OOO “Finans Servis” – 9% Detection Rate: InstallCore/CryptInno

Just wanted to give you the heads up on files digitally signed by OOO “Finans Servis”.

OOO Finans Servis publisher

The OOO “Finans Servis” certificate shows that the publisher is located in Moscow in Russia.

OOO Finans certificate

The problem here is that the OOO Finans Servis was promoted as an update for Adobe’s Flash Player. If adobe_flash_setup.exe really was a setup file for Adobe Flash Player, it should be digitally signed by Adobe Systems Incorporated and not by some unknown company located in Moscow.

9% of the anti-malware scanners detected the file. PUP.Optional.InstallCore and BehavesLike.Win32.CryptInno.bc were two of the detection names. I think we will see the other anti-virus programs add this one to the detection list soon.

OOO Finans Servis virustotal

Since you probably came here after finding a file that was digitally signed by OOO Finans Servis, please share what kind of download it was and if it was detected by the anti-malwares at VirusTotal.

Thanks for reading.