home

firefox setup 40-win10.exe

Hamonog

FlashSetup (New Media Holdings Ltd)

The application firefox setup 40-win10.exe, “Hamonog Setup ” by FlashSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Piruriponi   (signed by FlashSetup (New Media Holdings Ltd))

Product:
Hamonog

Description:
Hamonog Setup

MD5:
4ea315e59b1be0c60259fe7dab91eed3

SHA-1:
f01c1c65a6f57c54a12077ee60a52c3a2efbe0e5

SHA-256:
0e49c55871e7f798a05e56377818f6c25a6c31335a86c8ae08ad4367c5e8517f

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 4:48:01 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.25.19

File size:
1007.2 KB (1,031,360 bytes)

Product version:
3.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox%20setup%2040-win10.exe

Digital Signature
Signed by:
FlashSetup (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 7:31:27 AM

Valid to:
5/26/2016 9:06:50 AM

Subject:
CN=FlashSetup (New Media Holdings Ltd), O=FlashSetup (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FDED645F5771D0B9771141024E9B6BFB

File PE Metadata
Compilation timestamp:
6/19/1992 4:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:nWWp+ArJI68hN70VWgUxYhJ/n3zhKkOZHAlfkV4:nvcAz+J4VUOhJfzhKkrcV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9129

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox setup 40-win10.exe has been seen being distributed by the following 17 URLs.

