home

firefox-13108-dp.exe

Lite

Mode Beta (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox-13108-dp.exe, “Lite Setup ” by Mode Beta (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Mode Beta (Fried Cookie Ltd)  (signed and verified)

Product:
Lite

Description:
Lite Setup

MD5:
4884fd9fc7c78e1d1a2fd917cd107796

SHA-1:
114d996afaec1a9ef5418c2cb813a1e961847a86

SHA-256:
f21fc894a0c250388cba6d94a3a0cef8a9d592764034680c25967ccad0455f56

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 5:03:40 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.15.20

File size:
944.3 KB (966,936 bytes)

Product version:
4.2.2

Copyright:
Application

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\firefox-13108-dp.exe

Digital Signature
Signed by:
Mode Beta (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 2:37:06 PM

Valid to:
7/7/2016 6:06:18 PM

Subject:
CN=Mode Beta (Fried Cookie Ltd), O=Mode Beta (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112172B4C29D53526C8AFAEF1C4F6265E881

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:QTtBYvtCO6iNum4dvHgNoW+iN6jEvZJCblnxIGX:QBWvL2HgJ+iNFRJwIGX

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 23 URLs.

http://www.bodytowerfun.com/c?x=N6FsSpGpJtJz86v9miNrRMcSgW71dwtu98ek5Bhhtow=&c=uk54hquelLTfs4iligXAbkk5BEDSkU/UUBTQd /3OfjahZUF8x40V1bKO4Qi7PEOl4fHRJRt7kmliqxTap7Pf2fIH1hHSgcZyM3LBKXO0piUJHdaEcxhIhoZDsjOftCb&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.laboratorysenddl.com/c?x=VXi54MhkIIOUZ5BuuMOjg VSJCFIoYhzc9Odocndc90=&c=ThbmqdnQj3YunYH/DrVJqU3pG OGjEejKUazxnjVxAGkzMYpnOD2JNhC1GGXM/0hSlmwPM1nuiNuH6nEsLLbHWKHREOXNhAF6NlFQqlOKnvEsDZ8II4nDnmOX/tr3b6g&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bodytowerfun.com/c?x=LpwTi3O2BY/Zvz4ExBUu oel 1ar8KOqjkXkb32FKz4=&c=AY2QgtF4J9xOyZxNeEf7Gyoyf1j655o9MFd64f6V/4rYX457VEFuNYfUnPTI eXlYDxeHDgNQVGuZqQLNb4RRmDsSQeTulCAMYHVTiRoS8yfxzNYB2SB3/rpwN7Ut9wl&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.safedownloadfile.com/c?x=YtY7fGj7jkUS7YHeb8Ubpi2cLfaoXkJ2H6VTfr/TZds=&c=xo/9gfWydjhNIEUxRyavAGvEhv2XMTd9DDs4cfmDJ0GRpL4AIDvIzAn0xxFNqb/ARewx9UG6iLfBu4vNoe3y1Zfsw1vC2sjSRgmG8UkrEmChNEDVozHylMaCVr3obfLw&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bodytowerfun.com/c?x=4q6oNqShnCqnVlGwDqIdmiNytUzZJQBl/mWY7r2vzVE=&c=cuXxgy8oiUhWrq6OJ7LumqQZEV/Q0OAI6piMXOhfCpmvlIpr159TZJxsIxgBl9Y6qz6Zsuexx 