firefoxupdate.exe

Firefox

Chao Wei

The application firefoxupdate.exe by Chao Wei has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Update Service(FirefoxU)”.
Publisher:
Chao Wei  (signed and verified)

Product:
Firefox

Version:
49.0.4.308

MD5:
6c6aa8bb84013a0817586320bc2e6ea8

SHA-1:
16da6051b5d8919406df47c68927c7a8fda2b9d8

SHA-256:
e093fddfae1b37cd6fafb1cb21387088cc2ed0b619ab0c79a507119adf1926b3

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
1/11/2025 2:21:14 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
Adware.Elex.Chao (M)
16.11.8.7

File size:
188.1 KB (192,631 bytes)

Product version:
49.0.4.308

Copyright:
Copyright (C) 2016 Firefox Authors

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\firefox\bin\firefoxupdate.exe

Digital Signature
Signed by:

Authority:
thawte, Inc.

Valid from:
11/1/2016 6:00:00 AM

Valid to:
8/19/2017 5:59:59 AM

Subject:
CN=Chao Wei, OU=Individual Developer, O=No Organization Affiliation, L=Beijing, S=Beijing, C=CN

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1579BADCC703A48CF6490B89F550201D

File PE Metadata
Compilation timestamp:
11/4/2016 10:26:31 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
3072:lVrwcTvNqJeCytSdHK53K43kuCsTZupW2lQBV+UdE+rECWp7hKJ:lV0deAexhTEyBV+UdvrEFp7hKJ

Entry address:
0x76A5

Entry point:
E9, 9A, C3, FF, FF, E9, 8E, FE, FF, FF, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 58, 00, 00, 00, C7, 06, B4, 31, 41, 00, 8B, C6, 5E, 5D, C2, 04, 00, 83, 61, 04, 00, 8B, C1, 83, 61, 08, 00, C7, 41, 04, BC, 31, 41, 00, C7, 01, B4, 31, 41, 00, C3, 55, 8B, EC, 56, FF, 75, 08, 8B, F1, E8, 25, 00, 00, 00, C7, 06, D0, 31, 41, 00, 8B, C6, 5E, 5D, C2, 04, 00, 83, 61, 04, 00, 8B, C1, 83, 61, 08, 00, C7, 41, 04, D8, 31, 41, 00, C7, 01, D0, 31, 41, 00, C3, 55, 8B, EC, 56, 8B, F1, 8D, 46, 04, C7, 06, 94, 31, 41, 00, 83...
 
[+]

Entropy:
7.2338

Packer / compiler:
tElock 0.99 - 1.0 private

Code size:
71 KB (72,704 bytes)

Service
Display name:
Update Service(FirefoxU)

Service name:
FirefoxU

Description:
Keeps your Firefox software up to date. If this service is disabled or stopped, your Firefox software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and f

Type:
Win32OwnProcess

Depends on:
RpcSs


Remove firefoxupdate.exe - Powered by Reason Core Security