home

firefoxsetup.exe

Internet

SuperMoca (New Media Holdings Ltd.)

The application firefoxsetup.exe, “Internet Setup ” by SuperMoca (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Installer   (signed by SuperMoca (New Media Holdings Ltd.))

Product:
Internet

Description:
Internet Setup

Version:
4.1.5.4

MD5:
e65a039a5b14b1d96b38ff58bedcfcd9

SHA-1:
23aeead0320e44ae707b35eab620248b7141963e

SHA-256:
6b30271ad96bf85cc9f3c2de0cfbb535817cb755c722ea4e5d88f46b96c01ca1

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/6/2024 8:21:27 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.12.4

File size:
885.4 KB (906,608 bytes)

Product version:
3.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\firefoxsetup.exe

Digital Signature
Signed by:
SuperMoca (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:18:05 PM

Valid to:
3/23/2016 12:24:07 PM

Subject:
CN=SuperMoca (New Media Holdings Ltd.), O=SuperMoca (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DDA99F01EE6D7FC1C948433B608BFC09

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:YQ8S0DAuzck3J7JJq0a7psH0iG65wvbF+alZgOF5u:Y7VMul51O7psS65wjc2ZLu

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file firefoxsetup.exe has been seen being distributed by the following 10 URLs.

http://www.tourstocksoftware.com/c?x=y6UjV2wcOQRLFOFZ757ZaflP2fufSd9jkEJGgNpUp8g=&c=nbUZ5nzf0CqhQU JnuUXb8eJJ9qe0PAKllxtqSIETWqL//TBkK2bUPiv5B89NhFJmownAjPCz693IM7GDWXGzphXJaiFeUbwRcJKKEqzU1BVK/Mzy1isA3vg08JXTUy2&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.conecptapplicationcurrent.com/c?x=hn3pEVjpafvHOhUUdBYlONF9T5N/o7PZH/cJksD dUw=&c=c3Q94mfO4hqHGK6Ybm7RfFwM4iIryy4DZ5EJNZ C8bTdwSCQyolXYZSuPKKs3c01KxJ4UkjhgmT434xxnhuBi3gFHy6r11d4 JlbsvMJGHCyXpsnXt5AHXll3z3AldPZ&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.tourstocksoftware.com/c?x=IzmTnXeYRjJDBnaY2Nf0cN3MdGtyPA5gRHSENxdcg9c=&c=3OgTIgpIZkKiwn8QDfcaMgxOxSxiU bpO6MqqMr7VTNwho/j8QRKPGx5duIsEGyE8B2lQHZWhG6SYB3yrAQvYfpJRs8B ge5KjmEUragNg4A8yMFXv3tr/SWz/H9yivj&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.filenewfactory.com/c?x=TZRltQjTTZloQ5agckkOzr4wIkf5JZQObOsGUtsV8 c=&c=NlnKQSXVPQ7zkx7JmqiQzLzczI3jc4 KJBdx3S5WDaBdulaXtVnuKvRvJ81UfxTBq3a e ye8NhB9PdEMZA0yJ0DlhJtvXAB5maFNDx9p W5uV97T2ARLs1f6FwCItn&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.capitalbundletours.com/c?x=1S MS7CFpdtezAYmKyq 1zipDS2nKkaZLtocvxxukJ0=&c=4M2av9hX8R3k8IKQSPS2zzT6gcPqnHh3pEMyT 3azvkybwmOR6Ds2cztvXJO1RHkBKtINiwWE585HHXJCLpev/mPUSuc5BSpyyzYipyCJ0DxisQ38rZapNeafkkRtQ7t&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.filenewfactory.com/c?x=iYipZRQ0qVlR I1q7EUjSlB4MgCnlSOipy/PTUjwfaY=&c=peXZsLwUl3c9e8W1mDqpT0OcA8apWOHa4US3deGnlXXwqL9UXI59jnXMYxQM8 zRcp1qoQQtiiHX2XEuQeq80gzfMDXssrhmVWv3DNtq28m9dpR9FUCK0Gdr6txzNxL2&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.presentflashlaboratory.com/c?x=t6C9d2kG1Cf8lT6thrv5tgj4yFQSC5ajVIz3 jRgwOg=&c=PHkvoYRkJMFcWVt0j1qIoN7Jw kB7oTD38vaw1F5ogJTstaalsPmkeuvfyTkbOh15S79brAalRrC6KUkfdx7kI9QCPYXZ4vEo5yakYovkS9rkRx9WmudaVpeQK1Kf8Mh&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.citycleantour.com/c?x=dW3UrwAzarSiw5mxveuIVHJEdLi79uAsXIjhLTB/xho=&c=RnuyN7oDptCDMXZBZVRwLFuytj R4t/KQC8sHc/B9MWlU5y4ymw22wI9FW9YT9OZK/ZvQzr4ywmi7C5mS5vl8Lj/rhLgr95zAshNZqKg7jn902a /JMmVOO1a11fxouY&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.filenewfactory.com/c?x=4u6fsifC6FPnxPMEVqBPKKhxkxX6c8qrccu6k00CvKg=&c=c2eRPYIutp/hl3WYwx29UEGxKklEVY2FGErNEPY5zzxN4MFuaKFvXwdu5Wc/OoWb8VnmDIXyV0VuLh1fQ4j7zyzPLD0kM7fLS9iTxdt8EGqIeGC4ylOZnyZN/mM3hObJ&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.appvaultsbody.com/c?x=do2e 4GT2j4K6EhuLbiLzEAuo6eZXQvg3dO8rVJTJqI=&c=PXUAIPEpmy90wA5IxEvwNw4f2EYdDOWSSPo06/pvTef7Jtg9rKiAssyvkXe6CqSX9m1lRUy9C Z2n0y4mxXadr3AJuyB/J9oM0ZpWQsKMBtUExOYzGRwzXoG7pZO cU5&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

Remove firefoxsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.