home

firefox-13108-dp.exe

Mape

The application firefox-13108-dp.exe, “Mape Setup ” has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions.
Product:
Mape

Description:
Mape Setup

Version:
1.5.1.2

MD5:
a3cd4896c2a3122c46ed36e1f0034d7a

SHA-1:
de0e96b6bfecd4c8ddc8c13673e4a47cfcaf00b5

SHA-256:
98d1e94b63c62bed788fab9174c5389392861a8be673184ff60ba6a87cb8b733

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
11/15/2024 5:48:47 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.RE11 (M)
16.3.8.22

File size:
1000.2 KB (1,024,183 bytes)

Product version:
2.4.4

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\firefox-13108-dp.exe

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:/j1Xs3WXbgHotXnffGK8JcukYVqVGKCPd6djTaJfMNOK/EW9wT9j5jd4Pjszk67:/p8mkHotXffrKG9gKhHaJf0B8bT9djdt

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox-13108-dp.exe has been seen being distributed by the following 7 URLs.

http://www.hostingconecptbundle.com/c?x=jMdmgGeT2eoZjYWGvzYVufIb8kevvI2sx QlRrbdeBQ=&c=TnGndakY/0ZsnQhBOQLiKXte/knvnKHyRheT6UvkKkH933JmSP16RVxawXGDTAfEvC4XcksKGZUzTnNDpslAO8Y8jnuUwxZbZG3/C1YvRN40BS//aslVIfJ1JmuzJ4BH&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.metagifttoday.com/c?x=i7bj1IB9ljF3Dz3omjCtPPONTSvS6ftmgT4jm6oOtCs=&c=rm13b869KzUELFAbx/PwVxIWHyjBQkr4UEvWsarBjmIlxa8wfjqgVWydgX3TDeK4A4d4w8trD Bko7Eu8AXXQFPJyFRTTNhco3fiTNbrclxrMRXiO99QHeh/MzuWZgei&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.headhostgrab.com/c?x=kc8sh6yEibmR1M1PQCJ6 4Pht/LNti6CRkbxt2BbAfo=&c=3QPtf50SzJ9fzmg0lAPkMhUAW0R6Kja/F4 VA8GAfkcM6loMPJTPPHw0tX5zmWgS2QY0ff0jEVs2z5WEeKqGm7oUrAx9ctp1sDtwF4GZnzFDHTnpK4hSt QLmDTQAHs7&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.currentbodycentral.com/c?x=HVcZfopAHSKIsMLyiFyaUCKCNYzYUr3u5al2cGGUNrM=&c=NB0vXzCpXTnQZ/QietK0sMpKkuhr5dGe3lNhBYYR9lz029BHSfqNBuG6JpbctmwLWKDVm/CARO8Huww0tGyT05IjyiDMG/zuCyTcx17IyuRA8s2xLcHSVg2ohmiRttkt&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.currentbodycentral.com/c?x=RWjQHEkDENgPxOZNqebqK 7aTk VEboY79vYt2n98H8=&c=MQHkuiFoWmD2Li LAzGy2jKcCS3FfvQX823q/25ovRTXVicf4xUImh47e9zMUrc7biZX5z0I5WB NcWzDdzz3OS7pVass5/l4riOEzh5jKYpStYzji WOEGID3TRXy4n&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.vaultsdownloadupdate.com/c?x=6N7irHj3nXCPsXZQTT40W/baZEzecF0JZWoaMx0zpXE=&c=rrcwdiv9ME1AkiApmFYyrmgwD4YL47dLZv1tmkpte2WHOfO49uWxg5MFT5Clvm3wsxeRpCb1Fz9sRFlGxy 64WLjwp3V23SRBZumBVIjfPaSs0AZsnCFvyPisS4BnUXv&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

http://www.signappranch.com/c?x=S75ZNMXO1DSZ4V2u0aCXc3ckx37YelG8U5/WxS ZcA0=&c=4V/GR4Z/ywvrd4aWcG2yunJUyxuSswM21oXWmlLyMp3N2f R9hU pElAX2LcfnZ7djBOoN4/P 631lH7QNLS7/KwH0pw/YXqJj4zvMdHqgOJ44Kc75R9v2/7NoMWet/X&fallback_url=https://ftp.mozilla.org/pub/firefox/releases/45.0/win64/.../Firefox Setup 45.0.exe&downloadAs=Firefox-13108-dp.exe

Remove firefox-13108-dp.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.