home

firefoxsetup.exe

Web Program App

Top Scale (New Media Holdings Ltd.)

The application firefoxsetup.exe, “Web Program App Setup ” by Top Scale (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Installer Software   (signed by Top Scale (New Media Holdings Ltd.))

Product:
Web Program App

Description:
Web Program App Setup

Version:
5.7.3.4

MD5:
9baa1961d43944ca468a5125ca03c6b6

SHA-1:
fb8560ddea3a31187d4f5976bb600661ce601dd9

SHA-256:
d01e20d353c8b467e6a085fd5276298434b6be2e4aa7da98879009315d96c0d2

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 8:29:44 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.16.1

File size:
798.1 KB (817,240 bytes)

Product version:
2.1.3

Copyright:
Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\firefoxsetup.exe

Digital Signature
Signed by:
Top Scale (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
2/11/2015 6:01:05 PM

Valid to:
2/12/2016 6:01:05 PM

Subject:
CN=Top Scale (New Media Holdings Ltd.), O=Top Scale (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121FF0C79830A7B12BE4E698038C29DAF9A

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:EEXEsk5pVQGFku31tLLhQy3HpMktV8NToM:EgWHBFkuFtBQyXp0V

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefoxsetup.exe has been seen being distributed by the following 7 URLs.

http://www.flashquickbinaries.com/c?x=Enhf1pe8bZ6BeESUJgTwxExPehnb3WdcWPYbVPwQgl4=&c=BZifEog2ONcrJxf5pF7nolqJnZBf1mip44cirCjBe5UU2kBds1HFXQX9KBHkHMCDzMUBRnnhAZOpfsLFnwbOWR vaX5AmwdP78Y7FTUg72VdEv0BIhZEXTpX/hg0 e1atRB65O7dNO3PevwCM5DIOpE6s6cstegcoUmUWIPyUEU=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://cdn.mediafhsignslaboratory.com/c?x=/P1zB8OoFqtpOUXYM82R3fuL0bXcHXCh8Jw0IYB1 9E=&c=75viQxH/Qb/JAdkrbr oZjr5WX4MfSwlf678AObj1rcz8fZncwW1U6l3cz2SyyiR3iZVkfkQO9i8ahXTlcO1M I7wglG cnveZTghZMO6YKWuGZTGFuxLw1/tGhjGoNu H1MMTUd0hguCkkocJQCLAnujiKJ2BCDpqxQJPnlDK4=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://cdn.mediafhsignslaboratory.com/c?x=ofJ Ijbla069MnBLoXawUirhk01c4xjO7MvDB67MUiE=&c=SAdU70CVlLuRTHS5PKlwwhkOG86FQkSXNpH6JsAkHXWgw4j9O2 8nlYJf2mGJs16JcZy958dutPDX1fTOdMlF3VJu8kVI39/0znvc8qWUqbjgTWupqGRrgWw6xZIRXys5nyG55Ut76KHBMsxm2UHstdJOdVGFu79cqYHVecE2DE=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://cdn.mediafhsignslaboratory.com/c?x=gm/iayyXx00XRHuRHqPsb k8L8lB4yydFzT X2sOG3c=&c=SAizZmWcA73DxuzZKq4 M9GLQel7ikAF4W0DQeAM7US8m0GLsQFJpe4ruF5WIOiz FqGk2RYKfuP8hURtA iuLPJfFBM4W1Lby/rCIOUtgJo6jM vqicmAiRaoLR4rtIhF1BOCxOP9S4LNqdFDj5zOuqaWl5ttRLj14wST8VJ/Q=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.flashquickbinaries.com/c?x=08Iwrg46yp3WTO5CWtSEHwJEFcMsl4rwDFCQxwe2dD8=&c=TOa/X41sigzyvTkrM06TQWtp/mIyBTQwh7QimjyMU7RvZQPDLTTlF XQVEIfW2ToBnsHhtV9FJdoRGIVjtnSpZgvHyrS2oyE47b3f9Pf59jt2huiGr84VabW7v8vP0 YG43UmaTA 7E9Oz6Cs5l0s VRGaDtkZD6QvdHHxldHgU=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://www.metahostingbinaries.com/c?x=Et1qpfRqWoraZID3cGs8TAsr89lHRvytFv6/5dINwhs=&c=FIaKIQmtaNkk2a7HZ3FdzVJXwd7 xxIs7qy7Q9OZqLlDr36 AGmDRVDB41hX2yrgkQ629xQ/ydA/iDHKowO8FfcA2cc5oCh8grND7QUN1TA/3e3WezjhUcTOv/eE1xYFsbzAe3MNIa lJZdIU0hduLW2dgL8eYYlcKutCtEVODc=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

http://d.mediafhsignslaboratory.com/c?x=nwaWVUuaXYZdhYUgyz7uQ5JEUJQ635Vm220/Ucdc4Zw=&c=BpL4Wv5AJWNMiG1t54FJP0XhfQfaSP3g6CXkkWlBi7TZIesp3 OKbGPqL/Sp/btgXlB4e9cDVGOzJqbx3gSeEMPr7p5v90LNaz0ykRUxGBTWoKznlGhlmMwYKOkTXaq2yi6MoK6LrsdmwuoKYz2m9LGGDMqdLboGm3NhWLjuXlk=&downloadAs=FirefoxSetup.exe&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/27.0/win32/.../Firefox Setup 27.0.exe

Remove firefoxsetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.