home

firefox_setup.exe

Dnldstr_Aggregator Downloader

Download Guru

The application firefox_setup.exe by Download Guru has been detected as adware by 17 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from cdn.downloadbfiles.net.
Publisher:
Dnldstr_Aggregator  (signed by Download Guru)

Product:
Dnldstr_Aggregator Downloader

Version:
6.0.45.34368

MD5:
9e5a00beace0d5e6e92ffbd30ca4c87b

SHA-1:
a4275e81514ae17029a17751bf3d12005900805d

SHA-256:
288e6a26120a66cbcc8efa15c2b12189fafe92126f2f1c09c02eb10e240488a8

Scanner detections:
17 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
5/19/2024 11:53:08 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Agnitum Outpost
PUA.InstallCore
7.1.1

AhnLab V3 Security
PUP/Win32.InstallCore
2015.04.15

Avira AntiVirus
Adware/InstallCo.zlz
7.11.205.220

avast!
Malware-gen
2014.9-160112

AVG
Adware InstallCore
2017.0.2866

Bkav FE
W32.HfsAdware
1.3.0.6379

Dr.Web
Trojan.InstallCore.217
9.0.1.012

ESET NOD32
Win32/InstallCore.WQ potentially unwanted application
10.7.0.302.0

F-Secure
Adware.Linkury.M
11.2016-12-01_3

K7 AntiVirus
Adware
13.202.15603

Malwarebytes
PUP.Optional.Installcore
v2016.01.12.06

McAfee
Trojan.Artemis!75C5EAA4C9BB
5600.6522

NANO AntiVirus
Riskware.Win32.InstallCore.drfvwt
0.30.24.1357

Norman
Kryptik.CDMO
11.20160112

Reason Heuristics
PUP.installCore.DownloadGuru.Installer (M)
16.1.12.18

Vba32 AntiVirus
Malware-Cryptor.InstallCore.gen
3.12.26.4

VIPRE Antivirus
Threat.4150696
38552

File size:
775.6 KB (794,264 bytes)

Product version:
6.0.45.34368

Copyright:
Dnldstr_Aggregator

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox_setup.exe

Digital Signature
Signed by:
Download Guru

Authority:
COMODO CA Limited

Valid from:
1/14/2015 5:00:00 PM

Valid to:
1/14/2017 4:59:59 PM

Subject:
CN=Download Guru, O=Download Guru, STREET="500 Westover Drive #6502", L=Sanford, S=NC, PostalCode=27330, C=US

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00F2561EDD8FFEC5009496B41A4A4D358D

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:3VJcH9XsQ1Q0KVU3KER0e5BgqFq31ztf4JUOQ:3zuXO0KW3pVmd5tVOQ

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8894

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox_setup.exe has been seen being distributed by the following URL.

http://cdn.downloadbfiles.net/?downloadAs=Firefox_Setup.exe&data=ZYfd8ClVSTKyLTVL3LeoQeTV CPgEyeOg TB8nCb/peZJNFNTqI5GzbQrkHpyBrbZsRVLEsu85gB S9I04lukKPulgMn8KZvo2H86KHI9dsALmhoqZXvPmhovVQ6bSiXpHxIAjXCp750pcw ga4sqfwjwjTp/42tPPVrGpM5qjJWwBqu3u9HqDUtqVZk/mx7NgPBNTuUXO/JG/1N8ANXUX/agMXGInxUOL3eNV3hq5YvpdSdabUDGLgBcJ4md53YYjubEsMWJs4ONVS8w5wtjTqvZFl4UEB5e7vxIhgRXp8opYqKbo1ZPV7p8EcJzRBVOoFrT4iXQhL3nkbcYiCC9el3iWaFlEgZFbxOUs6gGfgqihuwoj Dpf9UuCUxCyTt/OzkBY/97Eta4fK9eMR3SA/y43YFXyPzWanWg FfwFMb8oWZDHDPBmzCZI97FsoyYRPdYbWsm 04vOIKGVO7RqVz Y3zWcmQ5pHN/gNhZqZL7rmn3eaDC7rbX2B1j p6nutxMYlhLCU6F7duACySG7ag7 vqB80C5Bne8sH6ry0b86ouE9dYZr1OgqnvwQSFh69Wpqv9SsjBMJMDmJp7FVqGVroywlZDB8Totjw 0kH80aAxsdaOo10U18B2DrQDxsX345oGGkxhoctyTq/0b8zk22laisHrPz6/ZQVUmK OtvbQ9LiKmdvkfzbAjcx1U617W e8xnSlQiVsEtfq6GqmnFmwYfDo6jpJGtzASrnFj1pA8/.../4IRuAWGDEPCgOxKNtL8o5XASftiVBwHsgzD38n5q2 GIsl3bg9S0bu0nTSNQOJc5FxPh7yOjqvjuCVM lSk

Remove firefox_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.