home

icreinstall_firefox_setup_21.0_fr.exe

web

MICROMAX STUDIO, S.L.

The installer utilizes InstallCore which may bundle about 3-4 offers for various ad-supported toolbars, extensions and utilities. The application icreinstall_firefox_setup_21.0_fr.exe, “web Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
program   (signed by MICROMAX STUDIO, S.L.)

Product:
web

Description:
web Setup

MD5:
0147d86c1094e4204e4594f2245fb6c8

SHA-1:
8c40d82bc95b8dd0d4aa4de6560c921b7b07228f

SHA-256:
86cbfcaa9389b8954f413a5765be913fbac892ded81ddf8435e5a2523b5cbf06

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Utilizes the InstallCore download manager that may bundle various adware-type offers.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 3:15:18 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAXSTUDIO.Installer (M)
16.2.8.2

File size:
925.6 KB (947,864 bytes)

Product version:
1.4

Copyright:
Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\icreinstall_firefox_setup_21.0_fr.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 11:11:38 AM

Valid to:
9/1/2016 11:11:38 AM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:SPGpGzYF+yUzNMw8HvgNO6Fxh9kfioAqR8LmQc/JT7/GVOzqVXqKty86GzBL2HAI:SPG4FzyfPgNHTzq5+Ldc/l6qezF2Hx

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file icreinstall_firefox_setup_21.0_fr.exe has been seen being distributed by the following 50 URLs.

