home

firefox-13108-dp.exe

Fuloli

The application firefox-13108-dp.exe, “Fuloli Setup ” has been detected as a potentially unwanted program by 3 anti-malware scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.presentconecptquick.com and multiple other hosts.
Product:
Fuloli

Description:
Fuloli Setup

Version:
3.7.5.3

MD5:
db03d10e7130400b8ea2b515ba08692a

SHA-1:
c23b8249d9242fe5cc19e4558b141245c8e10c8c

SHA-256:
9e998d4bed50ad1d9317edcd44e5f7e1e3db021544963e67cd8743af95cdbf1d

Scanner detections:
3 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/16/2024 8:51:46 AM UTC  (today)

Scan engine
Detection
Engine version

ESET NOD32
Win32/InstallCore.ACP.gen potentially unwanted application
8.0.319.0

Kaspersky
not-a-virus:Downloader.Win32.InstallMonster
15.0.0.562

Reason Heuristics
PUP.InstallCore.EST (M)
16.4.8.7

File size:
1009.8 KB (1,034,012 bytes)

Product version:
3.4.7

Copyright:
program

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\Documents and Settings\{user}\Local settings\temporary internet files\content.ie5\{random}\firefox-13108-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:XVeBVr2cg+4cKC32P97f7LQwdzmlQ5CvY8llApF6q4KmOuzN5T4:XAyk4XtDUwvAllALYOoN5c

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 9 URLs.

http://www.presentconecptquick.com/c?x=BlsQZqEAVw1temVoGjH7qMfoWFhUNmj5p9aXFnW5M1Y=&c=qwxZY3oE17GlhaSxd/aFl5kquBQ53tMR7PyufQS8KdBXzt1ya8RvqFEgqVMWDEJHk65/eXUVLSqal799 f8r9SLD40wcMRMJfGFKbqJMCptj4p4/aC9A9gVXtkVRwfj4&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentconecptquick.com/c?x=Sdpr9PFGdwB3Eqtk1pYM0X 0Z1CvSpR02IUv8 1R6NA=&c=uMgeCAHVdLykiMGGSn66z7alnVUXbSjfbqrPjwoMnDWtoHA 7AY1Gg8/HMZYwA0GarTy4QJFDx3WqqdCOrN3Vz4H NWUiPaibOvJ5j45aS 0qzO7y/evrJuwpx RnvhB&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentconecptquick.com/c?x=aEtvQaOn XBIUUul0/ psy3g/zEJxN siBOdFfywBlo=&c=NGyyj7lPqkDp3zxlFmKaWY3SMR34FeM1V8NY8ClIKsqVdLYHSJf5 WUUnBsc2JARgFGp7jJHXX6E0NwEWnvWXEw4N6EXONT3aeBr7lRQkE0unGaggXGsIWXRCEsUajTz&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.hostingfunchuckle.com/c?x=zxrDxnbdAMVXn8q zHj70DvmHR4QTTXRx F/vlw9Z2M=&c=Q6/AZr/Et1aPb2fvE9/tXN CDqfLwFCyFqG2n0Xb4bIehNZZn JAXbiyFs1uP7THgFFN7FYXtUluoo/aX3ou7O8ORF0Ql5wJYBzUWN3EV50ZBjr/WB8N upiBbaEKkhN&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.giftflashpresent.com/c?x=6xhXpnFlVlsZ RtZXDPO sSIJRDDYbkpuCslTgm9awo=&c=/rgIAg/Ga3xri /JZPoIeJ1Wn43e/utObl7jUgQJ8AsrKhClw6FZRcwaAvXC3IGzKKX9dzKJO45r6/O63YaD13gV3RQP9vsZmJH4CK1KZksD8J8ubSuW1MnLg9cxh3wV&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.capitallaboratorysoftware.com/c?x=zhb6VEvhtZf9CdfaAG//OuRzmynDOsdhEqi2sJ0l5vc=&c=xQppDpBA1mHqpSca7ngS78ToWc3QEewsiXXCZUb Wu4HNGfNAl uRppBWjK06 6effkevla1DWpE/J8UbHDD9 jsFINpm53CoC7V17QAxAra7WU4xpasPfaz9qTgy9KI&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.hostingfunchuckle.com/c?x=ntdJcXsJbR69OGZ4BQ4Ik9DX 6GCrU6J2TaAGQTOkEo=&c=nDd3EqNx6LZ/g1pl9g77pSHd8F7IwtCujCuh4iihBP R2JX4Qf4Z3J4kiaMQepun7AFhbiiT2yZYb76BKVEouvHQSAiF5rFWCODZEaiCVdkDyv 0h5LH1mQ6LLJ7uVP &fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentconecptquick.com/c?x=7tOoGBAyKYNLeExRpMOV pk1ZRa/xwppZSPbX6J83mk=&c=Y6kX35k98I5zGWnMCIvV/PVajH5A2otDQZaASopEfUgIQ8vvi3AD7He5CLHcN85ZjyN8j62XEdVA6/x0GbJkNF2ndn2jXNU3/DnTOdkxcH77GgR9PVu c9K5Pi/2lR25&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.presentconecptquick.com/c?x=BRI43yxbxi2xVGDl19k49hL2RIX1ASfl5AcU2wO0Ef8=&c=ZTM/ekVMAQghcLRJjleIbRlkWMTT9Lnj0me0Mu8jiZcPzaKtpLacZBD/tSqhQRpEWcqB99l hhPN CUCN7p1our9Cz9488CTB/XZM kHWWU1mwA3PdncTVX3yOg1i3Rv&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0.1/win32/.../Firefox Setup 45.0.1.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.