home

firefox_setup_17.0.1.exe

The application firefox_setup_17.0.1.exe has been detected as a potentially unwanted program by 10 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from downloader.ez-download.com.
MD5:
e291d166b99d580892187c58fe4a865d

SHA-1:
31b8006b0d6868acd0b0aaa2c6be9646b63479c8

SHA-256:
b097b85c51a8a7bc9fbc5ecd4c7f14abbf449c78b471b0a469b72851cdd2834e

Scanner detections:
10 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/19/2024 2:56:46 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Strictor.97895
5707314

AhnLab V3 Security
PUP/Win32.InstallCore
2013.02.23

Avira AntiVirus
ADWARE/InstallCore.Gen
7.11.62.92

Dr.Web
Trojan.Crossrider1.49350
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Strictor.97895
10.0.0.5366

ESET NOD32
Win32/InstallCore.AZ potentially unwanted application
7.0.302.0

F-Prot
W32/InstallCore.S.gen
4.6.5.141

Norman
Gen:Variant.Strictor.97895
10.12.2015 10:48:50

Sophos
PUA 'Install Core'
5.22

VIPRE Antivirus
Threat.4786018
45744

File size:
1.1 MB (1,203,848 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\firefox_setup_17.0.1.exe

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:W2wFY1jQwdY9jIe9iUcgGSnsJ473P+1W0b9jRmY:vwGskYR2SnsJy3Pih

Entry address:
0xD6970

Entry point:
55, 8B, EC, 83, C4, F0, B8, E4, 94, 41, 00, E8, F4, D9, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.7107

Developed / compiled with:
Microsoft Visual C++

Code size:
869.5 KB (890,368 bytes)

The file firefox_setup_17.0.1.exe has been seen being distributed by the following URL.

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1357093469&r=/.../?kw=mozilla foxfire browser&subid=EZFFUS&cust=mozilla foxfire browser&type=firefox&gclid=CIbpnvLQyLQCFcKPPAodAFYAxw&utm_campaign=EZFFUS&fwd=1

Remove firefox_setup_17.0.1.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.