{"id":5941,"date":"2015-04-30T11:46:38","date_gmt":"2015-04-30T11:46:38","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=5941"},"modified":"2018-05-29T11:58:29","modified_gmt":"2018-05-29T11:58:29","slug":"ooo-mad-advert-detection-trojan-installcore-win32malware-gen","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/ooo-mad-advert-detection-trojan-installcore-win32malware-gen\/","title":{"rendered":"OOO Mad Advert – 5% Detection Rate – Trojan.InstallCore \/ Win32:Malware-gen"},"content":{"rendered":"

Hi there! Just wanted to give you heads-up on suspicious file I found right now. The file is named adobe_flash_setup.exe and digitally signed by OOO Mad Advert<\/strong>.<\/p>\n

\"OOO<\/a><\/p>\n

You can also check the digital signature under the file’s properties.. The screenshot below shows the OOO Mad Advert certificate. From the certificate info we can see that OOO Mad Advert appears to be located in Moscow, Russia.<\/p>\n

\"OOO<\/a><\/p>\n

 <\/p>\n

Here’s how the OOO MAD Advert download is promoted:<\/p>\n

\"updater.safeplugin-update.org<\/a><\/p>\n

What caught my attention was that the download was called adobe_flash_setup.exe. This might look like an official Adobe Flash Player<\/strong> download, but it is not. If it was an official download, it should have been digitally signed by Adobe Systems Incorporated<\/strong>. Here’s how the authentic Adobe Flash Player<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Adobe Systems Incorporated”.
\n\"Adobe<\/a><\/p>\n

The detection rate is 3\/55. Avast reports adobe_flash_setup.exe as Win32:Malware-gen<\/strong>, DrWeb calls it Trojan.InstallCore.508<\/strong> and ESET-NOD32 calls it a variant of Win32\/InstallCore.ZC potentially unwanted<\/strong>.<\/p>\n

\"OOO<\/a><\/p>\n

Did you also find a OOO Mad Advert file? Do you remember where you downloaded it?<\/p>\n

Thank you for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! Just wanted to give you heads-up on suspicious file I found right now. The file is named adobe_flash_setup.exe and digitally signed by OOO Mad Advert. You can also check the digital signature under the file’s properties.. The screenshot below shows the OOO Mad Advert certificate. From the certificate info we can see that … Continue reading OOO Mad Advert – 5% Detection Rate – Trojan.InstallCore \/ Win32:Malware-gen<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[448,447],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/5941"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=5941"}],"version-history":[{"count":3,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/5941\/revisions"}],"predecessor-version":[{"id":5948,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/5941\/revisions\/5948"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=5941"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=5941"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=5941"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}