{"id":4773,"date":"2015-02-22T09:05:46","date_gmt":"2015-02-22T09:05:46","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=4773"},"modified":"2018-05-29T12:00:29","modified_gmt":"2018-05-29T12:00:29","slug":"advertaizing-grupp-19-detection-rate-installcore","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/advertaizing-grupp-19-detection-rate-installcore\/","title":{"rendered":"Advertaizing Grupp – 19% Detection Rate – InstallCore"},"content":{"rendered":"

Hi there! If you are a regular here on the FreeFixer blog you know that I’ve been looking on the certificates used to sign files that bundled various types of unwanted software. Today I found another certificate, used by a publisher called Advertaizing Grupp<\/strong>.<\/p>\n

\"Advertaizing<\/a><\/p>\n

You can view the certificate by right-clicking on the file, and looking under the Digital Signature tab: According to the embedded certificate we can see that Advertaizing Grupp is located in Russia and that the certificate is issued by COMODO RSA Code Signing CA.<\/p>\n

What caught my attention was that the download was called adobe_flash_setup.exe. This might look like an official Adobe Flash Player<\/strong> download, but it is not. If it was an official download, it would be signed by Adobe Systems Incorporated<\/strong>. Here’s how the authentic Adobe Flash Player<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Adobe Systems Incorporated”.
\n\"Adobe<\/a><\/p>\n

So, what does the anti-virus programs say about the Advertaizing Grupp file? No problem, I just uploaded the file to VirusTotal<\/a> and it turned out that many of the anti-virus programs detects the Advertaizing Grupp file, with names such as Win32:Rootkit-gen [Rtk], Adware\/InstallCo.zlz, Trojan.InstallCore.57, Trojan ( 004b4b721 ), Riskware.Win32.InstallCore.dnxkbc and Win32\/Tnega.MFNTaRB.<\/p>\n

\"Advertaizing<\/a><\/p>\n

Did you also find a download that was digitally signed by Advertaizing Grupp? What kind of download was it and was it detected by the anti-virus progams at VirusTotal<\/a>? Please share in posting comments below.<\/p>\n

Hope this blog post helped you avoid some unwanted software on your machine.<\/p>\n

Thank you for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! If you are a regular here on the FreeFixer blog you know that I’ve been looking on the certificates used to sign files that bundled various types of unwanted software. Today I found another certificate, used by a publisher called Advertaizing Grupp. You can view the certificate by right-clicking on the file, and … Continue reading Advertaizing Grupp – 19% Detection Rate – InstallCore<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[104,448,447],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4773"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=4773"}],"version-history":[{"count":1,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4773\/revisions"}],"predecessor-version":[{"id":4776,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4773\/revisions\/4776"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=4773"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=4773"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=4773"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}