Very odd: ARTUR.DUBOVOY@GMAIL.COM.XPI detected today

[PeterCascio]

Hi,

This is a bit odd: I have Malwarebytes set to run a threat scan every day at 17:00 EDT with update beforehand. Today it reported ARTUR.DUBOVOY@GMAIL.COM.XPI which is dated 3/20/2019 on my hard disk, and when I open it as a ZIP file everything is dated 3/18/2019 13:47. Nothing unusual in the manifest.json, but I didn't dig around further.

Thought it might be a false positive because it only showed up today, with the latest updates installed.

Peter

-Log Details-
Scan Date: 5/8/19
Scan Time: 5:00 PM
Log File: 3e2cb0ea-71d4-11e9-b5a0-30b5c203ed65.json

-Software Information-
Version: 3.7.1.2839
Components Version: 1.0.586
Update Package Version: 1.0.10518
License: Premium

-System Information-
OS: Windows 10 (Build 17763.475)
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Scan Initiated By: Scheduler
Result: Completed
Objects Scanned: 318543
Threats Detected: 1
Threats Quarantined: 0
Time Elapsed: 31 min, 19 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 1
PUP.Optional.RemoteInjectionFF, C:\USERS\ABC\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\WYHNSOSR.DEFAULT\EXTENSIONS\ARTUR.DUBOVOY@GMAIL.COM.XPI, No Action By User, [1754], [680966],1.0.10518

Physical Sector: 0
(No malicious items detected)

WMI: 0
(No malicious items detected)

(end)

[PeterCascio]

ZIP file attached. Didn't see that option earlier.

Peter

artur.dubovoy@gmail.com - Copy.zip

[Fatdcuk]

Hi PeterCascio

The extension was found injecting a remote script which breaches Mozilla Extension rules.
https://bugzilla.mozilla.org/show_bug.cgi?id=1549444

So this is not a false postive detection but now considered PUP.