home

firefox setup.exe

Lacuf

InstallFlash (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox setup.exe, “Lacuf Setup ” by InstallFlash (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Robu   (signed by InstallFlash (Fried Cookie Ltd))

Product:
Lacuf

Description:
Lacuf Setup

Version:
3.8.4.3

MD5:
b6def5413f22d34e19ed7fc42630b13f

SHA-1:
52857bc492def910c2f6102581867fb62563ba0b

SHA-256:
9de233ad676d2dae2c5801ac1c228cb549dc5486357c3a06ed8143ea73a46d62

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/1/2024 8:29:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.2.29.17

File size:
1.1 MB (1,120,352 bytes)

Product version:
2.4.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox setup.exe

Digital Signature
Signed by:
InstallFlash (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 11:18:16 AM

Valid to:
6/2/2016 12:24:43 PM

Subject:
CN=InstallFlash (Fried Cookie Ltd), O=InstallFlash (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ACE394F39EFB26D753579A412465CB79

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:y5pydzYpRU332AMsh7+m+JeFxOAgJFiG4C3/YuFA8TPu5RY5:yDazYmmEA+xOtFiG4C3DFyRY5

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox setup.exe has been seen being distributed by the following 33 URLs.

http://www.bundlerepositorybundle.com/c?x=LMKXAKjlzvIHVIK5qd5GAsFH77P0Hi4Npx//.../PRrAxfl3s5QLoFsf8pEiU7pfy&downloadAs=Firefox Setup.exe

http://www.tagfilescity.com/c?x=4/YpKr6d6vcgWqENON5pXZSGZpmz4SQY5UoYmc78Qlw=&c=1PYsM5PxndrcjtQMILesO1qYV922JiEIyJcxKai9i6EnH6SOZ9d6GT50iCMzJk9ys/.../qDEYHO4jXzWDjaRCXOvDGMLZbubuhrSJiZ&downloadAs=Firefox Setup.exe

http://www.packageflashcurrent.com/.../7rG5FmhU6tn QSeIn6epYrxqHff3Y WXE2qPcO V4R sbIn4ZXZSXkUOYhLZBK0CCOz5VDyqw3&downloadAs=Firefox Setup.exe

http://www.bundleworlddl.com/c?x=WoIZ9ExTiRsN9cFvt8qW4k/.../xTRhl0WIQiaKcl636FbtHkshdGQBLE0Eg71Gcxhje&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/.../ HZmKiVCQbi4g&downloadAs=Firefox Setup.exe

http://www.packageflashcurrent.com/c?x=BbPIzRQL /.../ SbredwB&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/c?x=UPD9OFm8YL2a5OId3KxZ1LncTYenVGKjtgqhdTk0jlk=&c=f5zN2gHNDM9Ubol/.../mKRUTJeo1aOHGATubexneGgDt9oPMnHNxT094ou6gZJeJBUU1Oen3BF9pdL4BH9SKwXD889PSeUHLRdlCN8nddNqgV9LkvHfpimkp4&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/c?x=K3S2tveFr5hQoxIbSv0ICMoxJC v4xlt2tcO1zi2atw=&c=O2UptAegZ B5m9KDcbiXWRcMTnw3g50ArQM xInYKVD6Fpi0BxOXQghIezRwRYUQuzbOQ NT2N4hhSBrvrpRobyG0qC8QPE qMNMxWeqv9kpFK8pA6HHmGpz22X30tLG&downloadAs=Firefox Setup.exe

http://www.centerconecptlaboratory.com/c?x=0jpxBBRUI/sakBnpsdPm7idk/.../oQ4ggQsPcsA x0T0fhBSNesd&downloadAs=Firefox Setup.exe

http://www.packageflashcurrent.com/c?x=Ja/loVl2sG4yBgBs8WIlaWDHDCSDYztzyPuvp2h7LpU=&c=AXCbgVWSOPoGtsFV5dFCC3oqItycjEif/.../t2718 C&downloadAs=Firefox Setup.exe

