The SHA256 of that file is exactly that of Firefox Setup Stub 35.0.1 (Win32), so of course Authenticode checks out.<p>I&#x27;m not 100% sure why some people thought it was a malicious file, but the comments on Virustotal mention [1] which, for me, redirects to the legitimate [2] but a comment seems to link it with [3] which is a completely different file. Perhaps the redirection is randomized so people got confused?<p>[1] hxxp:&#x2F;&#x2F;files.dodo-number-1.pw&#x2F;p&#x2F;MCLkP8Dzc3nUWJrG9fwGLA,1442015273&#x2F;zte%20mf631%20firmware%20downlo_10924_i57945825_il345.exe (replace hxxp with http)<p>[2] <a href="https:&#x2F;&#x2F;download-installer.cdn.mozilla.net&#x2F;pub&#x2F;firefox&#x2F;releases&#x2F;35.0.1&#x2F;win32&#x2F;en-US&#x2F;Firefox%20Setup%20Stub%2035.0.1.exe" rel="nofollow">https:&#x2F;&#x2F;download-installer.cdn.mozilla.net&#x2F;pub&#x2F;firefox&#x2F;relea...</a><p>[3] <a href="https:&#x2F;&#x2F;www.virustotal.com&#x2F;es&#x2F;file&#x2F;e6821e86a9d3fb693b32077e6c6fe2d83d830ac75f384cff0dbef279a919b956&#x2F;analysis&#x2F;1442014883&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.virustotal.com&#x2F;es&#x2F;file&#x2F;e6821e86a9d3fb693b32077e6...</a>