home

firefox_setup.exe

Hamonog

FlashSetup (New Media Holdings Ltd)

The application firefox_setup.exe, “Hamonog Setup ” by FlashSetup (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Piruriponi   (signed by FlashSetup (New Media Holdings Ltd))

Product:
Hamonog

Description:
Hamonog Setup

MD5:
ffb56b169ef78b7a4faeff62ef5df75f

SHA-1:
8e352e50edb147380a39996cfdccbfcb16711104

SHA-256:
4f446760bdab0cd3c2b5287c4fbce629101dc5df61df11a7bd07575d580bcebe

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 5:21:07 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.27.21

File size:
1007.2 KB (1,031,360 bytes)

Product version:
3.1

Copyright:
Internet installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\abid\firefox_setup.exe

Digital Signature
Signed by:
FlashSetup (New Media Holdings Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:31:27 PM

Valid to:
5/26/2016 8:06:50 PM

Subject:
CN=FlashSetup (New Media Holdings Ltd), O=FlashSetup (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FDED645F5771D0B9771141024E9B6BFB

File PE Metadata
Compilation timestamp:
6/20/1992 3:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:ZWWp+ArJI68hN70VWgUxYhJ/n3zhKkOZHAlfkV4:ZvcAz+J4VUOhJfzhKkrcV

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9129

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox_setup.exe has been seen being distributed by the following 12 URLs.

http://www.presentcapitalquick.com/c?x=cq4qc3LS2xYPuYnS/0S pqxOzy19XKIG5E P0C /3V4=&c=rnOOnYRQsKRxmh2q1OpOsygsOY 0h4Pk8Tw2kNVlBMq1ZwRlrPLTEX iHDERAMKSjWjX929Ie4KxwKluyp6x3arrzsVOzaSKWwZHTTq/ZSxhG5JJ0uabr9EBoeqN 2AJyBhyQwHBh95o JbHDGjf9kpO 9W3wE3zGc/M1YVEHr4=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/WVl6OTRQVmhKY3paYVNFUXlPVm80WTNGWVdsQnNlR3RET1Vkd1IyWklhbTlYTWtoUWVIcExhSGhDVVRKQmNuY2xNMFFtWXowNVQySTBhV1p3ZUhsV1duSTNkQ1V5UmxCclluTldKVEpHVFdKRmQyUTNOMlk1WmxaTGFHVXdVelFsTWtKQlVFUTVPVVZVZUNVeVJsWTJNMVZvVDFJbE1rSTJNRE5IV0ZkdGVGSTVNMnBpV0VNM2IwcHpTVVJvTVdOdlJFZHhaRzFGV1dvNVkxQkdTVzFKTUhCa1ZUTXhXalIyYzI5QmNHczBlWEJxZGtSV2RuTjBUMEkzZVVWdVIyRkdaMlJrZWpVMVdISmlXa2hFTkVGRVNUUjZiRXQzSlRORUpUTkVKbVU5TUNaa2IzZHViRzloWkVGelBVWnBjbVZtYjNoZlUyVjBkWEF1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2QybHVaRzkzY3pFd2NHOXlkR0ZzTG1OdmJTVXlSbVJoZEdFbE1rWmtiM2R1Ykc5aFpDMW1hWEpsWm05NEpUSkdhVzV6ZEdGc2JHVnlKVEpHUm1seVpXWnZlRjlUWlhSMWNDNWxlR1U9

