home

firefox-13108-dp.exe

Installer

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The file firefox-13108-dp.exe, “Installer Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Installer

Description:
Installer Setup

Version:
5.5.4.1

MD5:
7bef03fa057f57b22e8fd6c7f5a48a86

SHA-1:
073699778115c483ee0e2568cf334c02dfb0e94a

SHA-256:
c879892ff1a37a0e6e0f433286a1608635e58a283e9f401ecfc20b30c1d9bf5b

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
2/25/2025 1:45:21 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.1.21.10

File size:
934.1 KB (956,536 bytes)

Product version:
5.4

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\firefox-13108-dp.exe.td3jo35.partial

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 8:37:06 AM

Valid to:
7/7/2016 12:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:2NdDZZ18ewOdiVHjfog+ox2ZImYyPrdiOhM:2NtigAjfEGDmxrdb6

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 9 URLs.

http://www.packagepresentapps.com/c?x=XSJTRSAkEVnupdlH sbw2qcZmMGGdcUGOihdXk4V3Mc=&c=xL9hPF2BPc0RMc3LXhU8jOMob0aPPW9feMnzWF3t/fOy7LvvMWkoRg6fELiiJg5ZDNdFLuxRFclNpf3wZP2IqkVpdfKkttk/mEpp1J5dh4Yec9M1hdWGYFi64U2hW/lo&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.worldvaultsign.com/c?x=JTCNmXICXJJnLG43nGSxKkDQVbZlQB6ThK3I/Ih tL4=&c=yxATANqZq/Wd1DRChQPRp0Aex96Ti2WsfuZaryzf30DtVLVjUiYp80s195phy7vcBy8TeCy4jHMw6CSixFQNSnjvQSvCfy0fJL45ApYSEqc/bPc7qpkKMk9IqHXlT034&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.packagepresentapps.com/c?x= ifCHI1cC jI6aPRdB7/hIXpeFYtHSnTm9wsWf F8NY=&c=TfXur6AU91TDhzjpeKs/vM4TLFxDvjxMtYAn430Uywm2NlEjVjLPQeLZBWtPROmcACZRtLnEEaNhNcIKPEur0YwS6TPL8IpHuflTVbq I6E4IseEyespQTL2UDSIlH59&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.signsfactoryfarm.com/c?x=Y/8aoN4HtNeXEMWyJS8Iz Jw0oQwFRL0IL/Ma3BUE2U=&c=BFGKowZhf22aQj5TEdooSaGoDsyYQIMAqiA zlQ5W17Mzd9IwqNh2qWicDWpc3ySTiBLWkU gl8iykQpEmDcuIdisXhSKzkXwwaPJP368XM9YLF40ylXY0B/e8eWeSRs&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.packagepresentapps.com/c?x=K572Aj3Ie7IV9MIWSAtqHEqKk 6BhCGVbQmAUn5Z8mQ=&c=Nez FEc vVUw3YFZcqGCuBX2nCXNtIEkjLEZQzyGpb8KMe UtnJAG500PaWkiiQkEYQrXQURTks/Mw9kJ6Hu6/O0za82mdeX/rYefqFmcqJVT3kI4l7hoOEMzkQlmc1X&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.clearfactoryclean.com/c?x=TLoQxx1JZpyz y1uYh20pF4lNQZFRJbqOSRf5h/aDj8=&c=QMuv4yjy IQdW1A3Gajju SVCx3QtkbOOCyZDjtQiuNznGO5QOxKHdT2OhPt7NpFYlxNLzBtT79LriTLbhpE3yl8sf/P1cDjeiFRNB83p6PHTnQ 3iWvBdPmSWvCa 79&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.packagepresentapps.com/c?x=UlRo9jSmHSrhUfwbVOBR7QIOerf3ErJlR3veTAzoyuY=&c=prG7mExtNJ32J2E5gZU2pn2rCFN9WyKp414zuOP7vjuELbnqRdyQffdyHezxdUj4HRswrogI/8z4mKW GdSjDG n9LKumJXrnpio8mzbqnEQZyFIvV30gmVaxvV1heir&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.packagepresentapps.com/c?x=g3C2j kCZEGXqr7vm8tbHBJmNrf8YXDzFhMXpcdd2ts=&c=jFjOhTqxEe0rVbQOd2vfXIVtOXR8A5bhe7iLJQZvmcXbXFawc85UfI44B4WiqiRtdVEeFv xxKh2WSLZwsXzJjZ KOAQ221F4iO0bV39tRVUMn5uf5s vFYpxq6cNnfp&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

http://www.packagepresentapps.com/c?x=Qs VFFc CrGbSxTXMQGLD8IgHnC6va 8dUYvtXizfy0=&c=VjLgZOaSoCjz3g/Up8VzfOwPLvVhQN9kWJYpFpWMbk8y6kPTezRiE nSZ6yPpF1JuxHd8V/yEs0QKdFX54h/Pfb9Sp8eXlp/CxGgQPCJgs8NXtOYvGkETj2aFtkxXb g&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.4/win64/.../Firefox Setup 43.0.4.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.