021022000000&pid=11021&q=?????????????????7,????????????????,??????7??,??????7 TV Online,???????????????

Latest 30 of 78 download URLs

Remove installer_adobe_flash_player_english.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.