http://www.presentcapitalquick.com/c?x=r0a/f3kFjgBt85kFZI0ENq/ vsJTm0cWg1PpmvZKmzg=&c=hA19y/NIjrWJEEm56Oo6Zp/q NAO/Qs82uBjG2QyeKnrAD0sdiEgUSCPuQZpcHBrX7iiKXvWqwPTidc r1JrUskvHzxPnAiTGUxLJTpOFuVYIggoXoI8AqQymceKEMnPoWDJi77FX/EGNqWNaIPzwNig9JQEibJYE7Muu0xgi8w=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/c?x=waoYZ6SYCua3vDz70fQUwUBhJTW0KUkaa5ldt8Q5Y48=&c=VdsR/eRfYFvlIrHWB2DYRN6mz83t2KlW1j8bxXyKdk gfB0wTP53ACCskA12NVN Rni7Mp7QoqMHzVVg3291C5oLRj8L/wEJDbFTXmWGKUyXOHVihl3RS/2jFzteNQbIRTfMJudbg HTXjSUQVwGsDrFYVzTOE5AxQ1VhW7luFs=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/c?x=2dFtRWS941J1gELW7Uq103gnkNBOcwNCld6/ZF DGL8=&c=HOeC0MGJVS5Vdmn9jnhnf8ue5OrzACfDW 8 9MYZ avh5ooiE/LjOo1NYx0QXFV/YAohEEL7fuY3O38pKrxoe18Mv11mrm8dr1IJa5itRCvqluc7YEeDKKvd6LTQoChXvG2JyUWtJNtTePVHiPXLb4txToaMMhv n5Liiv93HjI=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/c?x=kZaUe5QhVllY3PGBocb11tnVoCids4R2ctsxCygajSU=&c=i5PyEydmU0/YJjsCvm3hRFawM6eS/4QechEcfYd2S8TuK5HCqDusgnjDWUi2N6bMkg7GwX7vpajyaUZZRRI3KysFNgEvaQSvy0jGHKZnv17JC4l00PiO1WqLmoenGGR139PJsCjep5aOicBntTzAiNZN0tAKf0QHjY4mhjamXTs=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/c?x=O00jKMuN4fFUioA/QvdyW7DrE958wYrF9jcncSCG4vo=&c=wiKVasFMq0hQ7ug/s696Hl4QnVjRsvxpGYRsJ/7Vogyz35V68lalz6T45ODBcApkKb7ZCp7VT59 8cs5HYq9ky1dI tQSM1coLTzSoI9QPS/3amvYpZ3DLrqjUibYwoAY/9lmg5PwyQrjlrAbslmiAg0NIRHSAFPE3YS VOtteQ=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/c?x=e/ k1E58e7UduQPCtuMMQEujNP6xMOoXENglNvB ObA=&c=mSacEJRqdNjVtOchO9QsF8Xmif/GHUcx1jSEz1JhiHZa3jTFf0Lyr3/0ykZ SzNL6cUQjwGXGsqnwoGwb3Qa/ NlzSbI9v3hPj455or4Oe4eAC5LxQPU9uPlnFdOXeEbEaB WhGsG3nCFCd6HOqgmXOc8jc8jfmHCdXIk5BIOgY=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/c?x=U3DvaIQjp5Go IM6IW7mS2ooU/0BNr1Xur1l4yENBdg=&c=m02w0EGyMA8SvTFpxf37eaYXDGFYlzHEg51ocxLBGFquOZkyAn0bjF3QWE9uICvT9NjiFAgHIjfUGvxo4Kwn0siLztR/1nT21m/PJONhGYeoQK1r/7c867cstAM78rKm/8JvqquFFw5IutytwU0UChqVbZ0dLXg6zLQSLEPGZJo=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/WVl6OTRQWE0xUlRVd00wZG1kakJ3T1ZobE5rUk5ZemxuYm5sWFRpVXlSa1Z5UjNCQ1Z5VXlRbkowWkd0dWJtZGxSbGhWSlRORUptTTliVFpJVW1WcVYxQmlTM0UxU2psQ1psSlZWR2hWUjJWcFYzRm5VeVV5UW5RNVJsVnllVEJEWW1VbE1rWnlRa1U1WnpOVlVITXlOamhMTWtOM1pXa2xNa0oyTnpONFNGaFlRamRsU0c0eVpITlpkRWxQVDI1aWNXNUVWamxKZUhWd1N6ZERabXhuTmxNbE1rWTFKVEpDVEVkU1YwVnZOQ1V5UW5aM1QyeFJTbkpZTUVSQ1ZFcFJSMU01TUc0MlMwTkxZVmwwUzFwaWMweE9XRTAwTTFaeVRYVm5KVE5FSlRORUptVTlNQ1prYjNkdWJHOWhaRUZ6UFVacGNtVm1iM2hmVTJWMGRYQXVaWGhsSm1aaGJHeGlZV05yWDNWeWJEMW9kSFJ3SlROQkpUSkdKVEpHZDJsdVpHOTNjekV3Y0c5eWRHRnNMbU52YlNVeVJtUmhkR0VsTWtaa2IzZHViRzloWkMxbWFYSmxabTk0SlRKR2FXNXpkR0ZzYkdWeUpUSkdSbWx5WldadmVGOVRaWFIxY0M1bGVHVT0=

http://www.presentcapitalquick.com/c?x=ULDMYCn6wvtmYx6uuGgHUgYpcXSoiG497kUCUpDcK5E=&c=URLLpAW1pYSCyoo1OI7aJyPbWW3l66wPdmnk5GowWF07AXYusmPCJhDe/ajpwAbM9mvk8TopKj3gNd1qA0HnU6mlxGo762VoO2OFskCbmK1CD/dgAbuh ftEjEwrQaBp33W20fYQGUjj8XAQaw2V0Y8yduQSg3x0qBJTfr2KUBU=&e=0&downloadAs=Firefox_Setup.exe&fallback_url=http://windows10portal.com/data/download-firefox/.../Firefox_Setup.exe

http://www.presentcapitalquick.com/WVl6OTRQWEV6TmxodU1raEhRM1ZRU1haeVRtdHRURW96UVc4NU5sQk9jbXQwVWxGcGRUWkhaa3hRVldzM05qZ2xNMFFtWXoxMmVUZEVhMjlwZEV4amFuY2xNa1kxTkRCb1dua3pRMEpVYmxFbE1rSnBlRTFzV0hocVNsWllKVEpDVW1WTWJtcHpRMjAwVVRjbE1rSTJVVU5JVkdkMVFrdEVVblkwUkZoNU1VOWtPSE5ZTURGTk16WlpkalJ4YUVkVlFUa3lRbGh4U2pWdVJFTlBUbFJUTkZvbE1rSTBaVGxWTkhnbE1rSXdNRGxvTlV0VFJXdFNKVEpDVjNveFJVNUVXV1ZWYzBwbWVHRlBRamQ2VURGT1ZXRlJZelIwUzJneFFTVXpSQ1V6UkNabFBUQW1aRzkzYm14dllXUkJjejFHYVhKbFptOTRYMU5sZEhWd0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmRwYm1SdmQzTXhNSEJ2Y25SaGJDNWpiMjBsTWtaa1lYUmhKVEpHWkc5M2JteHZZV1F0Wm1seVpXWnZlQ1V5Um1sdWMzUmhiR3hsY2lVeVJrWnBjbVZtYjNoZlUyVjBkWEF1WlhobA==

Remove firefox_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.