5IS/JMwFe QqYDf6X5JD70714ijj/Pf2N9yXGVsxHCd51iBFjpwqw7&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.laboratorysenddl.com/c?x=GzClZOE8s6Gz/mXhGQ xwjXhTtuI3Rxswm08d8KbBx8=&c=maYcI3/y4CuHX hYRB7F5DXdYAUhtdTGmNjcoFk8vP55vt6RMianTMbQ5EkV6u6IAqGXYOLGZlFm6Op5UVtzWfm66X9WXuc3jlxBteYvZqPwroOcZ94DfL6hqfQsi4fW&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.laboratorysenddl.com/c?x=MtMgjZNZOwYXp1aUM2gCLDv2YI ksqK4kNzH7RfWe5w=&c=mmTP R9Jt5s86LgwsPzrPAH1Wl23OX3AWVLsD6rOZEIunGcuq4BeiL5/bsMpiqrTsmOGqHGqFBXy/i2aMHmy2hTkALaI7/7Q4LLUJ5a0cuXYFB6LR5ZnmrZd3LgyL4VX&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockcentralcycle.com/c?x=b0TTE4L/CG VAHF3RphWRlegd2P9/gk3lQzytYkVcLw=&c=mMau821RMfDkw0oKZV2glh1KqpRCV29jD3 vP KY1obt7Uz7/dN3E2aplIBL kn kcKz9a/t/08nRCxwWcsYpnkXfQtfpI3qZFx5f 4DrTVeGuysBs7ZxtNE6B/UL/Tu&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockcentralcycle.com/c?x=VVnMq08fpi58ciL4frjyxvUuiGVHtrOCm3JhSJdHKDU=&c=gv1rtKx4UFasHitqr94jiKX/lNWDLqNwKF8KhFBQaeZag0L S42/W/HaER5WnbUdfdQ230vttLPc5T6O d9x1GtjNjdarL7G03tWcymSJNT8U/Vv0KH2aEYaIkKWUk8D&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.appranchsoftware.com/c?x=EsRdNXIIdrtwpjy/GyoO90Dmj5Ziv0MNcN/J5IGZOiM=&c=K058AOZ43USX4Ni8cDUbc1qPiVx2m6kvLFRfPWSz3lNhUgSasr s9Eul8ex5CiUJajwCosY1Gb58ibGJpD7MV41qFWU9CDkSrhzGIfhZfjNus8GyQXqVZUM7QXQs1Llh&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bodytowerfun.com/c?x=leAHJyrueoZCCHa0FI iUk7Nqk E6UTJvAhxf35PECI=&c=XS4VPF2aXFwHHBzB62XuAhrH5LjXG9wDWtMhcAYLUURN0Vr/6RUVpooYmNq86wFuuBArJ66984vdYXytcbr4mwnOV/W6mJMA A706sxGdTjEHN3SnV/wXVwzGtmIs8ju&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bodytowerfun.com/c?x=N6FsSpGpJtJz86v9miNrRMcSgW71dwtu98ek5Bhhtow=&c=uk54hquelLTfs4iligXAbkk5BEDSkU/UUBTQd /3OfjahZUF8x40V1bKO4Qi7PEOl4fHRJRt7kmliqxTap7Pf2fIH1hHSgcZyM3LBKXO0piUJHdaEcxhIhoZDsjOftCb&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bodytowerfun.com/c?x=C/aAlbDwfLZzynUxNpguEsrpUV6F0qUChX4dRmenksY=&c=XUgpS7jf2FHPZ o7sQcfAnFwankiZsHkTXdWQcmaysCOrnT2wO14ZKVAeakv/nTwL8NAybq0zUiT 3LC5kJbwuIA3HMABrO7BSMRlEN5/d27E/VRsWZ3c1S0twXPZdeg&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.appranchsoftware.com/c?x=OssZW1jN1AC4ko3O3laHiuU1haImPX6 uDLxJPTLau4=&c=Y544u2svxfuTuBDOvOOpLYG7MSFLt/jmD1c415L7D0Yw8tqECv7zXQ83kRSm40 UelI6je7hvhghbBE2vgaJPB4ZCBMJ 6M2Z aGF/lkpFlywU2r/mxygVLFORvk/Ls1&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.contentheadtowers.com/c?x=nGLQOLgaFEDQV