home

firefox setup.exe

Getetese

FlashFunnel (New Media Holdings Ltd)

The application firefox setup.exe, “Getetese Setup ” by FlashFunnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Baheb   (signed by FlashFunnel (New Media Holdings Ltd))

Product:
Getetese

Description:
Getetese Setup

Version:
3.4.1.3

MD5:
a93295926d6335c761f8c2640eb59611

SHA-1:
bed68ab8ac80fa7ce448551d132c1a87ec077e03

SHA-256:
9bbd31fdf75cbe61d9e390769259fc3cdc7bde971cd2c054322dc7791708c6e9

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/27/2024 4:38:08 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.4.13.21

File size:
969.8 KB (993,040 bytes)

Product version:
1.7.7

Copyright:
Lite Fast

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\software\firefox setup.exe

Digital Signature
Signed by:
FlashFunnel (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 9:30:20 PM

Valid to:
6/1/2016 11:03:11 PM

Subject:
CN=FlashFunnel (New Media Holdings Ltd), O=FlashFunnel (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DF62995B705C263C7C1BB644682A9A73

File PE Metadata
Compilation timestamp:
6/20/1992 6:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:AQMaHtCHqOdwKlKtejxpBs4NIcx1Kz3c/iePW5ITSG/jJGvJVOivKL+SNkihszMK:AQMStCfdqoZs4NIciuMg/EvSiiCMa

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9321

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox setup.exe has been seen being distributed by the following 24 URLs.

