home

firefox-13108-dp.exe

Installer application

dobreprogramy sp. z o.o.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox-13108-dp.exe, “Installer application Setup ” by dobreprogramy sp. z o.o has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Installer Soft Program   (signed by dobreprogramy sp. z o.o.)

Product:
Installer application

Description:
Installer application Setup

Version:
4.6.4.0

MD5:
6c311838531dff3ea80b852440f6ea43

SHA-1:
d3855548803105c701f51558a708f83e58099009

SHA-256:
7c1cf4ff249a3d0d215b4d4144dec8f09cc5c0d3456189d456170b42c8ae2ce3

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/24/2024 2:43:59 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.dobreprogramyspzoo.Installer (M)
16.2.13.12

File size:
939.6 KB (962,128 bytes)

Product version:
1.1

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox-13108-dp.exe

Digital Signature
Signed by:
dobreprogramy sp. z o.o.

Authority:
GlobalSign nv-sa

Valid from:
2/13/2015 5:34:27 PM

Valid to:
2/14/2016 5:34:27 PM

Subject:
CN=dobreprogramy sp. z o.o., O=dobreprogramy sp. z o.o., L=Wroclaw, C=PL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121B4F3A4313F8A58B614202F80129EBC93

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:SK0MnOP4OXqwVfMacL/BLLpQ/VWVSiPmBuJFTs9QOY4I:S1mOuacL/VLh/PmBuDTslE

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 2 URLs.

http://www.towercapitalcenter.com/c?x=xiKOmsxTVnS7bo0VbkctRxVxYd fYZPSAwoDMmugGoA=&c=8kS5PS/7zcwYPajX77L9X8NgJeMbG1NH2WbM2wkNUnJ1N09beBaz3TOd0G3XkZTjhPFYxGltzC2poaiGRwAYTPNsX6E1zHZG1XwIMzoJR Fpl7Rpb34gLNo/Fm9LwlqFmYlBaI6cteEwMxx0mDV6Uw==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.1/win64/.../Firefox Setup 43.0.1.exe&downloadAs=Firefox-13108-dp.exe

http://www.softwareworldapplication.com/c?x=GOwV8ZNceqwuI8BAL8dspdBLaT frCBlSWWQilMboBc=&c=WXWP4XArHsrtmnxkGTHpT3uMD87XCXzQxETTX7uUqvtp8VkYfuszsHWdqHw0ocRkGNuO7IElyKzkPgjfDbXV8 sBF0A6S1j0zuURRdiF2h1P013ql5uaFve5O9p2NxAT24JMzrE CUKLpqe6Q9RU3g==&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/43.0.1/win64/.../Firefox Setup 43.0.1.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.