http://www.bulktownapplication.com/c?x=PurlxA8ePK6ItI/XBXWW3EpQBohplFrvG/JWW7gCwN8=&c=bx4OE64dPQgBAamApaaAXED5RdD1Uz2G jjkRjnd4lYuMZekYiqRlVJhHVMHyY4LUNkG5edwOSCDiHFun8q8TxyTizFlITR22TFlhQF408TbkkKjfgRbJjWpeM205NYY&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cityheartsafe.com/c?x=eDrUfxKavIPS4gMSmmJ7RDuxKE2xMYNpcpv1sr0D1bU=&c=0Dmoz6JQl/k3RcLoXeHcIMOOo5A8IC6sWe2xZfFds2a0Ct2dHgxXZcx66gJ ssn62dhUXl96wfKgV6pB3A8EELjylw2n/lqvfQMVYJdOB9WtuMfS9wqftSEYbiUpGze4&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.presentfarmcontent.com/c?x=ueQ8BRPoA7BQBiO2Zi2MhS/ZGhwHdyp87YEAT2ZxDGg=&c= Sb25riRvTQ6IlSAMmSbCOJnJMGHgZ9DuuoQKrpbov6fhXjSDO8DhlcRUOehwiV/7gnP yXmdCAkXFmTwOxOQ 1OhxMyoZF1SVcCNqKNfLtcXORRZ94/MeG8n3sE7c5r&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.grabfarmtown.com/c?x=AoS2chROa0MYe36wzb4N5V3pEmdIYnVDp8/zOHdhrFc=&c=d0qZnIUVzrDc1B oWZUVU3CCbJatgUswCQ3vI2BxlpR7mc BWYC2dj5mNGK4BsJtFh P/j3ExmfxylWOqSUYmLfinkgYNxkItD20gwVxIDxTSiWSqb7xBVPYHCq36zZR&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.hostingcurrentfarm.com/c?x=Oa2yhgSH5kTBKsCqKI/Oxr5MUjcI8EncEw7WPCeOA3I=&c=kncNW4CiKNregIWY0xS/WgkymxQ5tkXZ1EOBntzSTukELLoskzOuQiud7vSrTWOBKfQe5bQMMkgn1pS/OjRl95gWHKAOuIyMDJA2ZDwlRu3TSthOfqy791z iJIYAI/F&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cleantourapplications.com/c?x=1TIUzFo1APyy/bpdqYFf/juzEmXM6toSkdCWGVYWe6U=&c=AmC OeZTz8sXeqOsSOrXtAwuEkob YvaZKli4KQw7V3E2 SYfhRiWsxKAERj/acHiTTOyyH1k7fXWPPmZyQdMo7yJLBZBzZV5BOR/okFNbTa5zvXpmVO7bczdgesa2r6&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cityheartsafe.com/c?x=iOkFELfzTTUlO5EfGuGMzqzhhCnrZNHzg1wWK4PEa9Q=&c=n1FmVyJeT/X IjbwT4Wwez PLZqRH1fusTalEHXP1r8M9Y1w1m18ANkO//0yGlAmafz59I4q4g7mzOlCAAeNOKZ/oz58xUQ9LVC1a9YJeDeFvkWdFGXQCb47Xk979B8s&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.updatepresentdownload.com/c?x=k9WkWBoV//90XblpC4iPQj3DicIYPC7R 4SCDgiUzTE=&c=S68h21o82zeXHbYlTrD35TSS/NtzZhDjo1vmm JfxT27fIqt7qpm9tuPwv9Z7dJlsVsbkU0vJiF4AR9F2kinMaVfyQD7PteNaxycqRNWMUhy6oAKm7zNqbsxm3vsqk0Q&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.tourapplicationbundle.com/c?x=lf01EfR2kBWb SIaubIT0nTVi /zd01DRqqJCOlGbWE=&c=4PZvenVzCtVUu9a1FvhY6fXmrHzN 20b 1XE9fxaIevGph7FXnikNPLBtpnuOAbkDnDoa 3qEpuoLHNWigUPAogfwr8lpkDJwBXIC6lMYtec9/RwvVtvsRwIXAHSdqB6&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cleantourapplications.com/c?x=86Dqorc2uli4doe4mqHidmYUtd6x2G2Io1cCwX6kqHc=&c=7yi9gAHUuVZwGyqxl qXqtBnK3OL6N9Gs0xSSAHsZVud78wTJSSobI6FmZlKt/NnBIxKNvOZOxMfjeFFW7/e1irPI X8tEDPxOgQ3qCAvi3FErx8yBEnFwO8LqVAfnMp&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.hostingcurrentfarm.com/c?x=e6oLg8F6hsZ8kCy7y93iKBj9aaEi5j6LBUazpkRyDJ0=&c=VZQzDHh8tBGJC8M zLr89NNt ddxEWMq3sgzLgjg5jwB1tzSMuBB4Z h4ekYL hpfYI14/bD06YX4v2PriaP9i92QnCGyF/a0Zb5emDwXfA8mSxH1DD zmYKUqyYDlG6&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.grabfarmtown.com/c?x=PZVf0YvHqKcG HYVSJN5ai2NGr/9q 5I2ZSXCKHOSoE=&c=bg1cz3B6Kk7iapB8hz0kvmBrygDv09opkFoImsUTpk/fxhzP5uye1Cbip 5YCpbBcrW7a6OMRMb8p9uU1XJ4z5IgJhIP81g43lp1mjRbUND8tYQROVT9jTaM1tIsa763&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.towerscontenttower.com/c?x=Dt447wUWB2fAQAK/irhpUeYCX3Km s3HfynoY2 NiHA=&c=kGrvKabpi4GT4b9HubPS2Y/w30ZnEIl2eHl/4m4u1P YGsvLgWsgwOYkPu3dkUbT8EsAJA2h9BaUxjEA2GWHA/6y8BPFmNDckqtP3fExuexkm5m2itqNEZYpFFqugj/K&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.hostingcurrentfarm.com/c?x=mIkkPj7AMKsAEi0eLVYqKlN/MR9bnkdsWdkX9sWSRsg=&c=n CpTM0yOkHhQnWlSU3tg69MH/zqJpGKxQmTZGl0fNMjIDGaVU4lYhcUdRO81ncbQj3dLpVKwxQGuYt b8LOTwfgg0QrfQhyUlPMK5eVZSYFRx4AXqtpzis13FGyKlIm&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=UlMi2k O6RJOQyewnb2vx/vw908Re9jrHPYFrlFC6sg=&c=WFUHDA7FTNmsoHKQjXssKNlC0cw IagGXfkrTAiUWFG vFt4FybkO3VOx AbrVRXI OxKGnUIGkpnzoQWkY4haXjZkb70rdZwivGdXhqRRp9RZBV8MX8TSEFKQgtB6ZN&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.tourapplicationbundle.com/c?x=V4KzfpNkxsSEQNyK425Mu1jqVAJBTpV6LgTziljSS60=&c=zoGNnBuYSMY3Ixb/Bzi2wEuMM5lF3V6Tt