Jja9Fl WqPJPnlougV7bf6VDWI SY=&c=aUf3qRagZApyOog GaEYM dS6mtNwTHKQZHItJ61p PeJIUFBeqBBHejP4X3e1TNFgPMtiNfKntmt3xNFN9jjXR AJaI5BC4esBqNzvot/yiP8iNxH5fWD90bKQmvowz&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.bodytowerfun.com/c?x=p3gNH469UGpGf6RDgWegOCRdmAxVIHdv9UxOAsG7wFA=&c=OSqygDxPI12cWnbpZXoLJ0OlqWzBWNcugFxl 1EkljWxz16MbC80w/F76zwoJAvHS67riTjbNCZmytyx6CPCd/YUuW3IU74379sUVG5SJ0C opv4qVKRqvIUYtnO7VT&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.funchucklecycle.com/c?x=BOqT5QEKh5R2fah7UKjfQWTFrwD7QbBlahNwurrtDQ0=&c=K5Z5rVO9k0ZrpiL nViVC/fTwc1GisTXl2H0VD2gvC5QHzVmx2U9/hpOSx4jZQyNL/CQpkFITlwi9HNVGswFQQcStirgCts0VwH3MNo0oIOQGaYf3CfmWSzszYbtWQ7N&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockcentralcycle.com/c?x=2HXHUg9hPiMDvgmXz830zKJhRxppii1/gzAgV3bKAPk=&c=O0R0mmHhSi1k61pfr7oMCHf0L4ZxtYJX3mfdaxuY7I6IPjJ6LLSP5PDA5Rx2 UxoTV55GtddRZWu1XxU0uxCL1EQ8AsFT3gFKhInMTkrkgGFYTamuYDP6uFGXXZZ/xAP&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockcentralcycle.com/c?x=uQQWjINwMooraGL96GkbnFYa2y2apCLBfq7 MocyS4g=&c=IVvuOR w5WHDJWpTEtUANdX3I4yyLX4aX72nFrfHv2jnQ3j2rNqd pXUeM9RyXY5qMycw6NiO xRjnO/KsImkg6xcuIThS5ymzWW4xPFN22qZ9DKND92ggMSVUAcqtkq&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.contentdlapplication.com/c?x=t S5cL4qDrIoYDS757FOaCYBSCi1w5tG3Ybmph5xOow=&c=7ZPvapU olWPzkn0vLM6xKBWZl0vYl972UkWpRzVWBUk4kqlSSNiohFvjuxGh/h86WpVRWmhkYctRrbadoDHZUslpVYS XVvvk9n2rEAeGx63LJeQMHQC6Ewi2BdDajm&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockcentralcycle.com/c?x=wnBGKX5d h4F6ml/rY2q4hKJfa/YgUMDEewU5xINufk=&c=rY9Bi8SyUYIfdgTkSali90navBBM3ef ULAs2kqqpCCq9dS28V9sjhV62om Ju Ag6Ja4MYuGCmdQCazBQis/xvKuXh/JBq23c7pxwnIv0Fr7Hdwf6bQYXdpMOoYpcuq&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.contentheadtowers.com/c?x=0uuFBS vrEv3hbFbGnpOYr9Ob7rplrmIHZGspto 8M4=&c=Aw leEFKT20NjepOVHcc6stErG236iGFEL7yMaf n7O bS6XUKosGTFdplmF3o7RbodjHRqTrtUTgI/O/TJ16NSSfX5fOdTj7lIi6QyIFWONrjCakSfXldCJeUm9wR50&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.contentdlapplication.com/c?x=j6kjswePJQ uioh5Bnyw9PPBSnsqm1wLmUcAYxCpKoc=&c=R6FLEEbzP1bZlnslAMrjfU6vd/vQCyCfzkH4pmsUgZX6ifu5WD011AYh5ir6KwHjolhwZmzdj7D8iLpwXAO6RFBPsMQ6sBNLizGqpMbLqu huQVGBIV2K7S BnvlGRxp&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win32/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.