home

firefox setup.exe

Pebetegu

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox setup.exe, “Pebetegu Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Darwen Marketing Inc.  (signed and verified)

Product:
Pebetegu

Description:
Pebetegu Setup

Version:
3.0.4.7

MD5:
9f31a3e9b6d2afb80a429794046f678f

SHA-1:
a0e9d8cfafce1914c2e147fdb062604e8966004d

SHA-256:
9cfaac9b7d5a2c25676318ebf1de82c4c917b70ff0a8e1eb8cc1f2026c9244f6

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/30/2024 8:02:12 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.8.11.5

File size:
947.8 KB (970,560 bytes)

Product version:
1.3

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
5/31/2016 9:00:00 PM

Valid to:
6/1/2017 8:59:59 PM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
3A06E9DBD0206A134B76F68EF10A4949

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:tilRZOpcscXYsHsqJNW9QC7o3bClvcAb+H:ERtsgs3937oCeA

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox setup.exe has been seen being distributed by the following URL.

http://www.capitalvaultsbits.com/8KoN613XwF7bkoV6cjWLOavOhzAyl34JHp2stxB041gRwC0Rtn01mFywCkJFhkixr2jDp WAZd4WFDMU1gxHCb76LvZIntBiQCWONOFZkXqoTBN0x89W4wgYJVhWHwA5u38ApQyDrnUrKHBSnwgilnAxHb9AyZnpD7Spnn3GBab0qN0 M19KvhoGffI_by joY3qGwu6D_Ilb8qw8KzIV5UZ3Hv_lCEWAl6FoYmrsWBO_fnObftJ8_ZZaq bVJUCRhiP3rqs3yCspW25c6bub3FnWwal4td oaegHM bt4r4sm2KFdZvP4BHvq0o6uCutT3J71bbiepOAYQWUKOGkAf VINH960Q4Epu_welXUvlMAL07ZMMN18FIMYt1PVc_t5d_rg08mtJInWWAKFZtM1JNhgSoT1hshanUbXVwLICE1 xXAn8yrIfOD747lwz91PnItDw0q2d vK11x_3UzRftz0DKtHiGl87a0SJZKOPwxSWnTx3eujXqKYsWjRMHtZO_ddA9gyQ9CP8EiI3rkJ9dne N3gcOeouBi_isAJ9yf42fROsUS67iGYHHdOrGqvMxrhhDTkuUJ0Hco8ujPdlDwSvVky9vz D1RcBiGFdHyMSFLFrNzTbE3qxnFBnfju5b_od-Ow==

Remove firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.