home

firefox setup.exe

Internet

Criteria Quality (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox setup.exe, “Internet Setup ” by Criteria Quality (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Web Application   (signed by Criteria Quality (Fried Cookie Ltd.))

Product:
Internet

Description:
Internet Setup

MD5:
825631b483029baf554bff993b5b1563

SHA-1:
ef973c7c010841fa17f33db103cfe8011f458d5b

SHA-256:
0aaa1d0848551ef3c3cc0b2e55fa8fa87818cbd6b06066059d1041e6e06ed9c3

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
11/28/2024 10:58:41 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.1.18

File size:
955.9 KB (978,832 bytes)

Product version:
5.4.7

Copyright:
Program web

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox setup.exe

Digital Signature
Signed by:
Criteria Quality (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 12:21:34 PM

Valid to:
6/29/2016 11:39:55 AM

Subject:
CN=Criteria Quality (Fried Cookie Ltd.), O=Criteria Quality (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11216ABCF20419312093F809F0E003C850D7

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:UHl0J+JinXu+fy6jFXsxRbvUyRzkDeQI+AMuuJVnsWbY:UFq+JWrjFIU+oDi+AwzbY

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox setup.exe has been seen being distributed by the following 23 URLs.

http://www.cdnfilesandstorage2.com/c?x=cKq1qEHvRDkY3e5OnX5RS WMrvMdIwc pecCDe5t7N8=&c=eyBlcADW9GUAgx/kvGvcr8fLltNZxcD EpL9SRes5RquUmvBazFFIdS58b4PQABFs/EBU34zFtKyXeHD2oe byQGVoM/.../ Py7xuep x5S6PoulKfkZOOCw&downloadAs=Firefox Setup.exe

http://www.cdnfilesandstorage2.com/c?x=WR7yOmJa0T6YW3wqr5rfLUhu7Z/GhGbCXm9q7wRZ9DA=&c=DmcP5PuD2nVa4VOZpGkmVejD3M4mGnClaNFND5Ih9bMtNYgcCSRAeOvr1wGC24N 04r3dVwC0Yaenq6wo51gjG LdJeHwOl /.../oLWfxnSwN9Jb&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/c?x=NeQvyfMiwfllyNPic9BuUlB4MUNF8NoOIlG8hZOaT1c=&c=S7LrvRmTb4VZcT/YbzAPSDXY1FXhET7J2GsnqrCBrCvnoOToZOsa/ds2kSFcBk5QwPdYdPo/.../UkBr4thQ6yKhcDZahlqtM8obm6sC1PxdYnD6qDtD&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/c?x=94ZGXPIe3SyG5hXQscMtUYiMq9RvyqIHMJ95GsSIV0c=&c=viFM2nxKFL5IkTqgivhmsJmAONspj4ZpyPTPyTkavPwgcmXr0DWUiVeGD5TZjTSHPlFRdR jOTfMhA95fcYjc7Kbbv9U uuKWj4kE K Jt3Zkn2zZc4sod6GytZWqxij&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/c?x=yt9Aa9OaLtazPji ugXTXGjbLI5akjQSPuKU9Xnvzks=&c=zusZS54km/.../GpT 5 W6C&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/c?x=h3TLJPAeUJzAPLivlJtK jPKU2fKAb6mrtHN6hXgdBE=&c=TchX3OButADcLJUn36iq7lXkh0WJzdq74VAzSaB1sHpluggjPNSOojD8lagP K01j4yS02CQTlzW1I8JLGHbOonkU724Abiq0NwdofPbLroIyp4Rawq71NIwe x2un55&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/.../tE2bVD7OCDOpLUBm6 &downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/.../m69fbES9H2SpP692j 1W7iKez GnTScZbJD2vNG5GQa3ifceNtgCIGD&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/c?x=AJaprYSToswbO7 Kbn/oMOHw/n mXSBuXoq10xD3/sQ=&c=ID13VxhMFI8MIv6GUadEDn79emOkeAMww6OjLHVkwWr8XFI GYOT pkndkVp/.../psZ7ZwbeGtJtRBthdBk7enl7bNJ IPMM0&downloadAs=Firefox Setup.exe

http://www.cdnfilesandstorage2.com/.../hEIQD00h75OzsMiOt djfHzwTYUyVwrrJOPjxglX5pCqNqeCRYtCLuKYyuwKuBPddYXnjWX603TnjBtMrlMZS&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/.../eDL85bNkjTk2F6YagfHOhEnud6qfG15qTQ9qt6sU=&c=K2zUoaj3 k6yMgU95Exw5Io9jQrhGmBtxkYTltLaDa SPrjDKciNv7xuOOqLrfYbW08F528ZaHThOXm45Q4kRRNIdWriC8te8WOlFDdIRrDi3F8GuH 10qve31IW8xGj&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/.../4kcYZpTNJCGgjD1MAjGDIsYuD7tm&downloadAs=Firefox Setup.exe