http://www.capitalvaultsbits.com/c?x=xASGsYtD5oafLWdCQcN2p3XhyqlJIdp7FZiG4j1Rmtw=&c=Sgmc44Esz6rokvU3J9oy3s3dZ qaSWEMFB1HAdPoidV/82dq9SuyV5Lr6THU28R vNcgtPWMZ xe8zyhKgwXhwZv7E3r7gP0tSkTHABbhKED8hm545KKXkbdJy48wGQh&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=isRWWv511aaLiAjlPaCsYymUH5jSi3qH83e7XV wIUw=&c=7LcWHXuH9Ps/SwaKt8ZDi6N8RCPxyK1QA/9xruczUC3QiJPIzhrq O LlBmBGqtPZCLu4yG7L4HG47EHzfZy g0n h0YEpwKxnMl9Eitg6yxWD30Om snctZm346oBGH&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=7BjltN8Fgo5Qp4pHePu4q7ftjpE9 kNUeLMwki L50=&c=vOY01S 79WMeaIZaQ/qGg9P/vTNBVYRzgVTcBoZanBBWWemfI1tyruPrA2Cn2aXqOCOMKGiJ9X1rFM70nREjFvvoqaRbvB52sS95Xxzq/lOg5gKcaAFh/ZcZ2GDw68RV&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=Dj4217iLaTFBBBdCa/2xkoR1w/n1xvVgVBRQP1HDo6U=&c=2qkPnDZo9I9Q BayjCTPy9s56zej/s/L8qYbl1cH5Fkq3/Nhh9mgpF4P5OOK4THGGxOISHzw7p23hf5Nb WyoCGOn8lXuUka8cOHx7pLelMRPRlfxDwiFMrhIMSa0hvN&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=twkveV8EPbNS96zB035g9hE2FsGZDyNwq3Do57nujno=&c=zi4KsnlbUaNd3oEMQBI9qiee6N2UqbURje8IIrMKyLgnaNaEKllqaW n35TFOeD2sQiqZq c7n629qZOyJmsjyqx Q5 eAj6jzHnH/y/UjZyEmhZQaAeXQqDfhH4DkOa&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=3tQuF3R82HjKJU/7Y5IBGmHFoY8GuNiu3Fv5o3A/LJs=&c=FeEZA4GypUGINtW2Bfxox 5KNCAV7XiX4Q zU5VUl0QVSJs0NaKA8WUwbPLKQdAsKhrz vOWEEiLr/C3OKXImYFq/KH83OZsjbnzlsbtDP4 VdiUlj m2uNaHay9kOB0&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.guardquickbyte.com/c?x=sXRrQxPMAl1dYpAML4riC69jT6jLeEtDACsyss7mIiE=&c=ZW6BYWj CjkFOa/K0IPPcVdrVExk0AHQj9JMj12h8/LDhKAZfhAUa0Y4XpwneNBKhGibrFutkQTAWslO74F6BqN0c cWADb1rt6BncKjp41oqCPXCbQBFNPNGd2s3vOl&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=UYstMLzWxxxUpN5C3an9KNDnTAWNVgoQl06h2/kBgEI=&c=FWid2hjUR1YrK/oEVBol4 wj1GMPEN5Wz/cYdcDeZmEKrduhJH4qHjHlVL4ikDDXmmVouPph9hX 2tLEzxQReWuMC7FmaxcveaX 8 xZG gcMet dw5A3WbVBdpBuFRR&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=PNsquKqqtVnsXWutjVvdJoSIukhXxVJEIhoCkeFbNq0=&c=HDqAZIRIL9QjMkvloddOjVJjPEOBxJGo5we8QiJuGYp5Dl9TaqinUybHM1rebpUwh9jJg/ajgxbDRvOjnQliY11OcpbXJNMcNNH2nVeT0mzh18WxVAnSTZmj0Pf2c9nx&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=9pjJJuuXf8NXrgHW6gcSY78CNRNf800/VWJhTkZkZig=&c=llqRmrEnoyssDodMvw7Gng1RQ1CHH0026HqkKEgdakMgJ1miVBVcTQ1bPbrYt0ZLwPkBkvlDIeATcpx76h5innIQI6WGAE08T/5GvFK8ia6NPuyl23rJ1vC Jvo7iugc&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.todaysendsoftware.com/c?x=Nzh5ybBjUUtKm9M8QrFfbFTHW5nfxl04xpHxXNkHm9E=&c=NF farBJvK9VO8OfUuG1mMZF70vXrO0jUn0VRryFk1LtsJ520Knhein0nCDzF4CniQNzM9xdSDvesShsByBH4zx /nyHGla1BRpMZ9/4DjoqgtRydE8XAUwqQkewXDa7&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=oXsekm07Hk64s4NWCQBFlX6p0PSAHITwmXFqlA0h2Ss=&c=LH92dk6q6Au6UlhCYBCNI/EmV5YbnqiZBqt8ER4qRFpPQHJQvV21rBoJFfTujqVeXVlzrE2cV2bgruz kPc0/Vyn0sLrZCYoNROqaF6iYMHV/sPEl2A2EZ7 fNxBFqjk&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.todaysendsoftware.com/c?x=YZE9DDNCM53lvAP6fwRuASjBlOHYddqGUYfUQjNObms=&c=JyFtl7Jm88L/23Etpex6iatcazZzf