home

ftdownloader v7.0-firefoxinstaller.exe

FTdownloader V7.0

installdaddy

The application ftdownloader v7.0-firefoxinstaller.exe, “FTdownloader V7.0 exe” has been detected as adware by 7 anti-malware scanners. The Firefox Installer is part of the Crossrider toolbar platform and is designed to install the Crossrider plugin within Mozilla Firefox. It will also manage the Firefox SQLite connectivity. While running, it connects to the Internet address stats.srvstatsdata.com on port 80 using the HTTP protocol.
Publisher:
installdaddy

Product:
FTdownloader V7.0

Description:
FTdownloader V7.0 exe

Version:
1000.1000.1000.1000

MD5:
30339bd78f57f3d9693ace41a9dd8f86

SHA-1:
3354f486fcdb6f4cce0654c7e4c342d17a432170

SHA-256:
900250998959c9fd904589e089b69965343c25d0fe8757a5b8fe7aa3fbc2f697

Scanner detections:
7 / 68

Status:
Adware

Explanation:
InstallDaddy bunldes adware such as toolbars and unwanted browser extensions.

Note:
Crossrider is the owner of a platform that enables the creation of cross-browser extensions by developers but is not the owner of this detected application.

Analysis date:
4/29/2024 6:47:28 AM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Adware.Win32.Lyrics
4.0.3.1422

ESET NOD32
Win32/Toolbar.CrossRider (variant)
8.9430

herdProtect (fuzzy)
variant of apps hat-firefoxinstaller.exe (Adware)
2014.4.4.19

Malwarebytes
PUP.Optional.1ClickMovieDownloader.A
v2014.03.04.05

Reason Heuristics
PUP.Crossrider.installdaddy.b
14.3.4.5

Trend Micro House Call
TROJ_GEN.R00UH05B514
7.2.63

VIPRE Antivirus
Crossrider
25456

File size:
866 KB (886,784 bytes)

Product version:
1000.1000.1000.1000

Copyright:
Copyright 2011

Original file name:
FTdownloader V7.0.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\ftdownloader v7.0\ftdownloader v7.0-firefoxinstaller.exe

File PE Metadata
Compilation timestamp:
12/29/2013 4:38:13 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:UQ+ddcWHHXWJnEra/bSxxESSQpx4wA+0t6Tl5qW04RS9epbcMvTWAdw9OpTp0S:UQWauSE+/bSxxEL4vxiepYMbyCT

Entry address:
0x92260

Entry point:
E8, 99, EF, 00, 00, E9, 7F, FE, FF, FF, CC, CC, CC, CC, CC, CC, 55, 8B, EC, 83, EC, 18, 53, 8B, 5D, 0C, 56, 57, 8B, 7B, 08, 33, 3D, F8, 81, 4D, 00, C6, 45, FF, 00, C7, 45, F4, 01, 00, 00, 00, 8B, 07, 8D, 73, 10, 83, F8, FE, 74, 0D, 8B, 4F, 04, 03, CE, 33, 0C, 30, E8, 53, A1, FF, FF, 8B, 4F, 0C, 8B, 47, 08, 03, CE, 33, 0C, 30, E8, 43, A1, FF, FF, 8B, 45, 08, F6, 40, 04, 66, 0F, 85, D0, 00, 00, 00, 89, 45, E8, 8B, 45, 10, 89, 45, EC, 8D, 45, E8, 89, 43, FC, 8B, 43, 0C, 89, 45, F8, 83, F8, FE, 0F, 84, EE, 00...
 
[+]

Entropy:
6.5436

Code size:
710 KB (727,040 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to update.srvstatsdata.com  (69.16.175.42:80)

 
http://update.srvstatsdata.com/installer_updates/004852/update.json

TCP (HTTP):
Connects to stats.srvstatsdata.com  (176.32.99.41:80)

TCP (HTTP):
Connects to app-static.crossrider.com  (69.16.175.10:80)

Remove ftdownloader v7.0-firefoxinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.