home

firefox-13108-dp.exe

Generic

dobreprogramy sp. z o.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox-13108-dp.exe, “Generic Setup ” by dobreprogramy sp. z o.o has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Prog soft   (signed by dobreprogramy sp. z o.o.)

Product:
Generic

Description:
Generic Setup

MD5:
52a7f3da26f3f787299186c50a0fce2b

SHA-1:
1bc3480769580e8c206084f41def48688f21fdc5

SHA-256:
25f7f2c46267719cd59643cad62a1e8cf2f5ca1f0c5265d423ff2a8b7983b0a3

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/23/2024 8:03:40 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M)
16.2.9.20

File size:
936 KB (958,448 bytes)

Product version:
5.8.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\firefox-13108-dp.exe

Digital Signature
Signed by:
dobreprogramy sp. z o.o.

Authority:
GlobalSign nv-sa

Valid from:
2/13/2015 5:34:27 PM

Valid to:
2/14/2016 5:34:27 PM

Subject:
CN=dobreprogramy sp. z o.o., O=dobreprogramy sp. z o.o., L=Wroclaw, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B4F3A4313F8A58B614202F80129EBC93

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:cBbOZ5PxVddjvxCddEm7vXTXtDRPzC3D02Fic9z4xmakfQ+It:cBCZ5PxV/44KzlRLCz0m914XkfW

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 6 URLs.

http://www.vaultscontentcity.com/c?x=EmTxIvpk40cT1rhYEp1fWuY2ORrgb5UmenHzdFQlOmQ=&c=t6fg5eXDauCwZbwafqBaoiQPBEKBlDgeK Qzcr0wMXALqAjOs7zZqqd3yr2/uG1M4g 0UFSXZcUBQrj7i4bjw4IAmeMGwnqKB91XkGp612DoNoIkZ0fh8h0AFf7l5qh4yFxO0/hhjknr2XsWBbcmZA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.vaultscontentcity.com/c?x=g5e2qq6rE0SB7kUOFoX8K8uObvIMiQFaSo0Yse0F7qs=&c=Y5VYgkimq/J8wpy4qQVJZpW9OSSNshcyUOnytnWHspbsmwia/sLoEd8UmsQLd4J6rv4/mvLsKb2f4eSKzo5onBqPBZ2rxN1AXcfrSg 9 3aDmtMiVr78P7DCmOk AMv2vNERsLpsJZzw owaLNh5UA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.hostquicksoftware.com/c?x=5vEgaM3GYUAU6JAH2fwZeIsG0jH9zxBQo4aMJP4IFP8=&c=zr8bmV5cxlit4nSh57aeUyyCp8YNzZZl/mqQh cTitAWGxm4VWeEXJMsPw6C3pS/QJkp0HAUKrTB2BvM3wbzHpIhH9/s49pSvEbw 6k GJwdUbB3y6GnaFQ3Ikh WWRf28kDpjDBIQAJxmaFjaeIEA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.tagvaultsclean.com/c?x=gd8vwhKvjY60MRp du/98r1uxbyrVgX1xXv2XfHN9pk=&c=eV9sAtp7vtQ1J0IrxFvF04/BELWjvnH0u8XtIbgFNN2m/zp2L5vm8ASsZZmuOXBNyA2M2rB8wZVdRP20AYmXGBHVNnaBIYUd4bHwQxVu4ZCbsbtswtpLGC0pCSAEjWwZabDTenjnzmb 3sz6jZGByA==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.bundlebestcenter.com/c?x=EKOMq26orYFXhrhmAJpfydWZ5Gwdj9B14JSk1B5c/zA=&c=ynWGNZkYfzRRVx9HNGcOcwFTkXLZUIFtqHO0TRj07ti8J7g69FsUV0qgLjVA3BY64rN6Hn6O9N2i6nA5kHkiR eID2EI3Xeeq3YmGVgcv6gRINCOcBUlI8I5z6f1RDqGP38dlAPyMbuc5f4AFn/OYQ==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.vaultsrepositorydl.com/c?x=TPUZKAbx7QvLywqBW0n9zzzaf5gvUcBcmXetE3xZaZM=&c=9xa3gm1vlZ9lsRCHylw5Xj1gUvKkxeZf3BcmSbrmqBEudiA2ggaoKuRZiZOfcc5pls3ncIVX6pmW9R/8MIHSHbCoKiBC1lDDrHKgLHltXC6 PIknw V9CmrI1y0zNo04Bgh51xEr8Ppg5HmN66496Q==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/42.0/win64/.../Firefox Setup 42.0.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.