home

firefox installer.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application firefox installer.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
369ebd6e63925967efd7d91e08b79b70

SHA-1:
638fed8d66ede50605ddb3dbdab1921c8a6fff27

SHA-256:
34e04a546c2f492012bac36ab6a41a06b65bf5c6287fd682c9e6e0116fcf5f12

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/30/2024 8:55:13 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.14.19

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\firefox installer.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:30:20 PM

Valid to:
6/1/2016 5:03:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:NQMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:NQMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox installer.exe has been seen being distributed by the following 32 URLs.

http://www.todaysendsoftware.com/c?x=xx7f7IB5K5P2AM9LrpTCYtsCUtFULiT7JqSTGFrokeo=&c=TItNE6wu01NJ58cv9eDSzETKQxhOuLb wS6LO1j3QOLXu1Mqo114JWQ0Jvz3z3LelDNjo4X7F5CnIsxoL4Hpg7kdUq5WcUr/UDGZ8bmRPBicx283r 67FqiDv2398Q z&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filebitscentral.com/c?x=cpsE6vDqXQ2wvrWFp64TnwOW b9PHRpPslDJStKZDjM=&c=TG7sSw0Ls/wSIgbZRZFn2tYg1X07Js9d3AEuaoWbXKFII0Xrho IxUOXKBRd094lOk2LcgOQKgJUbMQZSZVRYiFakGAnFCKLI9vIAzbShe9jm2Q77ZZvp4H7bMoiRjYA&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=aiXjm8orBZMwgtALQ6/ujA3bh9x0NroV9Jn5W1hH6/s=&c=FvgciRQX1mia4LVP5aStbCW1R8mIJ4EXl1UWt4GShKZiS0J/KF8pzLcrXMxfD2ZwiEf1 hXcNBNHyzE/3ZrMbCjmbgnjA11UNBYy6GaDq8phMs2yKwcKQPfr1IAL8e3f&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=AFy1ck9WpazUCSfcAr1x03oM8z41fuxDKc /9QEJ2Iw=&c=o9Fp2d7PXkuNbNnCtFXRAEGNTlMbDlQpoBFw4A9Dn7UD3KShVoEnHCHXq2uCNxeRAZqiu4A M13TdjTec0CQcl2qqoynfNa9 XiqJJicopnknyuDK3UAaViC6m8riNCe&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=GoG3khFuNF7C EOUGDciPJnxwMArTj04509Z5keDpX8=&c=Z8nV7Ak0p1pGwUC28LSvFB8ym/soLMJ1T8kHDMCDkJyE/csHqZ uYuFDaiaIHcBCvpVl/GvnPH6WyjGkUZyp3kthTHhXTB8QLSDuyKAxNQIe5HHDF2l4PRifuUPhe8S4&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=3eyfG9kvya1tlTSi2XNyPrwCGNOVWEbUgbvGHwV76CI=&c=FfVgo CEhoY5SZ0CNSKa7Z 5tDaGRiryCJ4NjXWQUnGEhDRXYWI3Ip1LAUNaIP1pU/DtpyV2 WReYd7wQzxJV1Eoh02rDn4IvT2V2XufR31knr/JOtAtozKm7DIo2674&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=Wq8q6pxWn9kh Hm8f7qHEyUJPgAdkbNkbHbkbBcmouQ=&c=CgIBNWflOzbsmbJ1PsAH0GcLrM2KNbLvfF3pOq3ixN4veOL/nSdOBaDjCGvt5 RCh90CuU/EnQU7CNZWpk5Jw5ubs29n knP2P0YuaFIlE8TEiX8h3Hd6Ad4aVoULVpT&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=ebH4HIZz Fld3Rce85rfZzesI4oQIr90hiSHi320y c=&c=RZN0S43eLeWlCUs9z8u8Z0Dqzn8A1F1ahkYlg4uEXgpqTY1YeszcViSmo8IVrO/Kmvn9KtCI5FlTQWQUCwVerfD3WQdJQaHEwssdUOWGgEZHj0N9U1Nzf5HCXAZlKZN &downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=CYw3pXDnHWxnMsTiRzc9yc1n7TNiX qtcdRuweKWQMQ=&c=Fo3yQJEs8MkwC3BHX zczRux8toHYdu86LMi79C2c9maG/wRappqYlXJP9NQIaJLL 9EtEJnlUNgctkpZeTwCpIN5Xj61tFr9MooIZyaYvw4Uof6N2RWGCuBW2XnaFoE&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=bKDVHpbQo2SDGttu9uXiLqMzGE15euo2gCZ4wV4Syhs=&c=qRywagCrqVfAirlYiKABqLoUbOVWO8GdYXi3JnesJIWJ0Yvhp32vhtBXO/Ke3/PFFu9nFuKbZmY S 2JhXMnd2aZvzocw5a8pqPaPz0Oi7mD6hd dqBcd8IiMZ7focpD&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=NqaMDKwlBmt0dYs yMa/1BdqVemoX0ap5PmuBWqGXzM=&c=Xak 8k6QR0vGp1PzS9MLknrQalKhH4d UUOBT/StpZnxMdX8UTJQl3c0Qyp5g/JPCDySQ C7NS60pdIGoDkH2gq PEJrHNtP0s0RS9hzZ8J44TjGeHNx1OvqYPoeK5uB&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=QKZp4ylcXlkZpLM7OZBVhDvkeWND3AXxs/n3Yasfq8Y=&c=ke4QACtvIF 2JL9V0jI pT NJ80 ERn7 2z/wVP0YWbsxaP9l6dtB14rm5eoEjmFmyBE6xXSmhI8 42GoEC/v S7VuMM8 70sHq 6JsCYSQqbEwcMb/gD480vTNIr0/R&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=LtQcV1j0 pVYObwVUrTSTWnDI2CtmsvyZP4HwITYtyg=&c=xAUrYT10sxg1D4pl6BMI0talFv1G9pglcy8WK7bmJu6eGIfU6mogc3iALyTfLJgpfoC8T7J57SsGUTEdYIn3CthqgDIqnYPedVFY1j/VPAH44jSV1N4RY1uYOz0F9avO&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=pRpQ9tVrXUPd V/bMlK1EajrjoI02vwgZrJFxb34h34=&c=/6wIaQxvqhnHim17oQnVmx3eRpTPSP/ztHL9XAYs3dsBafIPTK1OrGnpiRxceW/Plhoc2HzDGm60UCoGJS8sPl6sarszsqymlMTCskdwDW64hC7J5CLHc1s4SqWqZCC6&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=Y19K/ZAoyEBOnloCKKPz2mXfwsRr1VYBmJVDsiMbcr0=&c=IcfJCeYnowVcKjlEJbmhSB4DUqnpTW7SgEe7Gog0dWbEDxINtDmxhhqqCU7eD0Gz04UOsFZ9FD8fyN6CqdQVx0hj4glXos1YSf4wMX9bRCEuPf/rkwjlxUWteyXOmz8Q&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=6jPae7yq8AHXSuiKf39Onc8xsAxn8VUPKc0PonFdnIg=&c=B6OG6lG/ahlfeyMzwQHBlAxI9ai PuX8rKwLm69iuqlJEUpJJ33K/CBQQmfGiy6Su5pBvi8aLPr6HS79f8oQ2Aay12jFPKh5gUQib6Om7bIKJkHquS1Lk3TMXpSPm5hP&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=qZUX2wYveS265PzM2rXafH3VSTxPq5JNdvEtJEQnta8=&c=gQwB2TI9Ua5rxDnXh4USGNFmM3krym37lbt0l4vvNanTLCBc qW5SZCx21c3My2mio13KeoooujZqMpGyLlXxWGLeSIjPlpA6X5AbR378N5x45AOBAJ5gqqB74SVIQz/&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=ijTqqPdHzQHXYVzv78Rk83S0JCYmxG5FGBMMBWjA8 0=&c=c9UtUbqAw5Dg7T88ksogvN5WdAzL/ dVG2d2qWYtFPU2tGBCeKCnRKj3giEJzo5Hhghnx1z07jyV72m7d90yShseVgKM/MpFL21brXERxlu4Xdrdtsxg mt/1xGveokR&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.guardquickbyte.com/c?x=zTcjqkT9WL9wpZsu0IEYdgBi2Yfy0B3GyGaLMBVuTBw=&c=kgObbIg6NH/ABg/A3JVRhnSkFMbH/8 o4u2DVLiNMPVwZdtNW HfDFWOv8GX9zIpJb2cF1aH8wTzCAKlFw7Sl6rgx8Ocf0j 232jvkYbooUE6 1kij21ZL8m3Jw/GX2p&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.capitalvaultsbits.com/c?x=lt