home

firefox-13108-dp.exe

Cesol

The application firefox-13108-dp.exe, “Cesol Setup ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.currenttoursclear.com and multiple other hosts.
Product:
Cesol

Description:
Cesol Setup

Version:
5.3.4.0

MD5:
0fd30b3e31a58956a65ee82ec5ea2cf8

SHA-1:
0d383a36920c076c70265b4c663bf5fd24ca93ab

SHA-256:
f2c6c3794b66e07504df16d85f4d9784e9d5dc2dc6c3dd41a8fef1044fb82beb

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 7:30:42 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.AFF.gen potentially unwanted application
7.0.302.0

Reason Heuristics
PUP.InstallCore.EST (M)
16.4.14.1

File size:
959 KB (982,033 bytes)

Product version:
4.8.6

Copyright:
Internet Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\Documents and Settings\{user}\Local settings\temporary internet files\content.ie5\{random}\firefox-13108-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:hpas09+b2j18ARkQSK88Cy6h86fubS0nQ+UFfYxJSl:hgsM8afSK88Cyk8/hnQ+UlGK

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 16 URLs.

http://www.currenttoursclear.com/c?x=VhPbAt2s13fZqnZ2Ux th/FK6ccGKm 8L340WRQMZiY=&c=B82ku1UVhGlZnwqD0wr3ejZp5OBGfHb9E m/gvtq04fpY9YBA/i2OzL5BlnTfp9Q1DiNjlztGIM6xBwnQLvxyzVJHOPnhYam2n7mkV4s7mtDcROoOHO0N5pEZArfY7Oc&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.newfilesdl.com/c?x=F4LqoayIRZLsHwJt jvyt/jyrhkHUOZSmzcsD4VTG/4=&c=8q60IB4o2ypGr4MTVaCLqqb7yTnefgPJcAK0muZlIYNR9MfKcG2vvKLMp21LyB7p2SNP6v6Zk9NRUyh9/mOBiDxEIF z/MYv51DTIVx6EaRDdPd9kQLXmLgkHOmevnTs&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.towertoursworld.com/c?x=NH4Qxt5qykNPhqvbwBfGjAWOg tqqUrp0LVsac5fNQY=&c=L39eTqWuZnlLVlF7JBs69PkMtrsPHb/SxiZVKHrnGoGeNUDwYqdZ 5rBSTTamebm88LIGzSpNiJ0hTGJLq QqjK9HWsbw/Vfypds0GeKAkCn2mw7H5rtcoMu1F1RUxfr&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.currenttoursclear.com/c?x=76Wyhkqy0/P7qD0Dank9p1B/5XSUsf9ELlgtuXiXO8M=&c=WrDMcJkhPWfIJs9gBdKiKgvC5rROpR9NUNRJcZWaNK7vA6QyJM LuQ9IObw9z257zNDN1K5 jaJ OvitUVHbOeqQ N32z kQ8tvLd9SPJpSDPs7Fzb4VdYCX9064mjdY&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bulkbundleapplications.com/c?x=mB6hoZ/RG5uhAy1xm/dcXoPvo61MA3xDzwsbI6atjrw=&c=6O HP1X/2C/D6E2JT Gfc1LJdT2frRO4ZhPtfTtsA6RIYUmoGG72kjDle6nacs2wam/4RSX8yH2Tb2xu24qqspbJC1QqRRWLR5IXzjUfotBAPPWWD1VgX84NU91tenhj&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.towertoursworld.com/c?x=nZZ8hS gLPQK6ZJiwN6xhws9Yvsx6Pt5l4B0k5JdrR4=&c=qEdwYGTxIFggGyu62SZYlIAIn5PW4lgovAINPSdju 9kjo69gob/IaZHP34XsAFiwi gl79MH9wQK nM2RuIYijdQ CyGu6of2hCZoxDlmtnHWDJ1 EIq6UCbKv0fTSL&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentapplicationuniverse.com/c?x=VMtMsh3EnEx7nxe6jjs2oGMQYrWbyX5HQt1YmSX3Heg=&c=m5vwiqHHoKxpuvwQDa/Jjj6IudFSa6d7P