http://www.packageflashcurrent.com/c?x=142ZY/BQ W1PP3 fapoCdLZtI Ai32HjibVweGWyUSE=&c=zUQ6/bJCew7B0m7Z24IlFz3nX p6jmMvZV08hB7fjYMtyqSGWnYl5XSY7nTqG0h2Ry41nsq95vRIRqFh3 yIj5jIxcc40PvKEhL7h8/.../4zRRAI OcMFwI6T&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/c?x=KmwVZUQz0jbqGcv2fQmSF5smDzVxXN2XoNvN3zB7J9A=&c=gvimvJGgcmYTOzHmScJaicYQOJFZ40a4QcueHYhm lP47pquEnJrzD6GH Ggw13qLmzBIB8v7YxjceDihIgvd2NjmOYfHd65e AnG795GFm4hnvpU6BrBb283Lb2M6z6&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/c?x=ktwCGTjFt8CKdlZU2eMWNW7y3VmuN3tGRtVcXq8o5TA=&c=3oVLDoOEr81wT1k2264Zl3glOAEClxJzJLv0 aURe3CmgpVVy0 0xHkMwAhnb2c33IW0KgltStrstdd eJu5cQ6P a6Wetoc576XruxUQt yVA/.../&downloadAs=Firefox Setup.exe

http://www.presentfuncity.com/c?x=FSCTB8gWt/DIeS2UYYzZCZxct7bjLcRFnNl99Mm/erg=&c=bp/Mg2mn28h2g5fuG0aRqWIVEpOsfy1W7leb2B73LFTIfVW//.../LxX2RPe FeyGlo24TglophT1aAzjdRrl YlpSeBVrEuJFEa1cZqgmJ1zuAK4p&downloadAs=Firefox Setup.exe

http://www.bundleworlddl.com/.../f 99oCE46mg09H dOH2fJSoT45bjX G2uo6WOioisyV 82hzHoqueJR8dHS57hcs&downloadAs=Firefox Setup.exe

http://www.presentfuncity.com/.../zFHtiCdAnKgYLIZOrOH6KNyeHbFFsGd9h0TbKxdKyOICxB 9rv ptPxeb2fQ8T2zvy36q9Mmgb Spqch0KUl56DHHD3oo6tm7L&downloadAs=Firefox Setup.exe

http://www.packageflashcurrent.com/c?x=L2vmlOiDQs7R2XvG5n/.../2BHZ9tMG lFJO9bh4hdZCX6Bmvfh5KrH2gqhZMIj3uJPGZG65RECvKPV2152dxlKtNDdqcTo5Wj1wnc6hPV6f8FYHRwa1xHzVm6Aw717IbEqDzep3fKMq&downloadAs=Firefox Setup.exe

http://www.packageflashcurrent.com/c?x=/SHqOY/iXkZjwHsyQFLns7rzfaHkHdudPUzRI8qK3hI=&c=JyqxJPbyu2RKn3C/LaiIL5gEIHsIxZ0RAEPSoXaUK C2g3Gr0lpdGJd3HMJ 3hewrXCKYpnvpppzMmllL9GohFJmt1qefGGIFjTLfQi fQUU/.../DW2&downloadAs=Firefox Setup.exe

http://www.downloadsbestbundles.com/c?x=tlrAPLUqp8HufHk2YQzTnMYDH0YDLJuHNdISPt/rouk=&c=/.../MYqnQ20Y42NNcx5y1T5KwCcRb8ybcd4EeVgIWJtnoqKL&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/c?x=K2bwPjDXFnahO06CZgel0SymFxrVZAoGAjjU1xHNJxI=&c=XPLUAiG36RBGviSuFtOCbKSsvVpcq7ZQshCEOkeQ7VUX2BeKaZsymyVKKD24pTFmXuCRNZesOQUtIFkZ3NfeLPchekGalsIoBrBV5fqUaBumcO5Vv6c7bdY7kcx kuA2&downloadAs=Firefox Setup.exe

http://www.presentfuncity.com/c?x=14TPlmshwab8jB2HXz7Dwc0v0zrYuuvKKa9DEDn9/.../r ffVPB57HAKeNp2J5rBt9HpWFOYftFj4KXppsasz02BUxIAGFEdlvZ8fpt4kb5mEgdvhHaLx4DxVbl8YdBJ58VNqoo4c0Z7SVWifWxc&downloadAs=Firefox Setup.exe

