home

firefox-13108-dp.exe

Internet

dobreprogramy sp. z o.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox-13108-dp.exe, “Internet Setup ” by dobreprogramy sp. z o.o has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Installer   (signed by dobreprogramy sp. z o.o.)

Product:
Internet

Description:
Internet Setup

Version:
2.8.5.0

MD5:
27e64c4f94dfd66c7bc658da26f26ecf

SHA-1:
6d6ae615e1a86fb57bd4a1673a47af77040c8124

SHA-256:
7427f26d3b9b9d97a73fadaba287f3e095b4a6a13040e0261f6bf723249234f3

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/26/2024 12:28:58 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M)
16.2.10.5

File size:
907.5 KB (929,240 bytes)

Product version:
2.1.3

Copyright:
Soft

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox-13108-dp.exe

Digital Signature
Signed by:
dobreprogramy sp. z o.o.

Authority:
GlobalSign nv-sa

Valid from:
2/13/2015 5:34:27 PM

Valid to:
2/14/2016 5:34:27 PM

Subject:
CN=dobreprogramy sp. z o.o., O=dobreprogramy sp. z o.o., L=Wroclaw, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B4F3A4313F8A58B614202F80129EBC93

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:yyU2cnZRSHYp9oaAqe6G0Zw6y7ng56ALMVIU1/GXuDX:yt9SHY35eQC6yzvVl

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 6 URLs.

http://www.completepackagehood.com/c?x=neAWd9pYXgji/aTwiCKdoGZvPNGqXehaFddAnshJ6uk=&c=q0Nc/L8c4HFU6oAE1vLoejQjUl4Dk/OJ6HlKlklTAdxISpw/3y09gHB1lveBWMOMsF3NP6nu4rmT8RAyLe6ItIbaOeFZLRz8Nx4TvWhak6Bbc2LLipQVxqpsw8hyJLbz3P2B0MwVhLetrG9CqKaK9USdsTdCH5ApN0JeSdmcLyI=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/41.0.1/win32/.../Firefox Setup 41.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.completepackagehood.com/c?x=conU1e8gsGaELusc7cC/yFGleZ9av50CM7WajcTqtGM=&c=SgZQx iTpUKENK/MsTv3mXSTLC43y7JXelqQeLnFlqLwWLR8qKSITGzz6cO9cehTccXFBnXuMTCg3RQmaR9iwRQkAZAhQ0kn9DcREddp8YPeOxy8zTuFrIt7avxoN5gGWTEobdrw5GNjmL1/6X u5MJelD15GtItoDWRxA4lGeY=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/41.0.1/win32/.../Firefox Setup 41.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.completepackagehood.com/c?x=E9h bFdiTEBZD0yfgbjLJE1LANbOz/KFLEWCmDrwL2E=&c=as2myNhu8pp3EEv3DIZ58s0iRFwJuxYet3LYjJnosc6JdXbRZ8xrkyP4EdM1BOzYZ0OuOj5QAl4U/cSnCN5gkXK/GL4OJWLm0i jv8J1GdnM7c2dn/Gh0sO3QObie/r/Iv8qigKO3fr VRuvJiAV/ztRKnLb8RxmtWI7jORQUUk=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/41.0.1/win32/.../Firefox Setup 41.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.completepackagehood.com/c?x=MUKK2SV1OItF YUolAOAldZDPR/rQLWkvHRkoT9e7IU=&c=I/T4KWMoe3Sy3XUf33L3dj8NRlCQgzZQFyEa4ykU4UQKQkrBQAUX4T2DhU9u7b1a5WepDdKeXhfrMiWNvE2pLVuJhlSJI1AwgRGgZIRyQkrjoJ26U5tmF01Z/LiUZmz2yQx1IfsRfN/npeAh9lfImWot4wGdMPN/SD/v5gXiY0Y=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/41.0.1/win32/.../Firefox Setup 41.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.completepackagehood.com/c?x=ugEYOu76DjQufMTw45b9CYFWSsq4smmT/8uJSw3yNeE=&c=8nwvvj7tTYBvRdQ3kqiTzjlYhGZg6gb6vehbgrswqFkpel1 prEgQ4CsiPv8YKWfuEvRoiBpONeJO7O7D8Fi9UsWg3p2ijmDQINKTdjqhV/9h0vKDb6X uKGnYx/Q4duTAxpM3hyRhYSF97rcCPk76plGIWvAdTM5tYLKyJqIzs=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/41.0.1/win32/.../Firefox Setup 41.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.completepackagehood.com/c?x=nqreP/1bE4TW98UWglLWdMBpekD1wnSHwG7Uh n9P6g=&c=gquOjG0Lhwwj ZUvGdF2sqz Wes94yXoAyRKyvN1OwYV3zW5z/xNVlYVqyrVssaaiKFfHsk GzUltOiXTu2p1oH7MazIso/BihTtAkieP/3UxYC1ey8Eq6hGd/kb/0Y1K3gN6Wz2yAlXKtoYIf7eCoPX7vE3m7wvLGsMxLQpEcE=&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/41.0.1/win32/.../Firefox Setup 41.0.1.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.