home

firefox_setup.exe

Rubira

Quality Install (Alpha Criteria Ltd.)

The application firefox_setup.exe, “Rubira Setup ” by Quality Install (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as the free Mozilla Firefox web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Quality Install (Alpha Criteria Ltd.)  (signed and verified)

Product:
Rubira

Description:
Rubira Setup

Version:
3.6.4.5

MD5:
749d6f4a329ff76d7940df239d8e296b

SHA-1:
b5170abd65e93b7363d8a97340f5356b53c055a8

SHA-256:
a4f626ca164df92a3cc85e5d4293db7460c634e3c00e825f77b2c64006ed6d45

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
8/6/2025 12:40:41 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.AC.Installer (M)
16.7.8.22

File size:
1011 KB (1,035,280 bytes)

Product version:
1.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\firefox_setup.exe

Digital Signature
Signed by:
Quality Install (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
1/6/2016 1:14:15 PM

Valid to:
8/4/2016 3:59:05 PM

Subject:
CN=Quality Install (Alpha Criteria Ltd.), O=Quality Install (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121BA484E4C31175E4A844ED055428DEC42

File PE Metadata
Compilation timestamp:
6/19/1992 11:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:lifk0su4mZWcj82/3pYRA0FRfXVOs8OMBTlP0QjcpMXVJo:spZWcjz/90UWGpf

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9246

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file firefox_setup.exe has been seen being distributed by the following 5 URLs.

http://www.appsworlddelivery.com/c?x=DPNiOcqvVXASfht9hl1jJ7ssneM0U4eV1Y 6fHgVEC4=&c=odO7C5mm2K NYbPVZJ3hJ6qXV11Nf2AD7s rSIDVmow/QCEnZvJiV2djsnzZYPscDc4FUxdX3zJnTIdHpMEZAHljjfCsT 0VHZ6b22XPdh4JY9kRpNLe1mlcoxupZYvG&downloadAs=Firefox_Setup.exe&fallback_url=http://softdownload4.com/s4m/.../FirefoxSetup.exe

http://www.appsworlddelivery.com/c?x=255Vo19h5kM6qKAhDWvGW5ezdfshMFJ11Lb354YJUqM=&c=pgVAWP5Q7CsrSA6wP7JRAkThCzHayhBNKVHxlAkuNYBcIOLdx6G7BKAQUcTdUY9ln1dlQjAgtDeRV3WWAmhdndYXdGrBXvQK86PBHIi/ViVlV5zcWUx6BI1G8ottA6GZ&downloadAs=Firefox_Setup.exe&fallback_url=http://softdownload4.com/s4m/.../FirefoxSetup.exe

http://www.appsworlddelivery.com/c?x=lZCfajO23lAWlHCTVdt00KgrFf5YK233KCdEa0YLsqQ=&c=RsxVbbz1MNbP/LMZZB5aayIiLaD7WwLWnQPt3Bhu4mUiygt M bB2YRkael5QwAGD9irgW6sg7MiwhEBB9j8ZeIECir9XWsi/eJmqwdl9gVtUMVBWvWy3Tf8h1qipuh&downloadAs=Firefox_Setup.exe&fallback_url=http://softdownload4.com/s4m/.../FirefoxSetup.exe

http://www.appsworlddelivery.com/c?x=Poe/xmfC5NgO6Ht9r4BidojWfOp5 PpasHAMo1M5GPI=&c=kupz0aAky777lR6pB8tGSIZzAvgm2CqhampiL U5b2pBZnLGOl1wtsQGX91W1EBhF6trsHArdgzPoBrdffJCs2TmRKJVvktihRAHxfrSkUcHgQw1mtKIwtUIuQGt/Ugd&downloadAs=Firefox_Setup.exe&fallback_url=http://softdownload4.com/s4m/.../FirefoxSetup.exe

http://www.appsworlddelivery.com/c?x=Qrdv6F/W4Znq/8nZHMus3itao0buO16IV02e68 N2QQ=&c=190eo0nL5ljtuFy0EiRi6CD7X2oItTQ2OSOFHtHamJ08epb6z PgDgjFM qrKeeX ljB1nipCzlwXtxyXyhw8zmeXVJ7U5q1dzu/YWkby7u1f4xxBWBkSD67axHuUz/N&downloadAs=Firefox_Setup.exe&fallback_url=http://softdownload4.com/s4m/.../FirefoxSetup.exe

Remove firefox_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.