home

firefox setup.exe

Dufem

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox setup.exe, “Dufem Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Darwen Marketing Inc.  (signed and verified)

Product:
Dufem

Description:
Dufem Setup

MD5:
d7a2ea04e5055e35197c532ccdae7cd4

SHA-1:
630c331243e8302a860fb2b00149d92e2ab8caf6

SHA-256:
6d9c599568ee7360fb8fc9d64e474037006d45ab9e19c2720d0e3793e8e9e8ca

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/29/2024 5:46:06 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.8.11.5

File size:
949.4 KB (972,136 bytes)

Product version:
2.4

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\firefox setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
5/31/2016 9:00:00 PM

Valid to:
6/1/2017 8:59:59 PM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
3A06E9DBD0206A134B76F68EF10A4949

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:D7ibThm0Fm/EJVAUGX/Y0SAdv8+RQ3a/r+Fk6xcJ4oBWYJ:DunhBmQV3UoGk++aT+FnxJk

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox setup.exe has been seen being distributed by the following URL.

http://www.capitalvaultsbits.com/A09m6IBdxNKnDc7XA1oTC2PHR45gCgNg4FX4xfLBcorstJho5XTqZhHEJqKZB_yMvvVxXvh RAc06igKcPlagLf8WMJyh9nple2nWeqTO3jQOMbRayF1PnmPI1E2YeDeAco7fFKSBf Rsj55MzQhBWeLQ5 snwT2ZCS70ycSd5HrZPcPLtCn2UImCSnGEPLLMRvetYsxwwJGPSjFOv6CZfs9wNDB8e4FJCUqPORA4zHjDDvbIeXdxx7GbyhBBpNJL98Y33SFEeo2f5BlP579WKGgdBm0LXkCFeSYKprd51HJYIR_t5CZNW78zMqDwS2zfkiTmNf88gDSShFD0TmIGeKEhvvcAVKXEnmyel7KIzJ4OwJq2fUT7G XNrW3 dqhZQ5bLqgub v 4ewEp_X0nQNDqu0DBlRlzAL v0Kl5VWfp9H2BXmcRuFiG1o3i6l75LikPMrakDcMQp0btiVNHV97rsD0 kssEOTUZVNwhSb4UDKIphD8zhLe1XRdaFkqN ZP9si59mYgZy6_hj_qtxNBYU n8vy7KgUrJHMtYbBiixbph2WHEXHWeIaE8fX4EvVCIXM d7f66mxpStShPNdhMG9OVbNF8xW9vGeRkpE7WqQbPECMIOC7SeB2lkvRup5z1nM-Ow==

Remove firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.