home

firefox-13108-dp.exe

Fas

Docesipete

The application firefox-13108-dp.exe, “Fas Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Publisher:
Docesipete

Product:
Fas

Description:
Fas Setup

Version:
4.5.4.0

MD5:
9945700de9a805000ffdab756eb98503

SHA-1:
307c0aebef474654d53ac11c4d6c3a60791cc935

SHA-256:
051f4ab9d9700bddafc2240d4b5606d92b201d78cd78bada672eeaab11c00636

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/16/2024 2:47:31 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.11 (M)
16.2.29.17

File size:
1.1 MB (1,112,881 bytes)

Product version:
1.5

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\firefox-13108-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:RRdMs9NnAHY4gDGedk9OA/G+J6bOBZJfWSNSFKFW4wefTE:Rb5jAHGGedkYA1T4KFW4wgE

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 15 URLs.

http://www.giftcontenttown.com/c?x=cptbOQ9XPKp7PCTKGorNxOEzdExjYFeQnI0KIdP//0g=&c=LXLnwfuxM pvGc/5SP4sBNuQ6jcOXISx4cTWjUzLFIzXBTBq8Bk5RfUJAfh 3zmJH8kP0J2CIY8trW7 uWaAsq3DylT6iaQ6QxKeiD1VkwE7nRfOeZi20TlkGJLYf21N&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentapplicationranch.com/c?x=LOKMyj22/SQGcyCwaU0hkUXYfaFPSuD8N gFuWy3cBM=&c=PlGWs8v/uTGysKSFkour2d4YN1nsya3RoU ghtS9wdMRu1TBOxVvVyKSqlNNutomaZZfmshNuO1Ukfpcu96w6hrKBT07IP38py5V o3D5jJ6C2F4qkW/3WTpzRojwv3R&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.towerbundlenow.com/c?x=CCc7CIIg0CJDLQFkI82/41PCLJNuoSkSd5sCL7qSM4k=&c=zVLL783sgro5IFApUdJygNWH4fPJPHaA43UwT9u9KaSXcJfdM29ewhePtWCgU5wkyCTfKMfqo7hYyYnoXZ2YnNueictvVgEpadMBn917AyzSjYoZYwEXSFDeSGBPpP73&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.giftcontenttown.com/c?x=WU1Ox0LweB7rZe8ZeK0b3DBimUbMQm8gu8Ndzrg771U=&c=yHQd0HTvInUhkBgMo04WJ0soQ0JlHqWIFchgyDsUCZzQhpdOnpSMw9usar39MnGTTff7PAsKQXbWLluI37P 19S1nrdDlw4 /0aHZ3Fo7KVKij1JM7eOt8B3yQrsa2eG&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.newmegatowers.com/c?x=SFXdzQ7Tx3haznBlbvrRmZ9mOlvYGUBUvKBpqNp78FI=&c=Nc2nCeVJTbaF7UD32 Jq4SIYLaIFm 4NuQLUMTGtJyyuLXGdhhPP7QYZllCZRXEiRmN96ZafKF5r/a63klr26g1bWWQwf w9J4B4mxwy0gEKNRFFYsgSjClrwOmkOY/w&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.townfilesdownload.com/c?x=A8Zan4 Z2KVGtI59GZQ0XWENo3TOcKBdQ32QF eR do=&c=rUmSNPiJikvL5zkO3/iugVxOQiA2lM6W57KBcCXKfoqtxYxVAnT0V1tDVrWOf76WtbtAOR/YXtsHL44fUs4oDtrj4zd1bNldgy