home

firefox-13108-dp.exe

Installer Program

The application firefox-13108-dp.exe, “Installer Program Setup ” has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.stockbundlevaults.com and multiple other hosts.
Product:
Installer Program

Description:
Installer Program Setup

MD5:
0681997229e14f55de772d3080327815

SHA-1:
aefe5d905fc8462bed7f96618afa10609d5e82eb

SHA-256:
64052668362dbce81018610187f1de86c550e6c201df2ccd62173c54f6e4b63b

Scanner detections:
2 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/25/2024 10:52:43 PM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.ADX.gen potentially unwanted application
7.0.302.0

Reason Heuristics
PUP.installCore (M)
16.2.6.10

File size:
945.7 KB (968,391 bytes)

Product version:
1.4

Copyright:
Lite web

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\firefox-13108-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:RFYEp+EdRjyvfsG+AMZgQO1tz18fG90OpGui5f+i8a53:RWxBfwPLOrL91GuiIQ

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 11 URLs.

http://www.stockbundlevaults.com/c?x=oT57fEaF8UNRWivmCmuaKbjNciD5w0v2Osn2QbknlIo=&c=EEb3/KFiFxjFWujgLhtrt0ebzJraPPXksiANqs/LEKoZaZ6GPsmk2lbmulWF2mvwaegJZyoBfx2UgedBMKKv0zLukVBjwiv N6677cLyoJs/47SqeWE SNHYj3ISD5h/&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.repositoryvaultsclear.com/c?x=lY4VBSupqr/9sc/3OprKmzckZj016Ad/2BrKQwZkS0A=&c=q64wbXHgiLQBLh9CfnNBKH4IDaaWmL464iwG 2b klg0kAe2XD/KJRO3qoGrnZCb5ke34BhK4vWRkURIHlNm/RBYzz6dQv8sTRo3bokknS7lylAmz4Eq/tEfwRkOZ BV&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.repositoryvaultsclear.com/c?x=rlaj10FjrWT2tVciMmbhmbD9VX/A3udfpValqRUy8EI=&c=z98uj6reJcPMOrKJg4dzo8scxGJ 0SJVeqKCrirk8rjUkQpWPkHyqcrqNpxqt8//3jQmAblWvgAghRwWk5dz5UxZmk8uhQBhpMnOUtgSN40ANZCeg4QVJJUKRX8TP/AZ&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.giftchuckletour.com/c?x=YLYB9ilxQ5kV1U5NhvgGTk4/MP8 XHe3d00DOIRO74I=&c=k6BrIyniSL7CMZNkCTppUchU yGddma77lGXMLBIEgV9TYcIQYvPMCFOfUz6/bjS88U/W0EuZl7d1MzY/nhGq8BwDQ3DIIEZvTNLjlC1Dj/WBQ6uVn7t0QVRH7VcbR2i&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockbundlevaults.com/c?x=vw92pSTIbDtkqzwVR2b06m DK w7eR3NYaxILMl31Oc=&c=SUyL2CETQmgHY7BngL678AEORyJpk8LbBw8mu2ZOSspeWrZxlLra3H6OtJvCGB Lsm UKOYtnG36AnTQaakqpk1sBsSp fHQXn5W8naYgIroWFHW8gkC0z3I0FlX0 5F&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockbundlevaults.com/c?x=UuI/KhZQLU/KRtno2cAbVZeSFcAbPDfGi651kEOLz/k=&c=I02N2p1d5wFFip9D/ KIUA7M xQ5BxBNdRB9FMq0hsOugaOScvcbsFND6Wdnk3Kr9FZlO0f5hisCt2Eh8392N8cPAk1rTWGy3AgGZKP4x0842mpQdVJQsdCrOVtdYrA8&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.giftchuckletour.com/c?x=9I9J cwTWRD5ZJZaAHQVkp3L6F0nXSh9F5qeaDnqrIM=&c=64bs6kZC5fX/ZRBaCm6sALweypprXOj94qOxcBwKUmDlEjyTQQ2ZeU4jOOAs9W8rOhTzEhWh73FrbCU72y/yqMgGrjTxRA6/7iWj5alv5sBB qfXIDbBKGSxkoe3M0D5&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockbundlevaults.com/c?x=MDI/huycql0dLiY4rlWmK55oHuOn0462guRhl9NxCAs=&c=BqYaWkpa q0INg1N2wlp6n24D7i0OhIgT8zjcjVVUjAUtOhGxAGRtqpTotgVxFAcVlQlhdju2csCcUfC P1Qnl55xwxahCoFN6P/MIHItQLqpOo3ymnGGgQvNO7f2zYO&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.stockbundlevaults.com/c?x=Wck/w44bobQtNB/eRjNwbNdn/UkA9TxmZw9S6i3L8RY=&c=fmfOAdnHrl8SwUA8D79ACK2HRaQwLnXPXIiHgi9Z3ebvx0fllP0ikX IMz11NjIVI5T3e4YrzIVDVY4/CXWoFilLz0R/B8XY0AiS0yFRNYx/BlLjY0qj5R3dQsfLdEzy&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.downloadstowersupdate.com/c?x=1HtPawGQFyO8MoqnI8C03O5oDWrr36J8R3NX4UaiJ/c=&c=7atR 3vTS6/rVLnS2pWCta6s1w32oLSirFq1 N1j7uZ7/PbtqWS0MjfQloY IEDVmrtDW96a61tVsDSRTI0eDEkuC08xKUk8qIvKekAPn28eNnWz8aruL/3de6i6zZDF&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.downloadstowersupdate.com/c?x=6FDzM9mWNbUYkbXtpi7KOi3mFGC0Bdn3q1lLAMchnqA=&c=CcdN5h5JLTrLo823cu73XRif7Na8nbhqWjg8xMFJS3d9HvcNGm7C3GN6pN5qqpS HAF7QLTeRmzTByDykvlxpBjsupSe33Kqj1EXe4fi0kpi iXH1tXTmXvhqs8yTP A&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/44.0/win64/.../Firefox Setup 44.0.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.