home

mozilla-firefox-35-0-1-32-bits.exe

Web Installer App

Program Installer

The application mozilla-firefox-35-0-1-32-bits.exe, “Web Installer App Setup ” has been detected as a potentially unwanted program by 14 anti-malware scanners. The program is a setup application that uses the installCore installer, however the file is not signed with an authenticode signature from a trusted source. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Program Installer

Product:
Web Installer App

Description:
Web Installer App Setup

MD5:
38d1e0c3b06db3a579657e1b95d44270

SHA-1:
922fe0b496847a0626264a71e98c0f4759f9bd62

SHA-256:
55c9958baef201a60cdef0177b1df318ff58be96f2d8a896f0b1876d7db10c7e

Scanner detections:
14 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/26/2024 7:20:54 PM UTC  (today)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

Avira AntiVirus
Adware/InstCo.emase
7.11.210.34

avast!
Win32:Malware-gen
2014.9-160108

Baidu Antivirus
Adware.Win32.InstallCore
4.0.3.1618

Comodo Security
Application.Win32.InstallCore.QL
21062

ESET NOD32
Win32/InstallCore.WQ potentially unwanted (variant)
10.11171

Fortinet FortiGate
Riskware/InstallCore
1/8/2016

K7 AntiVirus
Trojan
13.194.14952

McAfee
Artemis!38D1E0C3B06D
5600.6526

Reason Heuristics
PUP.InstallCore.Bundler (M)
16.1.8.13

Sophos
Generic PUA JC
4.98

Trend Micro House Call
Suspicious_GEN.F47V0204
7.2.8

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
3.12.26.3

VIPRE Antivirus
Trojan.Win32.Generic
37510

File size:
657.8 KB (673,571 bytes)

Product version:
1.4

Copyright:
Prog

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\mozilla-firefox-35-0-1-32-bits.exe

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:7n6pS7Iu7WU2Q52FcYScVs2SFDwcNfvub2BjiJlqhdhWFJ5liWNK3kiKF:7n6ss7Un2qhc2FDwMfvkMiJlq7oF/li+

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file mozilla-firefox-35-0-1-32-bits.exe has been seen being distributed by the following 6 URLs.

http://d.baixakifiles36.com/c?x=uuHtip1O6q5L2AakCN7p XH4IYOw98jFVoAHlxH49vU=&c=cew U/RRJ3uX4BPJ79fqdx2PVrGtd3xZW2znBgyild/I9o4Xas0YQtO pubNZ6bVScU0qzorNPr/XYbK06sgdw==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe

http://d.baixakifiles36.com/c?x=HOGz38IFK0xFMXJfMJS/KVcZyXR7HPi oRHQM54mrxQ=&c=bMlRn7ySUPgqm8L54DeiI6INDZPsf IPKH9HvpCetf1B9i0ELPPJ1qi3oqfd3IKDdMpfkNj YjIOUfDvpPcfFQ==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe

http://d.baixakifiles36.com/c?x=CoxNN12NFiK6WeaTcQ3Lj01v9PAbrUfVoXLRb7QnYWI=&c=HwF8yXP1oBRS2Lx1ywTul0saqikDkPLnUuXAdiPCYzeJBOBR95R9JakoNQX71r6kJ4DlMwFmAucUmbWwsMBBBg==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe

http://d.baixakifiles36.com/c?x=Lt2VDcTmCjNLzKt//KQG80fczmF5j7E2K/oTso4tL/M=&c=1MMyErlEd 31d9zpG01/GYTOCYPVujJN2VeHCkA4QIjS9E6Uufk1COIFVsoUsq2aBWp5zymyWwXnNxzUtS20HQ==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe

http://d.baixakifiles36.com/c?x=Hlp/aXNXHrkh9iQ6GIGQnN2vta5BM8R80IUz0ZpFpbk=&c=6hDkYuJixKBNbs2GEv3FKXG4iz R56WvX4pFpuq9PAKtzqoH5cYl XBVeoqXA8KDGfwupWmbPF 4L4rH9I/qPA==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe

http://d.baixakifiles36.com/c?x=vvHP0wZBfpsYUTAhG faKzbEOSOGJNA2sWBWnDAVepg=&c=l/MZoS4GAogkLUkSgsHvgI7h5S8lwtypL9tuIQ vc9hWsKWXz8KMlo7DHC fMSZXmktHFQ20ReEoKl21AhvZxA==&fallback_url=http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/35.0.1/win32/.../Firefox Setup 35.0.1.exe

Remove mozilla-firefox-35-0-1-32-bits.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.