home

firefox setup.exe

Beni

Darwen Marketing Inc.

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application firefox setup.exe, “Beni Setup ” by Darwen Marketing has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download the free Mozilla Firefox web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Darwen Marketing Inc.  (signed and verified)

Product:
Beni

Description:
Beni Setup

MD5:
ac8a9bc102ed0c5c25c9ba3958a75ac2

SHA-1:
a1cc1a4303a80b51f416b8d623053e2fd0762423

SHA-256:
ee636ecb341ced426003b556e9f125f40836466e3136a6629f42bc2242785f04

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
5/5/2024 6:20:57 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.DarwenMa.Installer (M)
16.3.24.22

File size:
1007.6 KB (1,031,760 bytes)

Product version:
3.3.0

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\firefox setup.exe

Digital Signature
Signed by:
Darwen Marketing Inc.

Authority:
thawte, Inc.

Valid from:
2/15/2016 10:00:00 PM

Valid to:
5/17/2017 8:59:59 PM

Subject:
CN=Darwen Marketing Inc., OU=IT, O=Darwen Marketing Inc., L=Victoria, S=British Columbia, C=CA

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
1F1F22B813CDB509DAAD9139C753C40F

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:AmC2dUuHKAsjmBXsvrPXxj9ddUrxnkrmeqz9+OYIws:Af3qSXxj9d2tkrVYtYh

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox setup.exe has been seen being distributed by the following 18 URLs.

http://www.downloadsbundlebyte.com/.../e8eAv7uO9orxA4nUABmNIkpL4FUSFB5 GkjIH&downloadAs=Firefox Setup.exe

http://www.heartcontentvault.com/c?x=Go AVv7PJKAysBBHODsWV57mZ0qLEmV9PnOsd4WBxak=&c=WtFp0IDgsCdKaXPf9RSE2QonJDHXZMkDg/m93SmRCuigSEG I7vuVzreHEiObrXhrwle7rwz6dJj/URbS5hx3pdQeKSbvjE9ND2p2Gp4n/.../EMsBq6qNQ&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/c?x=FVmnWQAKxK5rIqlo1K2fwL OEh5n/XYPe4wMMJbzdjw=&c=8QIdy4zeyBFMwoSb9DBcckmG1nSa8lbkC/yXqJJOKHXCsHRfZfNPQzM10cdkQy86xDx75rcDzONYOM3Oi9By/.../48&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/c?x=HjlkZt/ugJwvUEjE95iLZrAjCTDztvgPhTqjMcO/.../Glq2xSN7CzygzFT6jQEAt7hJfPiALCaE0xhYMd&downloadAs=Firefox Setup.exe

http://www.heartcontentvault.com/c?x=Sc86aWTMuPYzXON0KiV9YxzXvxXWav/0SU1/BURzvO4=&c=vE4bVzeaeSNk100P4kBrj DvRtqSaozDYxlW 8PHjeL/.../MWnSRB37eP3D1oQE8qEfJWji22Pquf9NiJersH983DNn3PC4NR&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/c?x=jLQteBsl5HTkr3hki69ANGo0CZOqovofpL9yE3DSN38=&c=bchMu5KQHZJzt5c XC8jocGtLpsUw0w6h2tjG5LLfBLVlOzeWI5Vxn1 ze/JfrnQx6u2gOiPBGc2hdKVafpL9KxUny9dxnsm9EsP7KLNNKAIao 42lfAvcEQd//g98sf&downloadAs=Firefox Setup.exe

http://www.hostgifthead.com/c?x=9wOu2ZXI1RF9QKfZ5UB6rFc7Ca7WyV1npeaCB7wlH3s=&c=zYxDANpoQyPh2o/GV6y9ycFULXnghYvUm8a/.../DkwoNSTeuj3sboUviP4sQt0bf&downloadAs=Firefox Setup.exe

http://www.hostgifthead.com/c?x=dyGU3M6mLpL 73PQ/sPsYyLcWdK2Gmzc/MsVUkN7svI=&c=iRNrkai9j6iw/3N5DDdN8DkBLVN9oHr/90 1ESTS/.../1UBlpp1JJtbVjLbtIFnbCSwZzBcnROO&downloadAs=Firefox Setup.exe

http://www.flashlaboratoryapp.com/c?x=Qfmq4v2fDedj0P5//.../x8ToXuSaKX aPJcTyUNChZNJhEb4m3oS56rc71VHnTdPJ1rTlcVKdM4Yn30mqxjwEqSIB83XldYU7DeH2cMDzloUE 5SdRaqjrxTEiA4xsEIpuSTEoBXJK8iy04I2SO&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/c?x=rv1Lynoy4TjsKI9TnbDIw75w3rguUfOwgY341QdY pY=&c=lVyOkECil4kWO51PVgXL0Q Dd8NY4lg15mBfyvFborbl2KgfoW9oiP tRXkb6llxcllaGGpH3Ejd1F/.../1P2z3s&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/c?x=hiKZnA2hJw2KgzpwaXgXK/3qOM HwmpnDYEIKkN66 4=&c=Re9SZYqJ sUGehZpevBfwFkg NNqN0tbyGgwqYvKfvRsBqSeYyQ0gIGdl YoqG8hhNBOczHh4ibjB3NvnJJf Z kPSgyK4LeBbDISW7Br/.../errmV&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/c?x=ZlxrvOgoq0ONxt 3stsCD2PXJlv7lYprZaAo53xjkkc=&c=FdzOKbWXynaPnuZYA1BuzAUkCgKIqKwk3ZhC7c63iNzxzHazyM3vTBDhZPEj GmPFaLxvhG1qkIDxXZ0XFzqqdpsUXM/zik/.../XLYix&downloadAs=Firefox Setup.exe

http://www.heartcontentvault.com/c?x=A6P7bIFfHfaypf3Wsl3Str6IK6Em/jxngmAO/.../lIIGPHczBjyAGRcAcYbaiiH&downloadAs=Firefox Setup.exe

http://www.heartcontentvault.com/.../shS9JJwvItI&downloadAs=Firefox Setup.exe

http://www.hostgifthead.com/c?x=OKbw4KVHNUaMZ1RNl679FIyuwt4nyfyAivvEH66kErI=&c=nl603tNT9FUz1sZRlaKYUOWtWVhhbHoRPq1Edbm/.../kulz0fAan82xkzu6keUtePCQ3ryg7b3r6I2a1rpIQiZZkPhcLr4VMZePsF1Asb Ym7kob&downloadAs=Firefox Setup.exe

http://www.downloadsbundlebyte.com/.../reXAgkVa7zhjxB9AAjdxA45iZl8e7ySaMPax2lxcOZVGHVSvIZrsYVvEKVY2ZdsiWSjrfbe 9ZF8tMKilsT1TFoAXliFcvb&downloadAs=Firefox Setup.exe

http://www.heartcontentvault.com/c?x=J 8xHBiy6ayhQneJnVtp77Kt021O/eS36zmPZjRtiGQ=&c=4SdY6nRc/Q8hBOOQgpnel/.../Bwiaj7RYl kfXEUYHDRMXnmoVVeGMH96d16yFmHGNWF0f0m&downloadAs=Firefox Setup.exe

http://www.heartcontentvault.com/c?x=gih8eXAFGuyV52uE33aK/u7HHQd5KKZL6nDMe1 IIaU=&c=U86dU1uf86yYB3Sr19 TlpfZRQWoRPZbmzGdBmDPj /3kie/.../jTECkDI7sonSMA7yCx1L1v&downloadAs=Firefox Setup.exe

Remove firefox setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.