» firefox_setup.exe
Overview
Analysis
File Details
Downloads (3)

firefox_setup.exe

Firefox Installer

Savvy

The Adlogica setup manager, an installer that bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application firefox_setup.exe, “Deploy Firefox along with various offers” by Savvy has been detected as adware by 12 anti-malware scanners. The program is a setup application that uses the Adlogica Downloader installer. This version of the installer will bundle a Mindspark/MyWebSearch Toolbar, a potentially unwanted web browser extension. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

firefox_setup.exe

Publisher:

Savvy (signed and verified)

Product:

Firefox Installer

Description:

Deploy Firefox along with various offers

Version:

MD5:

d0955b7d6f7eaf72c6f70c92f96df0a7

SHA-1:

dd2c32e9064ec84deef202aa7565f86c2b9abb1c

SHA-256:

c74d1566928b45f6c7e1c4b0e34993e2c181a49d0538d9bcf67a93fbe9a07b80

Scanner detections:

12 / 68

Status:

Adware

Explanation:

Bundles the Mindspark (MyWebSearch/Ask) toolbar, a web browser extension that will modify a user's search and home pages.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/16/2024 4:50:46 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Skodna.Generic

2015.0.3344

Bkav FE

W32.Clod81b.Trojan

1.3.0.4959

Comodo Security

UnclassifiedMalware

17893

ESET NOD32

Win32/Toolbar.MyWebSearch (variant)

8.9507

Fortinet FortiGate

Riskware/Fam.NB

9/22/2014

herdProtect (fuzzy)

variant of vlc_setup.exe (Adware)

2014.12.4.9

IKARUS anti.virus

Win32.SuspectCrc

t3scan.2.2.29

Malwarebytes

PUP.Optional.Downloadster

v2014.09.22.05

McAfee

Artemis!09A931BD7916

5600.6995

Reason Heuristics

PUP.Installer.Savvy.N

14.9.26.15

Trend Micro House Call

TROJ_GEN.F47V0928

7.2.265

VIPRE Antivirus

MyWebSearch Toolbar (not malicious)

27128

File size:

1.2 MB (1,274,216 bytes)

Product version:

©ez-download

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Adlogica Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\firefox_setup.exe

Digital Signature

Signed by:

Savvy

Authority:

COMODO CA Limited

Valid from:

8/13/2013 5:30:00 AM

Valid to:

8/14/2014 5:29:59 AM

Subject:

CN=Savvy, O=Savvy, STREET=96 Jessie st, STREET=4th floor, L=SAN FRANCISCO, S=California, PostalCode=94105, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

397CE208945051D16EBC051D5ED4B1EC

File PE Metadata

Compilation timestamp:

7/20/2013 2:42:49 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:zM7YKmIr51DH4awRTPMuW5Ql3KKM5po/Y/XXngoty0IETeiGQ6k6TOZ:z6zLUj3Kp0/KngoYfXnT4

Entry address:

0x1053F0

Entry point:

55, 8B, EC, 83, C4, F0, B8, 14, 31, 50, 00, E8, E4, 21, F0, FF, 8B, 0D, 64, F5, 50, 00, 8B, 09, B2, 01, A1, DC, 2C, 4C, 00, E8, 28, 96, F5, FF, 8B, 15, 58, F6, 50, 00, 89, 02, A1, 64, F5, 50, 00, 8B, 00, E8, 2C, 2E, F6, FF, A1, 64, F5, 50, 00, 8B, 00, B2, 01, E8, C6, 4C, F6, FF, 8B, 0D, 4C, F3, 50, 00, A1, 64, F5, 50, 00, 8B, 00, 8B, 15, 48, 72, 4F, 00, E8, 1E, 2E, F6, FF, A1, 64, F5, 50, 00, 8B, 00, E8, 4A, 2F, F6, FF, E8, 39, FB, EF, FF, 90, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

6.6438

Developed / compiled with:

Microsoft Visual C++

Code size:

1 MB (1,064,448 bytes)

The file firefox_setup.exe has been seen being distributed by the following 3 URLs.

http://www.dealdownloadz.com/nT1lx06fxkMNN3bAfr4iww/.../firefox_setup.exe

http://downloader.ez-download.com/download.php?id=533ebdc51452b6b718c6e6d9951913c34de53ada&z=2&p=eyJweSI6ImV6IiwicnMiOiJnb29nbGUiLCJydCI6InNlYXJjaCIsImMiOiJpbiIsIm8iOiJ3aW43IiwiYiI6ImNoMjkiLCJ1X2lkIjoiZXpfNTI0OThiMTFhZDI2NTMuMzk4MTY2NTMiLCJwYV9pZCI6IjIiLCJzdF9pZCI6IjAiLCJzcF9pZCI6IjAwMDAtMDAwMCIsInRzIjoxMzgwNTUxNDQxLCJrdyI6Im1vemlsbGEiLCJjdSI6Im1vemlsbGFmaXJlZm94IiwiY2EiOm51bGx9

http://downloader.ez-download.com/download.php?id=533ebdc51452b6b718c6e6d9951913c34de53ada&z=2&p=eyJweSI6ImV6IiwicnMiOiJnb29nbGUiLCJydCI6InNlYXJjaCIsImMiOiJpbiIsIm8iOiJ3aW43IiwiYiI6ImNoMjkiLCJ1X2lkIjoiZXpfNTIzZmVlMzAyNmFkNzYuNDcxNjA0OTIiLCJwYV9pZCI6IjIiLCJzdF9pZCI6IjAiLCJzcF9pZCI6IjAwMDAtMDAwMCIsInRzIjoxMzc5OTIxNDU2LCJrdyI6Im1vemlsbGEiLCJjdSI6Im1vemlsbGFmaXJlZm94IiwiY2EiOm51bGx9

Remove firefox_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.