home

firefox_setup.exe

Lacuf

InstallFlash (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox_setup.exe, “Lacuf Setup ” by InstallFlash (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Robu   (signed by InstallFlash (Fried Cookie Ltd))

Product:
Lacuf

Description:
Lacuf Setup

Version:
3.8.4.3

MD5:
ad655a5a671f39fcb064c621aa4b93ee

SHA-1:
7a395e986150f8e47fc55913fa8b5120e2677425

SHA-256:
b3f5b4c6889c39ad962e7988a214f1912085af9ff5db635ea0a0061449b94f55

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/1/2024 4:29:11 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.2.29.19

File size:
1.1 MB (1,120,352 bytes)

Product version:
2.4.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Digital Signature
Signed by:
InstallFlash (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:48:16 PM

Valid to:
6/2/2016 8:54:43 PM

Subject:
CN=InstallFlash (Fried Cookie Ltd), O=InstallFlash (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ACE394F39EFB26D753579A412465CB79

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:F5pydzYpRU332AMsh7+m+JeFxOAgJFiG4C3/YuFA8TPu5RY5:FDazYmmEA+xOtFiG4C3DFyRY5

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.8700

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox_setup.exe has been seen being distributed by the following 22 URLs.

http://www.downloadsbestbundles.com/c?x=zuoBVsvS8earYRkNbTGd4C7Zs4CQuB08SS6Gd5zdsuA=&c=kh1 bUn6pjgCEOoSnCoSyrDmEcOreYtbOC4dD4ys5jyhgoLvNEJiYjsg1xbk4zk wnw dtMBXYUWyKzib2FiOV7hHns3u/NQskI J38hY/KHxVozZ3FdfKSk8AjpwLYX&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.bundleworlddl.com/c?x=oZOGZ0N5eOswRAvbbfClaCh4a6BaWVbYrFaDZtP48mE=&c=V1HxBKy97hb5uYPE2vFiQ1Dygh7T33olDsA/O6W4WEYRRQCKJOH9FMYZunSnnyQkdgzfOeMJpLRnw4uqO7fD0/VhxjzKJPRaijs3aRjP7MRImdyeu7Hd y gAs2UjUA1&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.tagfilescity.com/c?x=1V3qV Xqyy/fD9ZG/7IF6XzhHhVJQuNUgCvBCv7zAT8=&c= F2nswhF8qwRg4MTFZ5p9Del7z3R9 i057cXc9f5j4oUIsNt4RoIJbLP0ruHqXkbY Hf0C/iPE5tEdZ3vFuICZoeaSBxQtg8hMmJHbVgO7/QcYiP9Cvl8VnrVnjHY1ed&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.packageflashcurrent.com/c?x=2HovSpziRJj/Lp93Rwu6cPYkLPmKRdbDfDZMsMlAvhQ=&c=PCuAB3cVeXfxHQjUSnQzAhP2zcThWUgCNCNRnM2n UsUklgGHuc4RrNVo1YT7 R3YzGRCSwTQw022JIvSYTmN3m 9eaTjw52gfzBqn5jqWZeayHLxv6UpLcIfOPUA2ga&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.bundleworlddl.com/c?x=SQFIMdNCE/50b25sE u31B7FcqjSjJUsW0ExN8 Cn8c=&c=jtnINOd fSVLIHobiGosgpuepaY1juwNy/Qi7I2c92q7riV0DVDwNT4qzTs0DbSXeQkgCd2suvf7UqRH2IppoMHkQmn1qzDqseu5RxoH3d3gXwlg8 YG4VVErg9frL3M&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.downloadsbestbundles.com/c?x=CqWv1XLzGgayryHzRfT/svjVH8MYoRr4lr55EuAbaFc=&c=iLFc6/mBtOpUyOwOuXp36pLdQs6Ug/61dq5niifXALwn31MHCUYXVe87aQXxdbkVg6G/rb18OM9SogO22vYGG36W ec39JD7KaNGPR38FHNSwHO64VzlBdPgfX99DfbW&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.tagfilescity.com/c?x=IPEvSTZ7bpluU3NgSURFrml5Z4tQxfV21Qe7UklTT7A=&c=ixByR Z8gtuUAkbpQMDkoJ3RIV05D/pebiD7/t/1jvqF4Hqw9DqoxkF/rf8ogvzRs4 GnXPaLy8Ii2eYBolvfKZ/wPZ1u0lmrtsPe27aiM7P2ZJDVA5wmU7YoRdSxpdx&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.downloadsbestbundles.com/c?x=ml22oBHbhJKWWP5xDXebKKUbV9jgfMXHoc/mHKZPwV8=&c=h8J7zIDdpjVMBQduKdVhGxMN4hkZfpWTDcPHdKZc7opRcKVHcDAwlmbHnXCXM3Bi9D8UfmLRNMZf8AFJ19Hvd7alK4iqAi5xkBXIUV12Et4 WZ7KzXQ4RccbwSXFX7pt&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.packageflashcurrent.com/c?x=uHudnhzVOihhtrIk3vL7xFCXBr3Fmdg2rLXCBVNH66k=&c=XQBRCWznqLzQ72idXJI2qOxelGDWtb9XTcyH7K8AKpMufT1O