home

windows-7-professionnel-x86-32-bit-francais.exe

Firseria

The setup program uses the Firseria/Solimba AppInstaller (DownloadMR) which is a monetization download manager that bundles additional adware offers, typically by wrapping legitimate applications. The application windows-7-professionnel-x86-32-bit-francais.exe, “Application Installer” by Firseria has been detected as adware by 11 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.
Publisher:
Appsinstaller  (signed by Firseria)

Description:
Application Installer

Version:
3.1.3

MD5:
a602e1628fb2c9a0b6f021a256135ccc

SHA-1:
bf4c3b4b0ea8e212a5785fefc04931a0b8ab8693

SHA-256:
54e3fc867c2010c420894b0a22d95b41f732970ac40fbecb9d1ee108352aa8c4

Scanner detections:
11 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
5/18/2024 6:21:00 PM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:PUP-gen [PUP]
2014.9-140309

AVG
MalSign.Solimba
2015.0.3541

ESET NOD32
Win32/FirseriaInstaller (variant)
8.9518

G Data
Win32.Application.Morstar
14.3.24

Malwarebytes
PUP.Optional.BundleInstaller.A
v2014.03.09.05

McAfee
Artemis!A602E1628FB2
5600.7197

Panda Antivirus
Trj/Genetic.gen
14.03.09.05

Reason Heuristics
PUP.Installer.Firseria.l
14.8.7.17

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downware.Morstar
3.12.24.3

VIPRE Antivirus
DownloadMR
27212

File size:
293.2 KB (300,264 bytes)

Product version:
3.1.1

Copyright:
Copyright © 2014

Original file name:
installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\windows-7-professionnel-x86-32-bit-francais.exe

Digital Signature
Signed by:
Firseria

Authority:
GlobalSign nv-sa

Valid from:
11/11/2013 3:34:44 PM

Valid to:
11/12/2014 3:34:44 PM

Subject:
E=support@solimba.com, CN=Firseria, O=Firseria, L=Badalona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130C3B28D7C9C29B8B07321EF3F8A1462

File PE Metadata
Compilation timestamp:
3/6/2014 4:11:11 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:/5uRH38i5OBwdmR62zdpuQtv3NxjMjtG6ZLlYBk:/0RH3nCwdmR62Vv3NuLZLlYBk

Entry address:
0xE4B9

Entry point:
E8, CD, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 78, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 24, E1, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Code size:
115 KB (117,760 bytes)

The file windows-7-professionnel-x86-32-bit-francais.exe has been seen being distributed by the following URL.

http://dl.downloadsireigheesae.com/n/.../Windows-7-Professionnel-x86-32-bit-Francais.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.