I just went and downloaded the app from that add and compared the checksum against the APK on my phone of the same version (version 42.0.2, downloaded from Google Play)
They both match. (Both SHA256 checksums are D0B5A524ABFD5AD9D73DFF4DA398423CB7B337797FBA0C039F3A44CAE259B4B0, if you want to verify it from me as well)
So that site is providing an untampered download of firefox, so there is no "malware" anywhere.
In fact that site (HTZapps) seems to be a curated list of "safe" apps available to download, an alternative app store much like fdroid or the amazon app store.
It even follows the Adsense guidelines on their download page (clearly called out advertisements, no more than 3 on the page, only one above the fold, they don't interrupt the flow of the page, etc...)