QxYg9G/UDwaNlFZxfI7i7ZvJ 5zd15Vja4B1DnMDH6/dbRwbMl2vCd6nWs/EMOpOOh6RsqCOEpcxxAb&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.packageflashcurrent.com/c?x=NkEQvkgR9JQ9Thp RROuBEX38Hm3zaAtsfSFg6baKcA=&c=jyGsiAVRCmHfJOHH5q19V5FIWpwJ3jO8Zj8m6MYz4sXLoV0je7jEMRdO3LQC3VHgEenMBq6Nm7Eq8di3O2/gsaJ3e909F4/mzKDPlzutkeANyhQb i5wI8IhVHqB3mvD&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.packageflashcurrent.com/c?x=ZFBrVmts1d5OZARfmOWtKj5VG4uS0upKZaaSQ06XH8M=&c=vlneeDxCAj9qkt i7lYiQDp361eOeUpHPSIyEI3Sx9a0tumg25NTi4JHY95xILmWIwSNn7pHZUOkFWeoANbBV4MrDdR5vuqHlklKb n7s3ttG1hOlosHj75G8TqdedqU&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.presentfuncity.com/c?x=8DeGoBbzb2HH3AamgnmRJiuPvVhXx/7Rp5EWV vFxmY=&c=Q9bFBtICSzB9UhY7yQhJG0Xmi5A6Mf6ozHHtflWfDWxHzBvhn6NJxSNsiIZSRVt3UugHgvuhjW7uKa7GuxYGf6r3kXvGilSZSlC/lvaTa1TLcKrOLz/ST8TsE2W1fcTi&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.bundleworlddl.com/c?x=Wb23vpytyIF6CrTlAJjesWC nN1Kcq5q8WDh 8t9tDg=&c=WBxi pdDiPb1EADn/i14DHfeBbSOpkuYRkjsZhW/sXEDRDtUgIg2SEuW 36 o5VgWFY2232k/mR85kpB e1IMMYjE/ZatLE/696zbqsLN9Mv uFSt5zqYZlYFekMp4cF&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.sharetownworld.com/c?x=1zzPPZJy2l8S70giSzWLhO6fSv9Cvtam/YgTsGrMosI=&c=OXcf6md0ZfjzZUBMCOrQsiOJdh6Wk4h IwMdN2mtA2TRYVpHkCvzjebSx5gHXDyUFlcqOFQx4ODK2VcTnSvYs9dTdqNuQKyPzX3Zkru0ko24ZuDfoVE/foBlEPaceXcA&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.tagfilescity.com/c?x=8DklTmX8ckSuFbVknzvaCNvGBO0vkz8DbDlHjGsfHiE=&c=L/xlrKjOtQvy74ETNOqkQ2LSN4aRFqeeFkTzE60KWUS/aOLE wW LWnbF07wj1ysogrY u0UHTam9O5rLs5zngytKPzMBm0zQcvTB OmTwtni/Nkm OORXHzVmynKl36&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.sharetownworld.com/c?x=V1g7L1eBVpbwEtIrRyUvSaLwSDDVhu3P0dzhrQyo68Y=&c=CGEg x4u4u9XbgcC46WsL55wrI3EUFdsxPe4h337SVx9uFgH1zomFHBZkA1VOi/9uZaJ1BFNfSxhw65j2iT5I3T2xviH4cRuaRaZPM9SbnZWvHUfaz177MpFnVtxuDfY&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.sharetownworld.com/c?x=QNfPAsaRqX4QGGW586Jhgz0R92JtO/mTGETwLMe9j6A=&c=CyOHs37LNFKsyRFtdvSHaTnqXoc /bKLqPAC00DMiK/oF/1w5SfupoEcjIVVV86jab7Srijh8 6x8iHleQXgTbAMENoWmFRE5q/bm0DwaZ4SQFzqlc9yR yBvVe3K3nn&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.presentfuncity.com/c?x=mKZ1n6KFxpake7UsmJfGbNraWSDm0qB8JUp7SPuDbJ0=&c=Wsx3f29rldhR/QXkGO2xkltrmF1YCpvh22RwT6hEaL20onCds32FxYkbKxxOrKXpmZmsnvcQg5PZkYcGyRWa0o2Bm809en bQSbaVZ4deTg18RAJuFpF4VbA4FmObJ5x&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.sharetownworld.com/c?x=LA8v6h4fv1aH8jw6rPmAzbwPocDYQ dSxVu2aKxRjo0=&c=TXVCTtJGON6E2IuqaftLzEFq454V0ZmPk16PuPQXixK9pq0bl39sXr/pcXT/k2Xvcxh5iIav9Aw6tWZchCztNO/2fjasXXgPFTPF2MLehSwgH/U8hrArFmdsMN4sXal &downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.tagfilescity.com/c?x=7kkPhtL/es0V1eg6lsg3i3 O4mFalNnVyEi6beeIUWM=&c=DM0J01FrWeyHi83TyNvi Guhs/t5mzIhMvDTDaJd8NRcVeJnkFi0c9tpu7tBJu3PHcJWW mInIqJzRvHWICX9uMUiMtQLnUP9f UUqZ7oJERW2/NWOtNMRzIfjOvLAF7&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.tagfilescity.com/c?x=z53NEKajM2DXW66oX/Spy7wwPhrFcJd67MlMQ5SdoKc=&c=Y8Rl1vc1yS/WWmjHZ21EIZ/HpW/8AwIsimYd/u1JJZ7dKoOG6kO8cI47hkr9R5pyp4eRDHjpvvjgnBRjeusWP97t6c2ZPVAAkVGsLx8a8NrvPAIUnZn1UoR3uVbWXAbh&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.presentfuncity.com/c?x=nimPkqPg yNQ9gCpEFItvsOXISWby22Kdnxb bwvusY=&c=vQMtWKX9c3W2vT6X9 Dy f36TcJ4WW6p8ZT1Ml trNOuhJirbm6W/4p BgJJxxgDp6nLETVyF6cCPR0g 9qs1CdjmVvFLyUPm1vRno2EbrdjKPYIbhpzyioXhIUqzuuP&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

Remove firefox_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.