FJpkAquYYL2X4Lx3zDn5pDhlByur1xWuQH7zdJFo=&c=YrCgaBPiGpLGIn47o4bj73fhOoHccn2f6N7l5kz49zb7q2acFUZW5ufl6JcvcGC2IcT8KLnc3ht1VOeypoxCLuPmLjSoCA964nZL46f0WnYslkFd7DkCnb6oX2BafdCo&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=ng3ElLW4XahbKLh e9S/p3pMaO4XGWTE5ML5usCHTnw=&c=2x036jbWNnZ94wHxxY wnGts6G463AHOAa1E8Ryh7WQ6fyaDHHrW7O9CSoUWH 7jdzBF0UEj9S4tSRFbITWyy eQjfh/5a3v1eCGPUbHOwoJ75mbBnTAKjQ4b5JObTlS&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=UN50KsvrPNna5Wq1o9jn0JNOW51JfqYDLO U7QNOUV8=&c=fOhVN3HA5uHHum2Azl 51lok ciTCuzE6a wikbCXZZ6ckOKw53JXUoHHLbnWFLvZdlgz8jGgSIcWHTV1LkB7dnPaUTLI0eRnzRFc80Q da3poLzPefmlP6W2k014d1A&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.guardquickbyte.com/c?x=10zApq7XAtvCNiAUT8JO10/sap/7j/ LQB3mafruf4Y=&c=hATu4tmPZc2E2ch2MziPlEScPEqOxEiO8NCV7fwKrnBRNTnE5p5RDPNnsv udL2 uRboeKSMThWAY/TqkGa6QwDtYlACAx77H7AjmqY6sQ8kio5xW7F1MIsJnSNIjufK&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=dHRqQp6Ski8Fa0ZA92FgvgV7 RCrgr0gCrpvRBpg9 w=&c=AIcyt4EPvQv1/JBOCH9Q1s1tWXN2YQ5/di82PIDi4g15L4rGGSTQEgf/Y/G/Q3qHdCGdH3uJEK0J5TydYwsUFtZnBUXzKa8orjWpNPQAiFka37kZccj3dbDIphjpjRxk&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filebitscentral.com/c?x=uYvIWSbjxX4HvQuaZ 19zLvKaEX2uN1uL5jVwW2omd0=&c= Xan xwfb6zS4WRs5PkvT9zl6O85PRHobSxvQBQOosiZ7BgtP9zndHi wMzp1k wCc7Nxh70oE4waRSaRNBjOqThjeiGFNUL9MI6iHllJDCbK3ZH4N1RCgJJgvDIMXDn&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.guardquickbyte.com/c?x=2b8a9DydGsHWJTQ7vesmbtcNRgr7VKItY6xc/eYfoeM=&c=V9K0ZofgpFhh2slr89nWMTz4x1wXorkX4X71Rz dNfWP9lwk9QuJCKHkgVnRskMS8yWUXU5lnAjZqhzh5ynjcle/tw/InVRtXlnRVID8XoCtRvTtZubOgo TqTdpxZeS&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=xq2sF6/wdlI25rr0o/PU2a3fElcwfiAL26uWmuH7ijE=&c=1OXTjtD9vfOIq5u40r3YO5WMbxOl3O7899bsS8DnVRHIfXIIqn59LXXNkM8kxHXRoG4r6wybF8WIhCggKyZkV2YsVZyt4OSB9Y3GnDnKn2LwnbEz0VpTQ/ qbPEE5Ntg&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.filebitscentral.com/c?x=3ZwPHlF4eP2vzbbzYLGhEIo85cCI9igF4m8akN uSpI=&c=SbjmB7m7XEX9VuBzAmcKc/mG2j3HIR7eywosDwY1 s0QohbhQtfYg7Y4w5kL8BTvF6FSAVfVcI9FRWACsgXxekpD6QeMK3S/sE1AEuOsU8TqE6V7j6ZjqnEpeXfxdEzY&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=yYfvYr4Qd10EAXC6DPqX/k9GObFlb6NKoL/6Oz7oYhQ=&c=oij6lmWleuAAdCAz hA6pKI2eic2ahchGa150dI37hI2Cf9jreKAoTURKGaNoGgVYKOKzxFqKQOsPUF12sZsf94ai0xgpDZZMoFLPBRJ9ucF9MseU2H8Rm5ajuxzwj6w&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.todaysendsoftware.com/c?x=/sZbsSwsaNB8cI0HF0NHuffqdR66jyknhYqK2NzeiN8=&c=S9GkErDVYxUfeTF5K3F4GmM9tvoQ3OBKyJwb9jeClf5OEnbFtUmznLRwGmeQW7CkcVYlI71g7/vbgCLl0AZwMI4BU4plIOS7DbWLT6SiJXfOe5W YjSoLymrszKzejky&downloadAs=Firefox Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Latest 30 of 32 download URLs

Remove firefox installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.