home

chrome_setup.exe

Dnldstr_Aggregator Downloader

Download Sphere

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application chrome_setup.exe by Download Sphere has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Dnldstr_Aggregator  (signed by Download Sphere)

Product:
Dnldstr_Aggregator Downloader

Version:
6.0.45.34368

MD5:
6e71e3dd895cb63a0a932db4dd7a4ec5

SHA-1:
75cb48829eafb2bc619cf0ab2847dc5284b7e4bf

SHA-256:
65627c203857e68292fd203f843a95f7ed1b4b84bbf350df71a61f39f05ebbdb

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
12/25/2024 8:42:46 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
16.7.15.9

File size:
773.9 KB (792,480 bytes)

Product version:
6.0.45.34368

Copyright:
Dnldstr_Aggregator

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\chrome_setup.exe

Digital Signature
Signed by:
Download Sphere

Authority:
COMODO CA Limited

Valid from:
1/8/2015 6:00:00 PM

Valid to:
1/8/2017 5:59:59 PM

Subject:
CN=Download Sphere, O=Download Sphere, STREET="1732 1st Ave #26525", L=New York, S=NY, PostalCode=10128, C=US

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
09ED318A28B41FD6E81D57ED46FD6A2D

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:6RhMX6Ur/VzdyjW6cvUTOQBOWwd1jODAAi:67of/VJyC6cMllwPjuu

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.8854

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file chrome_setup.exe has been seen being distributed by the following URL.

http://cdn.downloadzonefiles.org/?downloadAs=Chrome_Setup.exe&data=6j31W6nqtuMiNdX46cKt/ ddPpK o3kk35PhObpSn dMYZ8F/YlTRNNmRh13jbWHZ1wAUlGS/ktD36Ji8Nur DNr30mUW2O5s6tpQC4Y48kYLLO8nr1Wlmmldmg2yytK3ZSEupNcytch/LmtMiEOoznz/gJCjNBT8LKf/59/LHOKI3bXMVUWfGcBMqVzyZwHgzDNra1QktU00M 2JQr3mwr5IqCL1eZu7eCtDVuygPzCYga7Q/8kjtu6WwtMrN/D6bfgarmdJsmb2MmGxnsDd5S2y7FO/iQLRD4nj28XlmHXP7JESczrkkkgipD5kIdFmYJpxP3NT9upXNyRVgl 1rwjLnP3qd2SjRxGGoI1NpPtKWCwABlDbunUTkacfraFTcIfGvGI41gtTV2XI mC8kSLBX9Zpr K/PZKa1Whx1sJLsby7zEEAsBXaQkqmF1m 4poeTS XiYjXsh3u9MHnRi4mmoNYOogPx6Lh/K SyNpmkXYwZ0Oku1/wMwgj6sBcEfhA/qtw8mA5 vXqu7u RHuJyO6kTWWoI058c92x969Dx0z7H7XliV/5DEBLCuI9Q2aFyR1VGAlfVw9ROEmiFRpFJnPC6dllBv2Cc2TIfkBKR0Th 3 wGsaB4fJPf8Hg/LMmtkxIcceL7I/IZpM4k7342VfkEyclKnCL66wuuqmH76qdZpWkHR44L9ayutlzVEuqKvVlX5 E1RQZHXcoj1JqGxLabglSuPfF4FOw1Bz5j5OVYvEgDnfTRiFt/rI5HH6qtN9xicZvz6Cl h1YBnTemyZwTCUFCXooigeSh/Lu/dAHRnLj7e6r409mCplK8cSTTPa45Kza2a1JN3mAcSFphHvDAj2i gdDjrfP5ZCfPq5 5LdNAxqA9mt80xg5/fYsLbm42xV R7KIYX/.../LLVvdGm7w

Remove chrome_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.