http://www.presentcapitalquick.com/c?x=zPXZQa0bFzbOHzP rXIPEZtzt Pj/qAi/kxDH5MNYIQ=&c=E 2e0kSFVk8wEe5CLh08uk7fmEZPsvGQyGlQLs4wkYIpdIciVTfUW0CFtWPMmG4GHic9SH/I3AkaFPOwWmWHJ7cvZmneYEVCJUrsc0nGckL1qJZ9y1mo5b/nIL7rdmkI&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=E5sSpbXaykxqJGA8bNa1esPR7vOSy01pvMPi00FIBIM=&c=zTACxnrzU6vxIAHubYJ1rQyWYhviWwEv44VVKQbN/aTnjBHXEYy3R//waCnso 3IfeTb/P3APX8L/T6g1Mp9vPJ7q34vH6ozn8Yl8S Fx40YWG5oznVdZMX03Ym5LpEV&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=e8SBWkfDAzWweDZfBj 9szT1BQgysBZsjz0mRbmy1Do=&c=YpSqDOPokNOaOcC1J/WzuFe7ZtCx/kR1qCw8uQA2hYutNlD1Qe/HpkQFeyb9DPA4UOgGxkyYfYjpI wmZQIG8SVYEAX3W1Arx1La/t fGSw3fpZUsFanRk38ZnDw6MpK&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=P771eVkVQh8wUTn9wLGaWZjosXpiQ/MD0PG62LO/g7c=&c=qU1MR3viuAtcMv7d6NVyRf PP9Slu 0mEpwNkUeBQIPayUpnRLUnU5ELv7dvYn51qij9iNq8oilLpi6kzum Krlr2kTU2Oe8gUrbLPqDp5wy5bb/Y6a LtS/yKexK1mp&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=FgJb71FNshTdKbNNkoHyo3Lsd1HylVKBjDeY8cT3gfE=&c=SlP3dWUEAPkvyfzVhJtXoNxyB9MHl7ZIZX9up2Rav5pmQV 5Z6M4wzqV/WwE9nKGjf4W4mQ Xw6KgTqcLRFGMgp6s4ko3q9yRYsBa76iQMtZPVBlgsSz8EOZSv6IFHPy&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=watZHfCYlWqnuM/N4cTGWgIuGUSOhrgSvUX7i7uOQCY=&c=m6LRvV5o42 gAFLktDIm0/g7bnhTvCAAx/AvCu3bwV7ePi5f Z5fK1l7gc9Zj0w5ppew8NBf9mQU CDg1DW6P0DzRfqy3d11jRvckEoV4qAyV0XhC8pnCJ1c4y8VekJ0&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=t46uaPh6xSLt2smJZ9On1n/veF5IHzAT2cyLL cr07s=&c=A2IIE88R9OnAGndjJuMVjuHZIlYQcgcjqkTsobWdNl9gg8MiajWeDn85seiWavilV3qPpdw/E/p3WN33CDPK29/ei4CkE60IFfpXUrbpe95YB/TxdWxV/szOTOi/WVpY&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=UGNXpYFA0iXo4dpwpZ Wa 6l0bL YX1Qf/l0RVHYrOA=&c=osierKm9Zb2BDTUiwNDu7ZBjYoBmKAiO9vbrCPT DvHgmkUF88r7GJQh/pqM5JjqYjsBxuto1kUuJKsg4FBEupQXH09x5pTER/vSn fLqf37YF84/tEbv/JzBFpcahzT&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=C/hwLhLBTahmP6pzE/3jcATdxpqIFFlitEVoZ2O5VuA=&c=XTFLlrc8pdbXunCwm78ZFrx9RHkc GjmoTOtATQRnV1VIt2z/pNVcUPXDLcydXCfvpWR7i lE5fSzZXUzTjDGfdYmRteDaEQoZb7YD2wftgBondunVVVdj4MVsyJTeW8&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=W1//6vN3fq/ueZpUCohIB 5HLrJOTtagifGqIPyLW74=&c=e7eAq7nlJ6sRO8sFbHlS5e Yrkaj25 X/xG9SLEkKoA9hLjjIYr3fvlA71YiSfW2syyqFc7MH209tBRhJwBl1zLoE/hD9DNYBYS1pfOJtZYsClFfaHv GoXMyUFEngIx&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=CX ecXJLVmsI1FBiPfaMTn7a76ZxdMpQonjxCai7knA=&c=QaMYZRDbAMg0QiM9i778m6yV0xRBHXv/hGP4iv3c52KWfkZ9TOWwpxbwgMiubi9dKL4QohfqaIN4MJbHZazBG 9i9QsikNgg0ypXrpMKG5p yPvu2AkQeruMRNs/jJQM&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=jjPiIWxTGL7BAvkUwd76sJ7qA/I6C21uxnq8QhlukOw=&c=rRuZjb/Oqj8YJsHyvINolA n9fT LYC1Ic7q QBUJIWkMVRQzRjeuRCIoAGvtLBjG2O/XKmWtxHdqAAEX7DgWPUix0L/pBSCK3UTvuWiNmI0LuQ5sdzM mAQoT9i58Vn&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=Dtn3wNR5J8cKVkbb5q3yJY7BlrROOb6fI /cZLoksDA=&c=BWF qh6H9DMWw/xGT9Ns35jvsJHLYjm/0MNxfQsk9kv I4TAQBQL7doL1JHGdkvwuidDldjHEYSzxttlNEYAU2cYejj6tOvzUJcwytZetdvMc4pKAfKZUSYLPw9A6/W7&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=OGF82qoP3f9dYeasXePk4AzX4U6o26hrzuCC yJ4zs0=&c=Ue WeEqzXzrKVD2nrHk1L2lhm xjNEL7ZOWZlo/vVgr/22DGB7Zue337BEwWHvPsskKssidrgq7JKB6K5pg6OzMa6Y7md8xHHrD5bLaJqbWp0OPlhh1yoQHYKBAxEBJT&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=eqKFp0l7hppl6pIuyD8eQNZYAsjjdhvW2DRs53V3n0Q=&c=6EjnXemRrA8LGRtlbjOVkH0yeXNk8pz2bRDaFxU95O S3tcdXq4Y5MCUSKUzdQCM61c3nMGHNHlkQYWsIrbwy4CTynKS8KehfUZ4MFg9cKeay4rYIXBJNNlPNmwyQopL&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=pUc1KaxIkdyiX zOSCHiz6jkZzTFzgXNF5qs0AjYnV8=&c=yMicf5u0G9JrldlyUht4y5oW1iTC1MToO881EgfWjcn72DIh5CADyXWpzqV2Rm5PVY5So2yPSaJe bYjUh51IselbkZdy/ZKeOcmXWWXy8uTNrj/o4yF7kUgQ0fNohDW&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

http://www.presentcapitalquick.com/c?x=vpm1F52ANmXWQ 2AOrAdR8A7d8K7jBEUQ20m7jWIUP8=&c=I/ZrYOWfXjagi3irvhFGkIvvbKjwZKs6OuXinA4xDuspvAIEjVYznFTeqw7CgWVDWclMK8fkQu1tcRGNHZA8ERPNtFYG7mE5wJL4UqXyuy0GqgeNzhLdMPtDcEz5b8b6&downloadAs=Firefox Setup 40-win10&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/40.0b3/win64/.../Firefox Setup 40.0b3.exe

Remove firefox setup 40-win10.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.