home

firefox_setup_17.0.exe

Secure Installer

The application firefox_setup_17.0.exe by Secure Installer has been detected as a potentially unwanted program by 9 anti-malware scanners. It uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from downloader.ez-download.com and multiple other hosts.
Publisher:
Secure Installer  (signed and verified)

MD5:
394f7c2ad8f47a79acdeb7e51447549d

SHA-1:
df89b335ecec938667895e29e326e485435c1d55

SHA-256:
d6ea4491b130060f7103d9ab4d3de7aca5a3580b069b451deec273920ede44fc

Scanner detections:
9 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
4/18/2024 4:41:37 AM UTC  (today)

Scan engine
Detection
Engine version

Avira AntiVirus
ADWARE/InstallCore.Gen
7.11.130.92

Comodo Security
UnclassifiedMalware
17761

Dr.Web
Adware.Downware.693
9.0.1.089

ESET NOD32
Win32/InstallCore.BA (variant)
8.9401

Reason Heuristics
PUP.Installer.SecureInstaller.R
14.3.30.16

Rising Antivirus
PE:Malware.XPACK-LNR/Heur!1.5594
23.00.65.14328

Sophos
Install Core
4.97

Vba32 AntiVirus
Adware.InstallCore.gen
3.12.24.3

VIPRE Antivirus
InstallCore
26326

File size:
1.1 MB (1,104,520 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\firefox_setup_17.0.exe

Digital Signature
Signed by:
Secure Installer

Authority:
COMODO CA Limited

Valid from:
9/24/2012 7:00:00 PM

Valid to:
9/25/2013 6:59:59 PM

Subject:
CN=Secure Installer, O=Secure Installer, STREET=720 Market Street, STREET=5th floor, L=San Francisco, S=CA, PostalCode=94102, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C3507C1ADDE6B4C52E5426990F85CA2B

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:FRHeEM4AAIo/Lv+KzovgWoUK2l+Q1bJdYavN2L+aoyawXry95U:39M4/IGv+KzovgWoUDl+Q1bJdYavNAiU

Entry address:
0xCCEC0

Entry point:
55, 8B, EC, 83, C4, F0, B8, 40, 96, 41, 00, E8, 4B, E8, FF, FF, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
6.8601

Developed / compiled with:
Microsoft Visual C++

Code size:
837.5 KB (857,600 bytes)

The file firefox_setup_17.0.exe has been seen being distributed by the following 6 URLs.

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1355066996&r=/.../?kw=firefox&subid=EZFFIT&cust=mozilla firefox&type=firefox&gclid=COaw3bDTjbQCFQEd3godczUAuA&utm_campaign=EZFFIT&fwd=1

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1354838316&r=/.../?kw=firefox&subid=EZFFUS&cust=firefox&type=firefox&gclid=CNeytrn_hrQCFUWnPAod-gcAsA&utm_campaign=EZFFUS&fwd=1

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1355329982&r=/.../?kw=firefox&subid=EZFFUS&cust=mozilla firefox&type=firefox&gclid=CKimko-nlbQCFYKPPAodBzMAlw&utm_campaign=EZFFUS&fwd=1

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1355263475&r=/.../?kw=mozilla &subid=EZFFBR&cust=mozilla&type=firefox&gclid=CISzhq2vk7QCFQGvnQodXi8ARQ&utm_campaign=EZFFBR&fwd=1

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1355291703&r=/.../?kw=mozilla&subid=EZFFUK&cust=mozilla&type=firefox&gclid=CNif08GYlLQCFW_KtAodDzoAEQ&utm_campaign=EZFFUK&fwd=1

http://downloader.ez-download.com/?id=9527e2a6879911e89a89c8977cfd2a9681f77e59B&ts=1354957840&r=/.../?kw=firefox&subid=EZFFIT&cust=mozilla&type=firefox&gclid=CJ-v_dy8irQCFQ1Y3godxQEAPA&utm_campaign=EZFFIT&fwd=1

Remove firefox_setup_17.0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.