home

google earth.exe

FIRSERIA, S.L.

The setup program uses the Firseria/Solimba AppInstaller (DownloadMR) which is a monetization download manager that bundles additional adware offers, typically by wrapping legitimate applications. The application google earth.exe by FIRSERIA, S.L has been detected as adware by 33 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars.
Publisher:
Frsera·sl  (signed by FIRSERIA, S.L.)

Description:
Dwnld·Mnger

Version:
1.0.0.20

MD5:
f3dbd7546c45ec92d80075dcd86dfe03

SHA-1:
d29f8b04431a80d506fe290d5e85cc9ebc426b47

SHA-256:
3c11dfd9b1347076ae6678ee75e38501f046f62031de3ea966dfce5bfe51cd2b

Scanner detections:
33 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/26/2024 2:33:48 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Zusy.77453
633

Agnitum Outpost
Trojan.Strictor
7.1.1

AhnLab V3 Security
PUP/Win32.FirseriaInstaller
2015.05.13

avast!
Win32:Firseria-A [PUP]
2014.9-150512

AVG
Adware AdInstaller.Firseria
2014.0.4311

Bitdefender
Gen:Variant.Zusy.77453
1.0.20.660

Bkav FE
W32.HfsAdware
1.3.0.6379

Clam AntiVirus
Win.Trojan.Firseria-2
0.98/20449

Comodo Security
Application.Win32.Solimba.J
22092

Dr.Web
Trojan.DownLoader10.51613
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Zusy.77453
8.15.05.12.06

ESET NOD32
Win32/FirseriaInstaller.A potentially unwanted application
7.0.302.0

Fortinet FortiGate
Adware/Sality.MO
5/12/2015

F-Secure
Riskware.Gen:Application.Bundler.Firseria
5.13.68

G Data
Gen:Application.Bundler.Firseria
15.5.25

herdProtect (fuzzy)
variant of microsoft office 2010.exe (Adware)
2015.8.9.17

IKARUS anti.virus
not-a-virus:Downloader.Win32.Morstar
t3scan.1.8.9.0

K7 AntiVirus
Unwanted-Program
13.203.15889

Kaspersky
not-a-virus:Downloader.Win32.Morstar
14.0.0.2051

Malwarebytes
PUP.Optional.Firseria
v2015.05.12.06

McAfee
Artemis!5053594A980C
5600.6678

MicroWorld eScan
Gen:Variant.Zusy.77453
16.0.0.396

NANO AntiVirus
Trojan.Win32.Morstar.cqhuua
0.28.0.57630

Norman
Gen:Application.Bundler.Firseria.1
03.12.2014 13:20:04

Panda Antivirus
Adware/Firseria
15.05.12.06

Quick Heal
PUA.Firseria.DC4
5.15.14.00

Reason Heuristics
Threat.Solimba.Bundler
15.5.12.14

Rising Antivirus
PE:PUF.FirseriaInstaller@CV!1.9C54
23.00.65.15510

Sophos
PUA 'Solimba Installer'
5.14

Trend Micro House Call
Possible_GENBUNDLER.UNP
7.2.132

Trend Micro
Possible_GENBUNDLER.UNP
10.465.12

Vba32 AntiVirus
Downware.Morstar
3.12.26.3

VIPRE Antivirus
Threat.4782980
39486

File size:
161.3 KB (165,176 bytes)

Product version:
3.0.23

Copyright:
Copyright © 2013

Original file name:
·install·exe·

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google%20earth.exe

Digital Signature
Signed by:
FIRSERIA, S.L.

Authority:
Thawte, Inc.

Valid from:
7/23/2013 8:00:00 PM

Valid to:
7/24/2014 7:59:59 PM

Subject:
CN="FIRSERIA, S.L.", OU=IT, O="FIRSERIA, S.L.", L=Badalona, S=Barcelona, C=ES

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
73C4780FAC0CD497B0778732FB8AF673

File PE Metadata
Compilation timestamp:
11/12/2013 6:07:22 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
3072:LjSkrwevwwuvy6/Dq13YvXZZtLt8gQb6i+w5woutWj/n:COBvwwFz1ohriYoSK

Entry address:
0x73080

Entry point:
60, BE, 00, 20, 45, 00, 8D, BE, 00, F0, FA, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 1D, 13, 07, 00, 57, 83, C3, 04, 53, 68, 72, 10, 02, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 00, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Entropy:
7.8684  (probably packed)

Code size:
136 KB (139,264 bytes)

Remove google earth.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.