w2ns3Xgqlv0Hn19Fpfr9Puzl4fn1qwWFo968C5orXJX52/oMRMBQLI2LXHAZpiiiXIbFm3NQSIgQ7J/8Hlky6d0f4/qEde9VNt&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=zYmg1rPPC TgE9gAUT8X5fFPItcx/fUTbr6OXCR/qkE=&c=wbMl7suA9UoMKhuPN/Hl0XIqS8FDS4OBxuL1JIDCEmh6TG0VsmXF lhwXLxEd8Fv5GCHmNr02gXlUWB2OJ0z3EGgEIfjfooX7dzh RPVHq9VKbcRURKmsH/ZzrWq21Fx&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=cIPBWS/7KFhsbWcTRzl mNwsIxSJCY9jb07uddNPWQc=&c=wib4GsYn4j/h83hyMWug9LmgChWPmwhPESFQJQZyLfMDVsSiUwsYQfxcmRLCBFsAdhjlQAyHps1B8mRyPhlTaZi2H7K2OzfrbcvcnkCYyF8WHOLzmashUs1VaNaGR2Rw&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=E7tGPU bUEKqO8P/86cqayOBgFfidNFo8q51N3aKAlY=&c=qK2KSb4sM1IWLzZIvc4a7rgmujXVHsLyyLMbu4ggaiJaHpDQX2fyJgOjF uwo6czPJDgtqHoXjGlCitfJu9akYX0GVr6BkkTNgBeGBzZbXD6lPdRQEesMDWeImSqO3JC&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.capitalvaultsbits.com/c?x=5Wd4pR/e6fGsMZPDZxmHXhmInISbWq1c8XKZxoe9300=&c=eUgw9sJnpsEEP/S IefYwjObJ qRQ 8xf8qITbuSpbAKBeB3zmy7rRC0iiWKrMipZuhHnEJc5rgrosBlWscP KIfjT/G7MVdd 5ahwhexMV7MQ8TzgedqpibhBcvNfM4&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.filebitscentral.com/c?x=u4IWDK/6/M2iBkukQ3gz3t6iOFn8TQUPOL206r1vIPI=&c=e2aHOR/Jg0Fk59JCzFdGLbUxexuuv7i2hGOqe87XmiWVyRFI0uYwVqJp9/R32QY7GX4KDr4VP4KG4lIAhuNFiF2dY9SPG6h7D17WL/ YNBqMo4G8uS9es7olpG86AAsK&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.filebitscentral.com/c?x=n8iLffmXFl62MYLybA tCoTsgbFrZRjrSnh/j m5pvY=&c=hnvjPzbH3N5PJ8QtrHmXoOa0KOXNyAaXPQn4Os23KO// uvFqFTT25AGbPxfC5ggdg u4 A9Mm kI vV3KLw8aHmU8ilTGy/ qUwfCGvkdmmF8znJJ66HHDDV4fqCvg0&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.todaysendsoftware.com/c?x=r wizK8gqy/bRhblwAw E6dyuAYp3oamlTGvzphc3 k=&c=/Te7SuadGN6cmZRBxIUPXa5itcyhqgEDy0xqzuVV6xXzeLrNjFRjgEMi EqVj98UzuPI4aVpckVgz64iqvOrQuHODXpaW yEKYVzjX3N6vNy82APPLRcJngvYRRr7C63&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.todaysendsoftware.com/c?x=i4HI0KdlLHA2woQXEytBAzm5MFlCxhmijaMv/es1B6k=&c=HE7Q6HIzpMmXvx9I5m5Os14sjYcfk YiZz1E7xEZwtuv2rq2kntJoQ1udNmIbXF3H6n6 6qWgM3Q19ELkzPXbsfslMmHExdXV2lFPujNShFYx38lpBVmvnIlRnVpXDB5&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.todaysendsoftware.com/c?x=dy7X79PfuhtJL0Gb3gaCaCwJ7J/qo1jHT8SIDdoW7pE=&c=sGyot6RpO5TIFExrAqUzYVeJr0EGAh/uyYP9idAgMVwdlzDIYlYFtHeyYiEvg9X ZwrJuV5XBzTT1qqWRajNW4rOYhcsHUJ3uOIIdkuqRmEWJNOyTnKOGxiCzZT9rUbi&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.todaysendsoftware.com/c?x=otBCyEZaSFa82FgXmCb0F8xdvgIt9Aq7WzoKe4LyL6A=&c=FEPp9uUv8K6rZJhw0QKOyhvQL183JqgEafh3FGi93R2Zt9YyAAjxcJP01uYLVQGTT8AdQxFpRnAwSFg0F9bl/1GdEAX3N5QSVhDwrr2avKW9JdtxT9wDIjhDXta43V9e&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.guardquickbyte.com/c?x=ytFuB8cAoYWcbme25co/NNWMTYtu scXqHB6UU2TQek=&c=p5Yh/tsLIEvT3EmkOCblLCefAuEn7EgTvZtKSZJnR7N2QQqGwwiclk0rv86bGFHrg7pCXRa2H98/LP1Fmndgnb8eskFfN2Kvt3mCSzUeZaomwhxif43cDcpPN nAe/s3&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

Remove firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.