» mozilla firefox setup.exe
Overview
Analysis
File Details

mozilla firefox setup.exe

WeDownload, Ltd

The application mozilla firefox setup.exe by WeDownload has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Midia Downloader installer. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

Publisher:

WeDownload, Ltd (signed and verified)

Version:

1.0.0.0

MD5:

d21a764dd73e6e37694a5ece2108dce9

SHA-1:

2c9ae9ba8e2aae4e02c99d12786410c7160e518d

SHA-256:

e41baf9e5895a9755bda36907c071dbfdfc6a13d9fec3019ef573551c70aaa45

Scanner detections:

33 / 68

Status:

Adware

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

12/25/2024 9:18:50 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Adware.Graftor.121372

865

Agnitum Outpost

Adware.DownloadWare

7.1.1

AhnLab V3 Security

Trojan/Win32.Gen

14.09.22

Avira AntiVirus

APPL/Downloader.Gen

7.11.138.188

avast!

Win32:Downloader-TOV [PUP]

2014.9-140922

AVG

Adware Generic5

2015.0.3343

Bitdefender

Gen:Variant.Adware.Graftor.121372

1.0.20.1325

Clam AntiVirus

Win.Adware.Agent-6555

0.98/19305

Comodo Security

Application.Win32.Soft32Downloader.S

17988

Dr.Web

Worm.Siggen.10085

9.0.1.0265

Emsisoft Anti-Malware

Gen:Variant.Adware.Graftor.121372

8.14.09.22.05

ESET NOD32

Win32/Soft32Downloader.D potentially unwanted application

8.7.0.302.0

Fortinet FortiGate

Adware/Softdownmgr

9/22/2014

F-Prot

W32/Soft32Download.C.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Adware.Graftor.121372

11.2014-22-09_2

G Data

Gen:Variant.Adware.Graftor.121372

14.9.24

herdProtect (fuzzy)

variant of minecraft setup.exe (Adware)

2014.12.4.22

IKARUS anti.virus

AdWare.SuspectCRC

t3scan.2.2.29

K7 AntiVirus

Trojan

13.176.11540

Kaspersky

not-a-virus:AdWare.Win32.DownloadWare

14.0.0.3211

Malwarebytes

PUP.Optional.Soft32.A

v2014.09.22.05

McAfee

Downloader-FMA!2A5878F4FF62

5600.6999

MicroWorld eScan

Gen:Variant.Adware.Graftor.121372

15.0.0.795

NANO AntiVirus

Trojan.Win32.Siggen.cqteqe

0.28.0.58720

nProtect

Trojan-Clicker/W32.DownloadWare.1160856

14.03.24.01

Panda Antivirus

Trj/Genetic.gen

14.09.22.05

Qihoo 360 Security

Malware.QVM11.Gen

1.0.0.1015

Reason Heuristics

PUP.Installer.WeDownload.V

14.9.22.17

Rising Antivirus

PE:PUF.Soft32Downloader!1.9C52

23.00.65.14920

SUPERAntiSpyware

PUP.Downloader/Variant

10344

Vba32 AntiVirus

AdWare.DownloadWare

3.12.24.3

VIPRE Antivirus

Soft32Downloader

27718

Zillya! Antivirus

Adware.DownloadWare.Win32.66

2.0.0.1771

File size:

1.1 MB (1,160,856 bytes)

Product version:

1.0.0.0

File type:

Executable application (Win32 EXE)

Bundler/Installer:

Midia Downloader

Language:

English (United States)

Common path:

C:\users\{user}\downloads\mozilla firefox setup.exe

Digital Signature

Signed by:

WeDownload, Ltd

Authority:

DigiCert Inc

Valid from:

2/5/2013 5:00:00 PM

Valid to:

2/11/2016 5:00:00 AM

Subject:

CN="WeDownload, Ltd", O="WeDownload, Ltd", L=Nicosia, C=CY

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0320C5B8F7CE6E92D3665598826A4480

File PE Metadata

Compilation timestamp:

7/15/2013 2:58:54 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:MFVRc+TS2Mt1nFae2kRgNvs8/JmJj82UlJh6Ur6ce7BgctM:MTRlTSrgN3q1UPf9e7B5t

Entry address:

0x37B960

Entry point:

60, BE, 00, A0, 67, 00, 8D, BE, 00, 70, D8, FF, C7, 87, 34, 9C, 2C, 00, 36, 68, 14, 46, 57, 83, CD, FF, EB, 0E, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46... 
[+]

Entropy:

7.8977

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.22 (Delphi) stub

Code size:

1 MB (1,060,864 bytes)

Remove mozilla firefox setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.