home

chrome.exe

Program Setup

Advertiso GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application chrome.exe by Advertiso GmbH has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
SecuredDownload  (signed by Advertiso GmbH)

Product:
Program Setup

Version:
1.0.5.a0.1_62513

MD5:
890c72fd21e75915d4596906bc1d0164

SHA-1:
7ce7a2ea10716fcb8b0f7867a5f99b1892797f4f

SHA-256:
f745e425943c06bcc2b7ea75b03fd204959480606adb63f13a15d594ac6197e6

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
12/25/2024 6:53:43 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.8.11.6

File size:
928.4 KB (950,648 bytes)

Product version:
1.0.5.a0.1_62513

Copyright:
SecuredDownload

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\chrome.exe

Digital Signature
Signed by:
Advertiso GmbH

Authority:
GlobalSign nv-sa

Valid from:
1/29/2016 7:18:13 AM

Valid to:
2/28/2017 6:18:13 AM

Subject:
CN=Advertiso GmbH, O=Advertiso GmbH, L=Hamburg, S=Hamburg, C=DE

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DC03319C2856FEEAC8C45933D49AAE7A

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:ziY9c6T9vd3Xl7XVBKIQC3C/7pqYD2yZ2XHxsju/bDuiRORr+erEC0AWh8DsJ7uK:ziupRX1bEraNXH/DKRr+Fk6xcJ4oBWYI

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file chrome.exe has been seen being distributed by the following URL.

http://www.bitstagcontent.com/tPCYMsBPVcyoNH0eAUpaWYx23gkS2bOULDpx6zFKPjxMvaJFXPrC05TZym5fsWWpUmGgasx0XGeo7pzgZhEmGXGrYguSBH9QNZmBl20L6ddzXDhxv1ci5EQ0lgmsbRbo_nz99Tdj0vC0WFZM3kRpGDNvxSS2qHinT4vX6Os6bqsKqOT1UWd_bfPs5hWYE2sjIjkrE383lrHLN3YehsBJxKbZmQMQir0imvLoJsSZer CivzdrTj 0yCEv RG0pNJir456JwTtPOXIubYM2rgFbwM5oJpwNuU1oeYwo6kcu8WIwR4qWat9_FYkuZoF1ZMi4x1OKJ99ecW9JID0yj FXtkJKbBSdcIlVFyv38b536IQzIoaUAo8lgYyak4bIosljgWueO3dfzKXSG0dDAWFUtrpQn_KTIRIn8mmbQl4MwlScKz gR_sHHK_NkMBP1fDvUvtp7RSUT0TEdZFaLTdTL1_F6t1gIKPDGt_DHfi hOlwAZFd3Q5LN7bKrLkkVNFPVP89_YaaKCdOP7msC0duqlewVpw1EURsDOYdJLJVqj4UoCM ShGoLxcC4ugBsF6FKYJnyElkKjdjcMlGsR CM3 8i8dIrTOmuMQjT7fswnfWrIMpGPWkjsWTBj_p5uREsDkza7J9Uie9mzcA4tBVi3bE5qp_w73ts6k4WPwDx 8gwIFKlD7XMXsrfW6fw4_Tj0Z 3HH4s4qTs6_Tbh0HkIhSzE7fZS8Fn69PhnT8pyyD1K8lONWrqKGABhn7fdDqcZwvMuBAailktNrp6b11pue80hYw==-G0wAAGR3npfNZsHtONcvZeWSQoENOHAqkAUHsQGHjbEzFYqIN1YUR2kkxkEuzIJ1Tqx6 xr9vWr37RYEPFCWBEQR7Bs=

Remove chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.