The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out. I'm not 100% sure why some people thought i

The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out. I'm not 100% sure why some people thought it was a malicious file, but the comments on Virustotal mention [1] which, for me, redirects to the legitimate [2] but a comment seems to link it with [3] which is a completely different file. Perhaps the redirection is randomized so people got confused? [1] hxxp://files.dodo-number-1.pw/p/MCLkP8Dzc3nUWJrG9fwGLA,1442015273/zte%20mf631%20firmware%20downlo_10924_i57945825_il345.exe (replace hxxp with http) [2] https://download-installer.cdn.mozilla.net/pub/firefox/releases/35.0.1/win32/en-US/Firefox%20Setup%20Stub%2035.0.1.exe https://download-installer.cdn.mozilla.net/pub/firefox/relea... [3] https://www.virustotal.com/es/file/e6821e86a9d3fb693b32077e6c6fe2d83d830ac75f384cff0dbef279a919b956/analysis/1442014883/ https://www.virustotal.com/es/file/e6821e86a9d3fb693b32077e6...