home

firefox_setup.exe

Nobotares

InstallFlash (Fried Cookie Ltd)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox_setup.exe, “Nobotares Setup ” by InstallFlash (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Tok   (signed by InstallFlash (Fried Cookie Ltd))

Product:
Nobotares

Description:
Nobotares Setup

MD5:
a0ad830c212b2063737339fdd898dde1

SHA-1:
b3c2a06e69c793905392f0f4c35bd716c1b2e684

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 6:42:02 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.FC.Installer (M)
16.3.7.20

File size:
1016.7 KB (1,041,128 bytes)

Product version:
4.3.7

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Digital Signature
Signed by:
InstallFlash (Fried Cookie Ltd)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:48:16 PM

Valid to:
6/2/2016 8:54:43 PM

Subject:
CN=InstallFlash (Fried Cookie Ltd), O=InstallFlash (Fried Cookie Ltd), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121ACE394F39EFB26D753579A412465CB79

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:9l1WWYyrac0cQ7ARnDV+4RBw+RftOqCbTtC1xcyBN:9bfu97ARXRnCbwLcI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9086

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefox_setup.exe has been seen being distributed by the following 17 URLs.

http://www.bundlesbitsshare.com/c?x=Z0GSgQ p/eqfrewYKQf/HqaTOM RC6 q8e2F2gn2bGo=&c=ViIhcVDggdfLiCNjPcZ9juCPlbJOLzG06KchxIlzT9tpL3B/wFaHmYVuOB9DmzhDdR0WlQDQJHcb 0kNlsO2auzDKpENOH1e9aIE/7HTZhlN0eth2oVriqyqHS/F0ci&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.bundlesbitsshare.com/c?x=JflRwrQbybrakaqGWmOzIWpK xAntDXZF1ah9cpo QQ=&c=m9tlcidte/Tav1kh8vNsYHC96kPc142ewpejNogvhQOLhpzf4t48kArnn6GOVxaPl m0wP4G8 /HFvWkJbPWLletqr1yQxqPopIJ9V7xdwVdbrwb0o97pM/O60SNIw7g&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.bundlesbitsshare.com/c?x=faCJQPXGE7jZTHD6worMe9w44FwhfEVQApJRbgspTDE=&c=yVO5PDNdqAmjiFakPf1TNjtvjFz qW 2ti6LS2zmx7ZGIXcsm1wLwvxsYntZBUWavThnbbHNl/QfN0HnxuW38ZuzNCXhVwULSz4/gRxscaeZTjtpZtrvgEMgWvxNcmeD&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.downloadsbestbundles.com/c?x=lqRngVyODMfQwIG6glcTQMm1OP33Q UXI/GSIcd1ekE=&c=Bz3aoZF x2x d2dYIwkBKFUE3RJ7S5qopupizS5qZ0xa u3 w06Qg8TGGfUIqbC9hx5cfX2KjCvgUtUkObWL7nKDNwYaPQfeeqbY8eO2wV34cH56hnc1cmwyIyBpwVZZ&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.downloadsbestbundles.com/c?x=fDE5dNe5H0WfUG9ALMH0rCMJEnm5Vcw14XvJYnNpe9c=&c=HzEyoUEdfDmz83Yj0KL12FkdeT/wJXe/97zlL98sT4nb/rc0E60FH7qOKGf1PsOj63kSDmWE7pgB8OH57y6cs9E0vHAp6GmKSX5R WNcla95jyKtK5ymnVutH6ANE4B3&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.towngiftchuckle.com/c?x=UQmXzLxbfsLT7omrpbm9mc6FmgpzbYEnDvM2QGI1WGw=&c=tPiPZM96jsKNvpF7Wvi/GXRVHbQtUHx8pnUiKz3MqVUxdihi4j6jwOQpZRGeIKyMmdiYY50NJGlgg 74fKQc5E9mJv5wdHrbiOFfv4fwnydre3QMxltY1X3hVPk/9ZMK&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.towngiftchuckle.com/c?x=02oPkg3DWKITJ5UwG3N7XYFp6H5NTcVAvpEv9NsUR90=&c=WzaBHB4o1HVuE0TQb83/JM8qBN/jsku3DYAjE6fOgCUAQ7IFyVvd2E81EOixbauPlX1kflyI5RF4DedkuLfSE6nTxC TgcBzzN0rG5RzC6OgCzEru9fjXopR6AODSDZ0&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.towngiftchuckle.com/c?x=vGWp2uN3r37fqz5OYliaBTzATpmTCKWn6Yr1n9 R0A4=&c=AHpCSKxshNSUTafUtwSpuD o6HtR3GUXhT9XL/BFeQF65xxw 4Ksn30wFePwZ6oDkdO/XgmHNzdZVs6S58IqKLQ/BGa72tUOdAZa/0o0X 6SrV94FRw2aHd7Fpn yah &downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.bundlesbitsshare.com/c?x=rwxHsZHaXo EbyvSf7rvadYDe/9rZNBKlvmmBJS121E=&c=ofwKkGVix9UefAfqYZ3NsrXoWzYfX4vhiLsonnhcbDIMJXHRoif7n5Xye3qEjbbNlhB5JMlqkSAmIJk7eAuA8WukWe5OWlBG2gWxF9Np8Gad/PTFy5tQ1mTcCq /jgMA&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.bundlesbitsshare.com/c?x=ZO7 xjL23YUptBimDxDmU9TH3sG1V3mS5rG5lvy1IOk=&c=34yl6 rdlR22SIawVZWuSpEFNLk7adhJuxDvg/dwKqKunPWNyalTPOVj0kEsAvX7x9D4q 35Hkep2Mm4YJZDyC1ppgUFWEZJ98L3pI3r VG2BN13QQkta7AQsLYCdmRL&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.bundlesbitsshare.com/c?x=8g50aP1oqhIVFEFc iw3MS/kcpf izUT/MdEtJZItBE=&c=LwKGlsTwFveXUgGyZxjW64QgSIWtW1 afIJwdhnbcJ3aO IzSQuKuJXCMQXI0x2ZYetGeHg76LFdKMKXOPLM5Iwikm7J7kQSvRtnrVB9DbFdSgTPl7soq5P2/g6n eDl&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.downloadsbestbundles.com/c?x=IjbIIrcb0Wa5qOkDCgjnufICa3jFc5vLxtsIoyEUbWE=&c=Sk/tYJ8ezqEya8yUH34W1A6vMXGRSyqnqesX3siS8fQ92ieuPKOBCFdFXl0uKn28jV2K0QxRyW9hOaoEke/oODRop0ZiPZ8djDr9l3hM8RZr8dGdkuynWj8LUmDSwOc9&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.downloadsbestbundles.com/c?x=y2o lCMD2WfWFGZebFBT63jyhtcWQ0iuk1/leZfVrv8=&c=CUsqiDcx MxSWUDVcYzJYS8OM Hslc/NChGnktoaw/oyJ8HKY/kmhyDYTJSEmyx Ek7ldtSUGDU2oaKSk/DTBHMlpe3UI65Q KLWfHDisXs0 kdWNSO5htYhtecshLTK&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/landers/.../download.php