wKr9lmnoz8C6cf5k4UayiKl50lXEwOSBiEDpTxhjp3sU4QandqpsMhiPsFXtNSBU7Ij6IyZamcnfGCzYtqXObOyv8pDCGJ&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newtoursfiles.com/c?x=8Tj6EVQ ASvnmPWGXo8Vfe8EqtWOeuT2Sz5FazhqPSM=&c=bgBTZb33BZB2D547VJtZNeye4wUDHbE4ADZeDrouyCroav3OrlZeXnNetV1LKNcvNsfkE7OW4N213cEsqLV7JQGETsmQf3gLvmNc7a894DhX71cqVumyq2Y3oHUkK/mX&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.conceptssigntour.com/c?x=7pUiEUL/C28S0/gRlaJm7uPVfMT3WsFHU7Mlor8GWiw=&c=Uv9Amv9X0jeGuTCVhhACkzEpfO5YJ/7EqRwXi5HiuIhVFlB9qOFUMbFZRyI/lmVe2LAcpuIS2sIUob QnOPKwAHr TrL3OA4uhREneJ6KZXh6GhvUBZEAoARJcmVg4gq&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newtoursfiles.com/c?x=x1U2GtM3TrAiQFRInBjkGXZUE2ixa9v1d7qZ6Sninmk=&c=lGTZ8dVSjrX3xWmrshOFZ1OLDc170EAngHBgTjwrEpfvUnFPY/XmqwFM0vWowJkdJDXpsZvCgcy00zpEo3J0FNL6cSFlau/6HGYutYKCEiTtqfmmN652FWa6jiGWHOOb&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.bundlescitymega.com/c?x=9BsUfUAwnyIi1n0GhyQjNz0exYIDklZkr1xuM2MjqS0=&c=LPzd/Be0 5uCov3 /Z Xd5IXIr59ko0DdCQwErWPwom643aP92fSi 07GcXRt6EJDek45H5bddqI9bDcv3RxFQcJXwxIh37h5dd8Bruj5tvzA/IIdx00MXYlxa2A15ck&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=Ylt0Us8DAVeUEM9kdpqbrePzdzdTWnZFqRW2fno/vK8=&c=VQcyGbGkvZOWzH03vEIb TY8jWtthw5SZTXez/ACqTjheJFZ3xk6/UZcb3WivU43EZ8kdsJgAuWob4ebaMVIvYvmy8DZckJXH9TOdr6ZM/QD/x5jnk1pVF1LbzgTiOcX&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=fygc6YNzmr6WAafaUx362GUEFaavbUqV0O4AYxaUmKs=&c=7xBhxg1LXXk8iZvAbzdLhHgKEYBKPMTxN8F6ZoBGQliQrFSWnYrpdf0b3raFLCrgulYzqVB98BXXNgdsccnt0G0pb4FfXm7tGUATVFPtVI5nuDjuljw8bo1OScukADyz&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=qTXoutTiqiYwRrTLtzoj8z9ck1tAnFige326ryKbv1I=&c=lzo0vtucuHDk/URkmtKTHh0ROSpju6a9c 5ncHScFiL5/r7spCnlBmoJihqd lXQWdJMp9mDoPc7Q6pggoNJxv6k4bVGmIvihuyQBYpvUYO5bTY2fYTVPI0BTeNONSoP&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=2UAWsa g0Av2SJkZN PHl6ycwQzeolHYkrNlO29svQM=&c=xKnZ5D5d039tv5vL9vUYvfASGBF1yNfy0V0fRCGitUy/v80Vl1HxQ0qZ4dZcmdqfs4nA85zAnQTPgD77LVM9rZkFP1sV/QspNozWvbBkXLZBJVKXJZRwsdsG6XJzxzOD&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.bundlescitymega.com/c?x=51tchIJEleMLMMOeOuQYUe4LfgNp2/BLp02sZTvOJN4=&c=GT59JN CVYt3xNobiqVQwYwx1wmLuH6zbhT3G0MrNvARo hw8/n7nsyoRjrgUMYKyHQkCRzaESRNTyfpAaDqostoNweH1hzR8yO8y802uZiMZkOc2tY5D3iBKNrzf0pb&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=2c/fV/hIouWKPz VYIq6j3GhTNDuXHPmigy9r4Aqkw=&c=Ddo4X7kl2B5yBfbT keNu3t P4h rDH3IY4iCEzUYkeaZWhjTcaQobUmOHEmAHXNsaoblXCcEkBtZvgZsbqkUY5ZnKT9bsbQP/W HD uGWcPPm2ylDSfdnVajJQj4nUs&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.cleantourapplications.com/c?x=BPkEWDtl0WxKKzC6DUA UpPWoC1tUTff5PGGZLFH0dI=&c=l2iICPQV5YAeiygNwNPznmemHB22jKQmXxM6QCRlITbMmZClTRqz5eg4EkGlZej/MM2hS2/3s879dmbLee2NLK ysIn TP0/oC0qEAuBQdAsJCOSNfHdACpd5gPw0K7q&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newtoursfiles.com/c?x=wI4rXp36zH4DueztXqBLLl 5Sd68am114MhOFbR0iqg=&c=EdjnBq kCK2Gry7YoM4X7sn8hLoQqyVWvawOY0Ayvoj5nFtxRnkL/Oo8BnxR9fNGZWBNhBqt6ZbUquC9QzO8wU0tc9Tt/ye3ucvpxHMGrT1dV2kN49eRX5mUlTXA4x6X&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.newcapitalcentral.com/c?x=Dq2qd06QUnBcQjgVfbSAZZTExEt/BoQlxMEqubi4aJA=&c=9oUF8LWe91NqKZOX g/av56t7uBCGhPd1jTiNSU2dyji4QjlGW8q BmI/ZkUIArD/fTSNnCspGvyGa9qpnTuPVOSG3wUuLOlkZ0dVw5CB0mxZKmN16MFk65Dm0uD/lXv&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

http://www.grabfarmtown.com/c?x=4iEg3XRRJqk88HbHrVQOpjveA5QNf03MiUugJsRU4m4=&c=so40465jAkF6E4WqoBrrKVOVEPger14/ E eO2qIT51MZxCkWXgfq8AUkx8Ac4lsSvREEjTvQnZLBEDbRic04YCPuGS8JEfdUIoboQFfvyTy7WdV6T3G3Hn8hdDMObg9&fallback_url=http://res.hufftos.com/.../Firefox_Setup_21.0_fr.exe

Latest 30 of 118 download URLs

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to os.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdnus.solvefile.com  (207.189.109.121:80)

TCP (HTTP):
Connects to cdneu.webfilescdn.com  (65.254.40.36:80)

Remove icreinstall_firefox_setup_21.0_fr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.