{"id":6719,"date":"2015-07-26T19:17:37","date_gmt":"2015-07-26T19:17:37","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=6719"},"modified":"2018-05-29T11:57:31","modified_gmt":"2018-05-29T11:57:31","slug":"llc-de-proekt-39-detection-rate-amonetize-strictor-pup-optional-bundle","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/llc-de-proekt-39-detection-rate-amonetize-strictor-pup-optional-bundle\/","title":{"rendered":"LLC DE PROEKT – 39% Detection Rate – Amonetize \/ Strictor \/ PUP.Optional.Bundle"},"content":{"rendered":"

Hi there! Short on time\u00a0this evening, but I just wanted to give you the heads up on a publisher called LLC DE PROEKT<\/strong>.<\/p>\n

\"LLC<\/a><\/p>\n

If you have a LLC DE PROEKT file on your machine you may have noticed that LLC DE PROEKT is displayed as the publisher in the UAC dialog when double-clicking on the file. The certificate is issued by COMODO RSA Code Signing CA. The publisher is located in the Ukraine<\/strong>.<\/p>\n

\"LLC<\/a><\/p>\n

The problem here is that if FlashPlayer__6741_i1561835113_il7532.exe really was a setup file for Adobe Flash Player, it should have been digitally signed by Adobe Systems Incorporated<\/strong> and not by some unknown company. This looks suspicious. Here’s how the authentic Adobe Flash Player<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Adobe Systems Incorporated”.
\n\"Adobe<\/a><\/p>\n

The issue with the LLC DE PROEKT file is that it is detected by many of the antimalware software. Here are some of the detection names: Trojan.Application.Strictor.D164B3, BundleApp.IVU, W32.HfsAdware.B493, Gen:Variant.Application.Strictor, PUP.Optional.Bundle and Amonetize (fs).<\/p>\n

\"LLC<\/a><\/p>\n

Did you also find a download that was digitally signed by LLC DE PROEKT? What kind of download was it and was it detected by the anti-viruses at VirusTotal<\/a>? Please share by posting a comment.<\/p>\n

Thanks for reading.<\/p>\n

Update 2015-08-18<\/strong>: Found\u00a0another download today, also signed by LLC DE PROEKT<\/a>\u00a0and also using “Flash” in the filename to confuse users.\u00a0The detection rate for this file was 25% according to VirusTotal:<\/p>\n

\"LLC<\/a><\/p>\n

 <\/p>\n

When I ran the installer it disclosed that it bundled a\u00a0bitcoin miner<\/strong>\u00a0or some other type of crypto currency miner:<\/p>\n

\"LLC<\/a><\/p>\n

 <\/p>\n

Just a quick update on the certificate chain. It begins with UserTrust<\/strong>, then Comodo and then LLC DE PROEKT:<\/strong><\/p>\n

\"LLC<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Hi there! Short on time\u00a0this evening, but I just wanted to give you the heads up on a publisher called LLC DE PROEKT. If you have a LLC DE PROEKT file on your machine you may have noticed that LLC DE PROEKT is displayed as the publisher in the UAC dialog when double-clicking on the … Continue reading LLC DE PROEKT – 39% Detection Rate – Amonetize \/ Strictor \/ PUP.Optional.Bundle<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[126,81,726,157,306,305,725],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/6719"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=6719"}],"version-history":[{"count":5,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/6719\/revisions"}],"predecessor-version":[{"id":7014,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/6719\/revisions\/7014"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=6719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=6719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=6719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}