http://www.cdnfilesandstorage2.com/c?x=rdxQISF/NpjTb9/A I7WE7QAEmzeBDvnDQpnbPSO/F4=&c=aRj2Moy9lQRzmmBjZ3ADBQsftVDBd7ldOSGbs5ALjdcn3TMu/Ral24nzgwCcdZAc3tQYpy5nuOvMlSgDJNlyKC3/.../0F5pSmq3wrvjeRoY7v&downloadAs=Firefox Setup.exe

http://www.centraluniversedelivery.com/c?x=YHVgqN6WGmkIf7hyROz HkIDg4kfSUdJisQbKlTP7RU=&c=kxbDY3Ji3CCbCR1NmiBh/o0b6AWzYpa 0Ait8G1iT/.../Rap8pBMMIErsh9x2T0CCWmWv3to7&downloadAs=Firefox Setup.exe

http://www.cdnfilesandstorage2.com/c?x=PoxBg6bdV9vMtq9 8jcCb0Xj6kCMWfMTyB4ARAXucUs=&c=QzsdlSlk 1JwHXKuDkrADvwrH poq/.../I4nRxb0lLS1ULzmeIqMDbGTMaajdmuu5Z6mRMR2Sl2Ogk&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/c?x=S3GtG3MWYq28P55yGheR1xt jR8nIZvJ88abrngIcAs=&c=8ne/.../bsn6 wCIz9bmtzVWRJ1l3WtFumLVSTZw&downloadAs=Firefox Setup.exe

http://www.cdnfilesandstorage2.com/c?x=AL/mrWMFzA8w0q6lB0hpJWAZ5EDDk3AVyUohtcj /ZI=&c=A16UiPN76Lg3HKlGUOA7YklFQZ6RmWcXQm4ZGEAwiLhi/ a2mtM/BcyWtTDKomWYkqcl 6x2JNvi/vzot4MN5u6P/tu8Czj92VV4/.../0lU9uP&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/.../ K57zZJWy86oXc2HhffjIYx8evRr3Q=&c=rrWSpvbiMMJwYnatLT6ReaZYTTJ9au7x6b4cMWqmiVEwVbf0Aj7k5QA0rT9h9tewFituZ0ciHs6qkM6rrCg2A09xpH1rk qBB3FWXSAehmp01pA ylTzdMyBKa373Bqk&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/.../TqLhZRWoyOsyYWOzxM=&c=x4NBwtkn3lk4vW8Llc6KpvDp2LFM0y3Z71NJm6YMvLRbcRbry2chyFfgRRPmrUuocw0pwGzppe9d14s1p1eAuQGO vC1ie2gzzmstKMKU1yuuzn91iaIBltb5TiarDtI&downloadAs=Firefox Setup.exe

http://www.giftcapitalgrab.com/c?x=ZGZ4lysfCUpUZp/8QSUkc0JJDfDsg3joBk6uPH EDts=&c=XVrLDnPx9qjEjxWyzqfNasqZUrWwVFp/mWJnwOo/kX8W3j6h/.../DSb6BdLJfEvcqy5CFDKG6p021qEMWmUGj3i8OTKsPigm2HYJnTSdVRV kuxuAS6O7D5F&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/c?x=sc19azj3GVTRfxa dfP7jIYjtMzyIPPQb8h4bk5ex7U=&c=3uivOyTW8VdHuC5v/.../93ubdzGILhy14J6x4Ird7SC42SUjMM1O9mP0nZsFgPUGVS9I1v2A QOtMSUIkFxug97xYFps E4Sqr9FsjvuthmuUk9TL91bb&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/c?x=OPKGnnWw8Mvd7wFBWMZYHMOoWzYB20CBpKiw1Df7sgc=&c=blEi9uNA4pweFUU6d EAmlSTzLKKXGGOteCAiQ J7rDngdGCCaIkNohxdqpc7QfeLHGUvsrC iMwR H40hbbEynKXFJeYPVfYXWifOrTbm38VMccZjgIVdpzN8lfQIhs&downloadAs=Firefox Setup.exe

http://www.hostsendpackage.com/c?x=JttF 476i8XCzWNwXSAYEEDbvbWsM4bkxzwqSjBXFJg=&c=gxn3MznwUlWdme1lUJsihD83NLfPzKf/.../I09GzJUUrVbgUiBUQ7RI6N1wVx4pM1vMmUPt5ILFskCWqKBrgYZdQFiGkbpLlheD49UXickbrnOsV4G0tLnU&downloadAs=Firefox Setup.exe

Remove firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.