home

firefox-13108-dp.exe

Pofecas

Funnel Quality (Alpha Criteria Ltd.)

The application firefox-13108-dp.exe, “Pofecas Setup ” by Funnel Quality (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Funnel Quality (Alpha Criteria Ltd.)  (signed and verified)

Product:
Pofecas

Description:
Pofecas Setup

MD5:
627139abeff33f3e81203fa3a7e96149

SHA-1:
2191ef97c0314ea33e3d75d3639d4a501ad89d78

SHA-256:
e99529ef505ed8c0380eea1868f225639413f211b7b94363c8f66a6deca1deb1

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 12:44:50 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.6.28.15

File size:
958.4 KB (981,392 bytes)

Product version:
5.2

Copyright:
Stub

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Digital Signature
Signed by:
Funnel Quality (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/7/2016 10:35:36 AM

Valid to:
8/3/2016 3:44:04 PM

Subject:
CN=Funnel Quality (Alpha Criteria Ltd.), O=Funnel Quality (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E6C9E138C2956FEB458B5B444F447890

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:3O7llHcZYwySG9c+bYoLXOM2x9zEtDe2laiC6HnNbvDDyp7D:3OZVcZ2SGWEeM2v8C24yHndDDyB

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 13 URLs.

http://www.giftdeliveryfun.com/c?x=GgPfAjhh4ibiXZgJmlWUOtfO1dUou5JkHDsrJMSyi2c=&c=iw5IrYMVA plObtB 40jVcO2KljKN90GQQ2T78feFpKVug0JtCXJNPG96vFjvWV50aU6OyBlmwOFae4odb1SJp0Lu7eTvVujKm6J3yJk2vhgsQ9qACpVuaEnRtxOfLW8&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.taggrabtoday.com/c?x=AmAcShuA0960jna2hqpG7Mbk6AjJVUMikGhoB FWMwA=&c=7FK88Wl8oIhW9whoRxFoZlgQ2TKr6UeUcFSbS1FLyanrcqrBfU/OLeBq/nkP8fgcV31iKHTNWPcnrV2s u2rwA36IaEddutI2jZe/Koar/9FGAaiApU4YjcUgFaL8eEK&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.todayconecptgrab.com/c?x=OzvWT043MlD EPqfM428uwnwKkc7aalvjDXVX/l8woA=&c=OZvEwZxkqSTxyA/W x9QpaDzxqiBTVsE7DhbB7RToyqO6AUedMzAuvVgqpleuhSnB0q9iJ8kZUBBRB/qQfkJaG oIIuX4we2dl948Jn0/c2Q79PxbrL GNZ1hKnYfQGA&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.safecityclear.com/c?x=T/NhGxPF01Dk1H94xwbB1J1QWmsmthMb 358V1LOr4Q=&c=peAgNPK5YlCdIMxRvch3F94TuAPQA8E1/GUC84dvmlN9tKhG0PRsgYjH4SZ2QAgDi2E/ziDTrowuhv0klP o3nG7ZiqQfk632yvPy6CUUMeT/oeC9qFf5r7PSyusVXP1&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.funsafebulk.com/c?x=xIULzdWOJljP70e29MXjYwUtZlkGPUeSgneYskKpIhQ=&c=gJPgsRkLeSYCc4MvbI4pFVqj26vlYxH7FeEjax2xSQnEl0GYXJCgkfqiSYGxstcyYp1ZVIIWD2KD Tyyl9e ZjCdhd98E eKmB1oJ7XtdSLuo69Bj 0YcDNjcnMi8G3R&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.cyclevaultranch.com/c?x=jqC83Vxx2xPAmvtHL/roXVG9crfEIthqftlB2WEbt2Y=&c=jShgdYAHMuQ7p9pcjLFDXjLsc3eMFiLZZdK6tRAlCQIS2f1AIPMTUI LDGykdABSSak6R GsfSQLlBfSSafwHhg1FTsLeKfW6vDRX3jWsNGVlmdmD2GwDtwV0opnDHoF&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.taggrabtoday.com/c?x=qqGOu0q8JeOfJcXHAAcuK/IxyzhQTIP0yhkHqHElhYs=&c=AxoWDAVrtUa1p1NcoM985nqkpwgoxuEIqYZrh1ChCCiCIBuV MsqjIm9drE0ShX6LNNEPd6rUkujkOVe33s2MaEGGVvEhD3BcX aE3pyc0RR7GdlGbtoiNdZTY6Sygw2&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.funsafebulk.com/c?x=atsuRG48EO6BS6ShThnt02yW3MRxFQBl7Lh3hPERKpU=&c=VCf4ZbRo3LRdJIaYIZoGHVIvo20uAObqqmVMZAYXQ2Ks1y pEfjvpQsh/N7AK oPaDSXrO2DQJLAoMoxHNEAcCJm83uhZAblVvo3QQDkEMqny5 S3DiVO3oyMB/mmMHb&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.headheartcenter.com/c?x=SIc1UQ3uXjdmzJ5lQsnr132RKQ0caC2dmcJjn1akegE=&c=lxt1rTPonoGaf2AMUlNxUcr3F5O9CCffMMH5TIyhWhL9bq S8s6xgmv7Rb2isF2IfCL9jy2vflhd3rZBKrofRuEOuSBwmn6mfYcVKQdKcqJ 78v6oFNDAN6zI9Ku1O48&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.safecentralgift.com/c?x=Ka PDLODip7zzEnqDmmnCCV6LyoJYvnxe9qw9nQQlQs=&c=CBxuD9OjwOQn2f631NUk7rRDAlW9aLnreQmVny7vfFBeiab4Hx67oQEjeKjtIIpcFY1RvDdrFgfxw/oS3 zK2qmnOZF/b86yF67krTYjYQTb5ebTLPFXJ8XlPpXXYL21&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.safecentralgift.com/c?x=bplQb 6kJxXUOCSjFUPGPX0e01UBMZA5YH3YQDsqmhU=&c=jm1ohNPWjN/4qWaYCGodhjJtUdQJE0jL4DrHQ/F6u3GORqUYl6wItSIkhxFnjIUNutExKgIl5RaBSeuLppTpJGEJ159QSFC53/h/nYFh9TNDmLDiOYZsyklDgrOoKfNm&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.headbundletown.com/c?x=KKGFPv3/rqjX9BmVeDkYqxWjXi0dyeGUG6MBG4nYxwQ=&c=UVF5c5n/EQq1t3jYCJNk6yNxvUTOC jJXrVbIWXQLRmEwOuwKXSo6od1rtljt2Ji7EeeXx7WQ1EH12X6XyTbv3EldW7RB3A4Bm0XN1FeQ bCX2kjoj0xyQEdfr3DLqSV&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.signfunpackage.com/c?x=fwiszt5L U DuizTdlBT/3ZKwfCU3SuQd88 F10IksI=&c=Eor5yDsu88vaNY0VFOX3Ylsk b/9c3xPOg8L1NhpvyVjeeSpW5c06kdNVYXfKUo43JWxOSeq27StgirDFB78q4h6MBrHYNS/IkQBzMhhRuR90GxlP6J54rSJM/UjpdG0&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/47.0.1/win32/.../Firefox Setup 47.0.1.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.