home

downloader_for_firefox setup 42.0.exe

Web

Total PC

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application downloader_for_firefox setup 42.0.exe, “Web Setup ” by Total PC has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Web Internet   (signed by Total PC)

Product:
Web

Description:
Web Setup

MD5:
17f4f660c9a5d97505e4470e7d38935e

SHA-1:
ad2e48e84549a1a51cdf1f7b9b2aef0d81ac3c7f

SHA-256:
40aab242b8f523301c73e529f4e4f9fefedf06d75d7bdc45e84b9701b65009b0

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/18/2024 10:30:53 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.TotalPC.Installer (M)
16.1.8.10

File size:
1019.5 KB (1,043,976 bytes)

Product version:
3.0.5

Copyright:
Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\downloader_for_firefox setup 42.0.exe

Digital Signature
Signed by:
Total PC

Authority:
COMODO CA Limited

Valid from:
3/16/2015 5:00:00 PM

Valid to:
3/16/2016 4:59:59 PM

Subject:
CN=Total PC, O=Total PC, STREET=Unit A6 Dundonald Enterprise Park, STREET=Carrowreagh Road, STREET=Dundonald, L=Belfast, S=Antrim, PostalCode=BT161QT, C=GB

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00B2DF3698915A5B9CA523FD5D2457DB45

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:9hiA/YRDnHyJ9aQDChWCTR/uglGFXi2k1jAPuO:9QVVyJ9a2vCTR/5lgS510r

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9308

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file downloader_for_firefox setup 42.0.exe has been seen being distributed by the following 24 URLs.

http://www.filefacts.com/.../6258?sfadownload=1&psid=252349260

http://www.filefacts.com/.../6258?sfadownload=1&psid=254863599

http://www.filefacts.com/.../6258?sfadownload=1&psid=254805214

http://www.filefacts.com/.../6258?sfadownload=1&psid=267413632

http://www.filefacts.com/.../6258?sfadownload=1&psid=265980940

http://www.filefacts.com/.../6258?sfadownload=1&psid=266203790

http://www.filefacts.com/.../6258?sfadownload=1&psid=262540024

http://www.filefacts.com/.../6258?sfadownload=1&psid=262966349

http://www.filefacts.com/.../6258?sfadownload=1&psid=263572779

http://www.filefacts.com/.../6258?sfadownload=1&psid=261191673

http://www.filefacts.com/.../6258?sfadownload=1&psid=253967320

http://www.filefacts.com/.../6258?sfadownload=1&psid=261026022

http://www.filefacts.com/.../6258?sfadownload=1&psid=255365574

http://www.filefacts.com/.../6258?sfadownload=1&psid=257893797

http://www.filefacts.com/.../6258?sfadownload=1&psid=257415525

http://www.filefacts.com/.../6258?sfadownload=1&psid=258021094

http://www.filefacts.com/.../6258?sfadownload=1&psid=258624129

http://www.filefacts.com/.../6258?sfadownload=1&psid=258842587

http://www.filefacts.com/.../6258?sfadownload=1&psid=258559627

http://www.filefacts.com/.../6258?sfadownload=1&psid=257736014

http://www.filefacts.com/.../6258?sfadownload=1&psid=257672367

http://www.filefacts.com/.../6258?sfadownload=1&psid=251200250

http://www.filefacts.com/.../6258?sfadownload=1&psid=249052621

http://www.filefacts.com/.../6258?sfadownload=1&psid=251888131

Remove downloader_for_firefox setup 42.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.