iOFoSbgLSBOVf1N6kFA32 WosX0uqQD39ONFYFOMHj9Y32TT27/rQ0RrnibhjX5Shd9oIWb02gVCmeqnUzOq9rQaf7AtqV&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.conecptbulklaboratory.com/c?x=U0fGWqly0FckzPfuBst2E45P/6452IcgrSdAKCpW6p8=&c=zib9ffTXHYuYp2NgHL3wftGBIZ0TYxJpnseT0ezpIu3abjAtVvjQy4glKh3SMiW6m1bEl3GfbTwXBOn0k3GFy7qbC8qIKCTApIdeShM2932SCGRU7v79hMbgaQ8Gfkmc&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.cyclefactoryvaults.com/c?x=sqN9hGSEEiPrnft9sTHu ixrInvuq49ZOReL8lLwYHI=&c=p15M9RBRkVYflA3tnSnZ9flAAn2 DRL0HNpWvQ1UcVA43W7Qjg9hu3miHs4m98wMwrZoDiU4xsHW83Uo6KflC2IR4j3HcFh nkiEZVX2RABhb6fD3 NHhpNJn219iiEL&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentapplicationuniverse.com/c?x=nk qdtUVSUmxZQLW1SMkJYPSUcg7c Rm1dOhEfin8Sc=&c=VZ1VYL0t67dAzuwykQFsSkoXCi4arb3LFSNwGIQQbG0LinW2bH2L4Unlwf8YsTJWMmSjvZu2ndK4yjxga5601vo1c0bBjWmtAPz2GlUOv6lUXUfqVqtryYvirDUVRmtd&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentapplicationuniverse.com/c?x=x3j1SO81aTDeCcTcpJwk3/M5hiu/ZihCNaTiZwIr/8w=&c=WzNZmNgpZYlX KmEol0rG8rsFqiN63fqB Eh5vfgVYJ9FSpqljxPWD72wIitGlF5EEnAWZOqkRgr1/dW1Rtyb9b0OBVN7T5C5VIytB YRaJgB0vllH9n5Lr0lf4zbSbm&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.cyclefactoryvaults.com/c?x=NhcJwWOg6iZY7sdEaRpIwHLQSBSeXPBR4m6gk05bZmI=&c=V1NicbrcwPTgsdXQkN2On/HYyZz612UC8g8o C8aMJZmaS3bsK9M31UqgTXARGrsy9snq99BKZlEHMWWTQsJqPUd5jLqik4pcaAc5rQTb4TzbFHcYEzR0lSOr5vxw10B&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.chuckledeliverygrab.com/c?x=C4xdqRhxqQO4AXFiH82YGkcyJGprTzGpHexMUz59ERM=&c=XMSYFkLL/w1JA8eKTTZU/2m/2OGfbKuJWVvgtLLdsTYV8MTaaOGsBg60Lc0dwiC75BsRvqjY621Ln0HH m/ sDUVIq7YjD0IvUGgT0X5AvTEQ2fjd3YDxq/ h2xAONBA&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.chuckledeliverygrab.com/c?x=krGG3ekGHMx3y0wBo4L2cWyEWJ4ErI9cWJWgTJ0rhAg=&c=RhblAkVG0Q/4BWdmayl91l60DYE2k4 36ToAPz6dPUMDM5coDpXySUj/ManOX5NvtGFiGgQiiAF9p24VMT2NnYKWVQlCY4/Zc IOyZdaEUJL/jumL5TQnruS1f9oi7BD&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.chuckledeliverygrab.com/c?x=fHGRbhL e1yQ5qcvp/N6FFXb/j0Edo20U/BZAdYYwpE=&c=UBn0WMLz7bvLmsRDdO 3Gpy/FptGhuaqsqWjXDm2E/2iwlUDREt2qqhHwISZpAYi1zXjd/DvD2G32lT4mGP60n/Sm7Krf3F8tj sv 9qo4yFmlP87NVwjtzs 75gLlu6&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.towertoursworld.com/c?x=dvN5abRtGCkmffbM0SYuaJ9PniO2R6z8NkgxURpvHgI=&c=7d1TXj9YY JjEaMLYqYS1xuNmTjxeASVNXUTuTdM5VYFeUjZ ele/f8Kw/S CImReEzTCjCuWdRqes77nKLiysMsohiu/n5tTg71WhRY/mOndfiyUYjgPGiNnSZDRMAM&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.2/win32/.../Firefox Setup 45.0.2.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.