http://www.bundlesbitsshare.com/c?x=O4X9qBrOhzjeT4y2Pkk9IUy9pEsJJUIXdzuJ06wUnO8=&c=Q9nNSb0Ja8bC dkmCu6xVG 0IcWOMQobGCDgrn5zVdEimgXrKcJrFT/p43LdoxC5VGHesbbde4j6fTppWPQ2GytvCBO0dDl03Hx6LC/OXQ9fkU7h /MA4XkhT9FuXfIe&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.bundlesbitsshare.com/c?x=GvHPHfggIQW OwClMwfTXMpHBfDRZi4Zuup 70OggTQ=&c=HmaUUHDtN7PvufsAYPkm7859hfHq/3XE5A 19nJ OvS/02OvUiuL7EFfUHQtH97L3sb7jRiUIJzrU2RWBocMU7pt D5cSEy/kX1 3fYxQ46NMx0ktO4yVyqLJPORWIWB&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.towngiftchuckle.com/c?x=quJe6AbZlBqi0aVcgrVxkeSy7gHIg4zTR7xbifNfSpY=&c=bshp tIOgKV5rtVtZrItfyDBwjKWnms1oOpJqK4s CnBDs1 6Xw/KOcx2xypKPc/PV9jAuUCf0VAwV3CED6cBVlLePEXZTaJ8rNj/B//mVRGSbLa4JupRFx78EGVcmUk&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

http://www.towngiftchuckle.com/c?x=mieOO9LwCa r8anj3r5zSte/zf4375LsVq/j9g7 lHg=&c=VEHCVDUjKYUUX9W2PL4j8tLqkICDG2Z3i77i0hRK1F2VpHBVbhFzdPQrR7A y42HuHsS6c4JLyEgKIOdZ7eI607oeDX9xZUsg3Z81DDOXVHyP7QfkPJ6bQDvN8nx9ZnX&downloadAs=Firefox Setup.exe&fallback_url=http://www.downloadfree4.com/.../download.php

Remove firefox_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.