http://www.tagfilescity.com/c?x=dsaCuYaG7S9foSg0VNvCVCFq6ZvfqnV8R4SA9XlD2U8=&c=Oe6SRG7zwM452jfkYIqAglR5khahaYfUpLohpCZHRK E tJjI10YU8WXT/.../V4BMOf09S3R IT3Cb96FxM2mtwt6fbPXOsYL0eSNyL73d&downloadAs=Firefox Setup.exe

http://www.tagfilescity.com/c?x=CX QeEynxYdXFg0jtzNhqlV5WA7k0voC3C2tc3vGpQo=&c=mHIMpcTzz7HsyXtiTRDPIuBRo6WHIkgWA6N1CfrfuquhxshkuiMSYchK3 N0nB3TOv13C2S9WrVuC2Dt0dV8RgQfI6w3Y0qiL3LAErI8cHwbEIGzCk2tloxA9W 7jsNx&downloadAs=Firefox Setup.exe

http://www.sharetownworld.com/c?x=r8PCpqbsPO6HHEq0zEnQZAAuOuk9Q8U7IuKe7 b4i9w=&c=DhdDkGdVmV2uiOYL65U1fxHnJCuEmMBVw2vkAzqVEV6DaQ8t4IJuchqynzmQIirIg2USbN4tpaNQw5h5Sw OqBE9FeRTmPzKjxdCZWMJwVe5WLHDs2xLJdI10H7PSTh &downloadAs=Firefox Setup.exe

http://www.bundleworlddl.com/c?x=Sfhc8RHdKET3xhWiu4E0VcsSA1HB9yvgyzaT4ci2whU=&c=32yDjGQxy5KfPXy7LpSjWONWdikWnAn/d/pW/y2DFdaQGwrlB0TK//OYutDgqEDNrL9qQ7RE5e8 FdiCssUwVrB5wXgXTWJzN3urkPKOSClqeH3rLHY8KJdV NHVADSU&downloadAs=Firefox Setup.exe

http://www.tagfilescity.com/.../Qr1V8K5SPsYTRS809XcOPbmtEd6p8YZ4hTE6BQm5WZw0sThcLfKSs0VOiZmPNrTFyabbkHhoLL87vnaU01NZofMlurrgVIEWWywoBwxHNdnv&downloadAs=Firefox Setup.exe

http://www.sharetownworld.com/c?x=OJvTL54 CSr1dlxeLBdmKv/DDQ5UE3j A84kUX0TbBM=&c=Cwo 57nh2hMq4kl8Z/7oRo5bowJVPRkpfsSLm/.../WWZVSK0vaDNlaI2MRiTD 5gb5z1p4mKuWn0HKEarJgtiezAxjgSm6oj0SdtA9oyq5FHWhjeTF4dzlh5b7lf&downloadAs=Firefox Setup.exe

http://www.bundleworlddl.com/c?x=usXWJ6TkjTTF3IjxAXhAE3/vw ES9Z6vf/t4fogqNLA=&c=F5LFETN51kLs6Gky8mJoScp46f6RJA/.../0cNcPT9&downloadAs=Firefox Setup.exe

http://www.tagfilescity.com/.../MhA4vHpZrHAcGw0ZUYAB3rmWvxyNdDtLla4v2IJTNeRi5WQSKy15oga2lqrRt1IKcpZi8TDzAH2U&downloadAs=Firefox Setup.exe

http://www.bundlerepositorybundle.com/.../0Uw23VT kcyVK7ys=&c=FnZx9fxdDdzs8XojLKV4hB7L19Eou2G0tWM9lv9qLvE2Aloug65ybUDz3f tsGaep3KMv1Ww4ZIz65sRXabjxRgS7LVXInR yGy5ML0S7oIDJUr6k ccZVo9eWPgZLAr&downloadAs=Firefox Setup.exe

Latest 30 of 33 download URLs

Remove firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.