home

firefox.exe

The application firefox.exe has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The file has been seen being downloaded from dhc.freewindowsmediaconverter.com and multiple other hosts.
MD5:
b1ea5671a64e329cc9d201f125e6dc61

SHA-1:
b6c4c8fee46d71f72a1790f98280661bf30a00d2

SHA-256:
2abff30f04b5526458a3673e3e11813fd6d79515802248eb6963d512dbdb3ac4

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/27/2024 3:48:54 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Win.Reputation
16.3.1.10

File size:
5 Bytes

File type:
Executable application (Win64 EXE)

Common path:
C:\users\{user}\downloads\firefox.exe

File PE Metadata
OS bitness:
Win64

Entropy:
1.5219

Packer / compiler:
RLPack FullEdition V1.1X

The file firefox.exe has been seen being distributed by the following 14 URLs.

http://dhc.freewindowsmediaconverter.com/download/b94/.../setup.exe

http://mbttd.com/engine/.../cyc3VwcGx5X3BsYXRmb3JtX2FjY291bnRfaWQ9NDA1JnN1cHBseV9wbGF0Zm9ybV9pZD00NzUmbGluZV9pdGVtX2lkPTcyMjQ?ext_click_id=0PXfecTgN2XZah2OJgzbn0bWen6eMpYCtRsqCg4hcrB6pdlrFnrVYf2J9jQeaUNjI1SdbtxWJ9Wz0LWkWHBnKQEf1dVsQjr_Q7PHGzLOa3NDvTFh0vdg4gBTGGl4kENVEvO6ST6ahM9I4S2PIEy6eHhLD7M9pORKm0WCIG2zot7KLtkB19xAFXorHc20cZHJGIK8HbIHZt1n_JNLIzQdNxdBcnUsTnw0JqfaRKsqadMqfgjxn0qBkn0PX1XqYHAGDo_ljGC83J04uOftYvZF93VX0oe-A1UMAPlo4QaJY10kXd1QwfoBBfoYkt38GVMaQ6RM5bHmvsqqsxUMAxchmnax5Nux5U89aI5DuhbUXwTSfKtkZmIpAaZlcNFiQJ8CvhDvCW8T_DANJeCy

http://mbttd.com/engine/.../cyc3VwcGx5X3BsYXRmb3JtX2FjY291bnRfaWQ9NDA1JnN1cHBseV9wbGF0Zm9ybV9pZD00NzUmbGluZV9pdGVtX2lkPTcyMjQ?ext_click_id=hjBpfp8UkYcMophkKMpK8mijRMw4qY4TjTIQGQij5gD5DI4YqNqYCRU7nKE4ZMgJSEO9SO5fkVAiXeCdtg3gwVJbhmwsHfvZuTLvAmxKSf22Q7CCPXtzheRXFV9DjcmseZXlu-CcR5fyhIvP83oXHWzSpr3hWzbmXbE__LMs2d7B8_-mQG97BI3xjVxqXlgl2KDAalRWtNd8CN47YgaUjOboFa2rI8RSOJuQSxl39oR1N4nnmkcCHBiV7QP39KLXYTJVI1tXEtvy6ChvHGyFyI-gkyfiNvJKWDQEifkjwP7kue5Ed087uJGkoBHEtBBjWMR282dtZTFOcsM5cx5UwkIzlfpBG8bgpFyoeGD0Ogo9D1JJDXSYS762E43aHVAvoGTQSQ

http://get.file2desktop.com/.../Get?p=5492&d=6716&l=6303&n=1&productname=Setup.exe&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&filename=Setup&clickid=1026e15382790374e8007a7562ddfb

http://mbttd.com/engine/.../cyc3VwcGx5X3BsYXRmb3JtX2FjY291bnRfaWQ9NDA1JnN1cHBseV9wbGF0Zm9ybV9pZD00NzUmbGluZV9pdGVtX2lkPTcyMjQ?ext_click_id=rv_HPJVotXNUQO9n2SE5QNECFWdU5e5-x0X4dL0sx-D8TLcobcurtA7Tgye5sDLMBlpqI43EyrUyPu4QQ-yPFR6kTmVmvnDsGvvDUZa_wsXKWG6_cSbjUYJuuQGpwqK8yPfznURR8MIWXTbiQQp8Sor53eOTr6-4yhNHr0y9HoSXMNOBm1td_HgcqLIL25vTPWr42MRNkt39Fba3CtINYuAIN_C8dFBZI8pE-8DWYMdeDOGN01f3iG9bg654iZ3vN1rowWgy3HBVzJneCoXB7XFVivuUgqkQRAUACALdmyltXTSN79gsRe6xSEhwK_WKNesKb-1lnfDPwzrrk6Hd7Ux4IOq3DyEz6hIikbQtJ90M_APhupDxR49nyXsPZzGF5N6rFsXWst0C9wFumAkwmhg6

http://get.file2desktop.com/DownloadManager/Get?p=301&d=3746&l=3578&n=1&d5=34162&exeurl=http://download.microsoft.com/download/3/A/2/.../IE11-Windows6.1.exe&dynamicname=Internet Explorer&d1=5111

http://sebcotrk.com/mt/.../&subid1=Imp

http://default-page.com/real?pid=3022&distid=1775&clickid=Z0dXVpZD05NTg1NTQzOC05YzRkLTQzMTEtYjg1MC0wZjA4YjJjNDM0MTU

http://get.file2desktop.com/.../Get?p=226&d=4333&l=4127&n=1&productname=firefox&clickid=1029eac49fb8395f412c10b05e6a3b

http://get.file2desktop.com/.../Get?p=3022&d=3508&l=1694&n=0&productname=player&clickid=ZidXVpZD1lMTJkYTJlNi05MWE2LTQ1NDUtODZhZC1kNjZlYTExYWFiNWU

http://default-page.com/.../?pid=3022&distid=1775&clickid=ZidXVpZD1lMTJkYTJlNi05MWE2LTQ1NDUtODZhZC1kNjZlYTExYWFiNWU

http://default-page.com/real?pid=3022&distid=1775&clickid=ZidXVpZD1lMTJkYTJlNi05MWE2LTQ1NDUtODZhZC1kNjZlYTExYWFiNWU

http://dlp.yourplayersetup.com/d/151/Setup/502/.../rKYSN1kB

https://ttb.yourplayersetup.com/download/request/.../fIkTs2Sz?ClickID=143--414--1379665531.6567&PubID=${VURLID}&cb=0591815b13

Remove firefox.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.