home

chromesetup.exe

Sehihacob

Setup Manager LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application chromesetup.exe, “Sehihacob Setup ” by Setup Manager has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Setup Manager LLC  (signed and verified)

Product:
Sehihacob

Description:
Sehihacob Setup

MD5:
576425613c32c382fb3282c822b23121

SHA-1:
09e2df1bdb0fd7031a6e4faace1ad6f27fd5de7e

SHA-256:
de97f99b6c2a7b9becc4ec3faa475dcf37d2b55e69e205045b0117969be54de1

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/25/2024 4:28:40 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.11.0

File size:
941.3 KB (963,848 bytes)

Product version:
4.7.9

Copyright:
Installer Software

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Language:
Swedish (Sweden)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\chromesetup.exe

Digital Signature
Signed by:
Setup Manager LLC

Authority:
Symantec Corporation

Valid from:
12/17/2015 1:00:00 AM

Valid to:
1/16/2017 12:59:59 AM

Subject:
CN=Setup Manager LLC, O=Setup Manager LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
5B54F9A49482444F2A26324DAC8E187D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:EisVRT1mw0cadUJfX9deO+a2jvMlvcAb+H:5ORT1fJaUNaO+a2QeA

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file chromesetup.exe has been seen being distributed by the following URL.

http://www.ranchsignbundle.com/ftwj9A7RiZHH3hA5w7VY77CSyceFkJx5mF5VwlbUD_QoziC62YkvtAsaAnQcA6m8vD5RYnBDpsmoBOZp9DANXKWO_s39yMMHo8oCPWNx04R1EH ROpo1qbiwq3T4agZn6uyTlVf2F qktJoumRBlHKzh_nviWCzyjRRZgsvf0yN5b_KalzNc 2kvgFGiTSMu52eI_JFA4UnzGtlofPTZ4NN9LS86BwLxA6i718SyYzo6W4x0KgRQC343j2hQ9SjP5kyt9X5K NM_2RWV3e8ChDuzTRRCrSG1AfS4r76ZM4BkB2lPJufoyPx0sPH3tZic3x4_lGqTZIKlkvyfFAqeOcA63phi7g5aiaqzdDcUWxLIEdZRG2CWERkA0JDvRdZzJ2kCWbJ2OYuzfFRxiJXJeg0_lHucWd7hwlQ9mRR6ycPMUEawNdY2iRN9KC8h7snxfTVXBBzoca7a30y k6JjjQgTw_0BIsWnG4zmzdCec6V3KCs1DoguGrjco2TvAtNI2lfskwpyqGJO0BtHU6D0dlgsL6uS2HGbQRebJ5B93dxOLzl9PKUgqE1ubCsR3osS1g2DDpHd9UMpaLF xOBnDxznPz7aKC1c49NSgVDNrOGsLl6R0qcfgLytKHmIEkLLrF3qtDapdAF2s 1xte50Axa9gigQ4nXmTpi6IwV9_ax JkdwyofMf7vYKTnCfgvWRZvj8ip2Ll 7XPJ6__Qd2qtQO eG7rFFnPuRpNDaEGbNWxH7Afbs9gSDYSahwojDZhZ0Tsg5146BVYp1ibD7M5esDtj5OPi77zgr7KxbTTm4SLzvPym6N5yWQhtx7FwJ1pUHfficL3rhd60DNPn6gjU2jUwiqYsBo74bjKPiDhGpYGNZJ9Y=-CwiAZnJpYWZpbGVyLmNvbS80MDQD

Remove chromesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.