home

chromesetup.exe

Cokonac

Setup Manager LLC

This is the Softpulse installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application chromesetup.exe, “Cokonac Setup ” by Setup Manager has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Softpulse SoftwareBundler installer. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Bef   (signed by Setup Manager LLC)

Product:
Cokonac

Description:
Cokonac Setup

MD5:
a2708fcb72d93464395f10247e9a55ff

SHA-1:
2f0cf944930a05115f018b5ba32c55239e7bfaa6

SHA-256:
c9c37f5e4ac8c93820e25d83ab5b0b3702426c970a876885256e4393d838188e

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 11:38:03 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Softpulse (M)
16.8.11.2

File size:
946.3 KB (969,048 bytes)

Product version:
2.6

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Softpulse SoftwareBundler (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\chromesetup.exe

Digital Signature
Signed by:
Setup Manager LLC

Authority:
Symantec Corporation

Valid from:
12/17/2015 1:00:00 AM

Valid to:
1/16/2017 12:59:59 AM

Subject:
CN=Setup Manager LLC, O=Setup Manager LLC, L=Wilmington, S=Delaware, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
5B54F9A49482444F2A26324DAC8E187D

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:L7PlaKuc2gFnN2M8ZZyyA4ft3o3yYx6Yh634iy66xfT4HEq:L7NXu/gleZ+4ft3rmj/nxfTF

Entry address:
0xAA98

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 2E, 86, FF, FF, E8, 35, 98, FF, FF, E8, 9C, 9B, FF, FF, E8, B7, 9F, FF, FF, E8, 56, BF, FF, FF, E8, ED, E8, FF, FF, E8, 54, EA, FF, FF, 33, C0, 55, 68, 69, B1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 32, B1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, D0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, C2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, 24, 93, FF, FF, 8D, 55, F0, 33, C0, E8, 66, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
40.5 KB (41,472 bytes)

The file chromesetup.exe has been seen being distributed by the following URL.

http://www.ranchsignbundle.com/19ZKyWkRcT2KxWUknIFOtakYGm9LPuD4nuRS2V2ARfO5nb3OVxlp2 fdv7lwveluNhA6fI6 J2EHdSpG1W7son5AsdsT0slkZ5ysnhKumBkkDTR4LqcigAPjgey5FzEWY6TiXM7RiP rj2EljbKjuXR3nafHuODCp7orYIDxZXCcOhM8hYQGBBKNq34OxMLp_ULZZlTe9PNfHYEtaDUJbFDitFErkD9Ch_ta5j1NIF_FJQq0WctaeAnKll4dUk_zDGbkxjL0aeWLXZqc1gK242fZbBWyZxhwbt2iU2TjcLzTeAGNnwfdbJN0DvaR NynlvTy8nLWWGNV_3P5RS0jRBXGPgyGrv8vEYIC3TCym7VRjlv5tZz8eU11NCnv9Iwm_DorQ5Ptp_oLL2VP8KFhng_8QzABR9hclJi6J3Dej4Td35cIM8gkU4icZSzX9TnUJgAFQ9C9mtgwnWIl4RL0prmT4U1GcFaMo16rOSbuMlGmKg35eWUO1F2iEwEZzQ64UpusKpSxZhVSY8kQI3U69JlgGggVWDp eQAq7DmnehHDvkcTq9R 0eYn0jQw46hJxsmwFbIYgwNlXn0PbKDEiR4w4RNOoxTdD5mmwwrnbfCtCOFTjSRw3wRFUNtJ6sHGSUSOdnONXzdnJgA2HJPOTrJixL7y D81RI WzDEMn13STzpzkdF7rU3F553xM8jZ3EkbcJM55T9flmEgAip5wKR4AOh47LjD2_HuSztvEzV5pD8xDLEsJNOTZeciTGCdyIrvZDiLPhL1nhKtJfahMNNt8sIkp8XYpU_oF1yVFmsJ0beIymEYfUJb gwDEgiSHeoDpUS0RQBH2i9HzOB RtAI0bDWww==-CwmAc29mdGdyYXR1aXQuY29tLzQwNAM=

Remove chromesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.