fccEjW2xJt392bBCbxUV7cqUCkWFx&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentapplicationranch.com/c?x=Nqv2skR9Vm7QOKVnWJhaRt5z8lOHROMxuMSNdbUMNoo=&c=qaVH3h14KtcopSOic3k08XaJuT34m6W5EeNdKTXM1oa/C0jkUtBEqiG/0y3We0OXsS 4NzTzx30Y jBt d45BCDcM0k2PR1kpPs/tqhxtfz8MxZbE nBYSxoKl paBAl&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentsafetown.com/c?x=xdOtDIaX8KvlnpB/Z TEBce2EzPGYsQKOy2G31ILNzI=&c=C9Qs4CgMk4wSV3JlWPmKco0fUJ6e4z7ipCvutlumzxqGRPSA s3seb7ZHZ2tVxEuBn70rAcrEESpfGRjBPrIZcottKfMhWm3gibtBr9ioeEvbsA OiRNbFB6G9JWwB2K&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.hostingconecptbundle.com/c?x=NgQBb31n9ZgKESYcEBP8u/hzWCf0SOpyzWJtqeurIbg=&c=zzqSyAwM0nTyQY WUTUUJiRVIFegCzKb2VMDNxChK6hUA8WcQKQfM7ELSfa8vYEPFZmQjM 4VvRb5cDpvXX61HWw9eW81IIbQBX8TquBXC4XuGGO43/XphwH3PtMJnl&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.universecentersigns.com/c?x=fA4FXXdkH5ozFVilyKUcQPJJO3iFzvfMTMaINABVuBg=&c=zaJY/MoDkfk5BvJoCRQOCrrgRpNybko5H1ncJA6gM96lj8JNZzxx73FlltcPVZS9pvrqNKRMpmazZd0 VZW1zM5X010PAI7YHGsb6d4GfXx HPTvn9BDINRoFG2IaWUG&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.towerbundlenow.com/c?x=6VZtgBB/y J4lUDw91wIH0yyE7bGddZi1SPhHVoBSTo=&c=0jhpIHnTVeQU4j8z3GD0MCbUfHDsCB9rTGso6KgYykrgr e2d0AUH98KGHJmD7vZgRQmIP3g31 ywxtTljwzUN6FzQP3atpZzwvjxBUCnQ6jeWdJND3resAW24ZqpUHe&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.giftcontenttown.com/c?x=jZhcCl9tLCr7AV/uvL0BjcInofPuGM5Qp72P/mO0SOg=&c=qpLUcXtArDJ2It0TTKA/KJNHpmSgkFp1XRBwwDvDN84sTPUik8WHJRRbBaQ4stBPwufM9ME6kPPG7FsTM/UwfSQjXgOA 0xe/3iyXhtKeOX31t9Lf8z6cuX/itQcW0Wm&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.vaultfarmbits.com/c?x=hJJoKfljYdlMvEvcaBAsNbfNsjvlOlv5LkHIvjBGv9c=&c=u/iP4EZi6Vh 6eiEoadaHLxqFm0ibLyrT6oWf4gqpqFEUU64/sNlMcd/nq2kfwBJMDEzijXlcO7W0cUd3GZkCn6jWb0jvDAzYT2EQKb7sMqoAUcEfNnlwinGDVsH3HOe&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.universecentersigns.com/c?x=A8RyNZ/zOH5wdDAl8iDHYv5lhy4Op7WCS4rGsxu6xL0=&c=G75WaKLVHzcY/fJrzUC6V CMLHncKSRGb/9vD3uwwPXPRU41wXJWLMyJ9RebsFlAELAoGqmgmN/hvBgWeQAu506QRWLw5WX1swL3ih3Vg40n mPq4Tk1q/gOzpuBldNo&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

http://www.conceptsmetatag.com/c?x=8ZYcJi2ndsjjHZuJF1uki5fJ5QAZs0y1VmTZlkMEDZY=&c=OS4XbSuIwZoVS2Nn99rk3YzB/V9gRs45UsaURPWq/0uaI4Hh493FKbm5rQwGwFnjrdAsLr58ot2RWHchO8uLGxqnbriL3GcPgOuE/8z0QfAAPStVgmjjo9Mlkj/VGE i&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0.2/win64/.../Firefox Setup 44.0.2.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.