home

google-chrome-programas-gratis-net.exe

Installer Internet Web

AgileMax (New Media Holdings Ltd.)

The application google-chrome-programas-gratis-net.exe, “Installer Internet Web Setup ” by AgileMax (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Software   (signed by AgileMax (New Media Holdings Ltd.))

Product:
Installer Internet Web

Description:
Installer Internet Web Setup

Version:
3.4.4.8

MD5:
3e38cfc38421d099adc84fc0ad6ee894

SHA-1:
87b12c3fc02fd576e64913bb54de9a381d204107

SHA-256:
18961335039b49c9cca495515002dd6d793cc1b6727d43da2c274e98bb1e37ce

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/26/2024 8:33:47 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.13.3

File size:
958.3 KB (981,304 bytes)

Product version:
3.1.5

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\google-chrome-programas-gratis-net.exe

Digital Signature
Signed by:
AgileMax (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 6:04:31 AM

Valid to:
10/30/2016 9:53:45 AM

Subject:
CN=AgileMax (New Media Holdings Ltd.), O=AgileMax (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112186313590F7C0AF7C143BC6BDE6200476

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:vKSxgTgYTb5VISBjR4+UL5WwuLCv9yUQ3YuEjHyq8pU:vreTgmVVH/U9WwWCv9yJ3aZI

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9306

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google-chrome-programas-gratis-net.exe has been seen being distributed by the following 14 URLs.

http://www.tourstagranch.com/c?x=3xlZWe IuNNTrWkgabA6MdCY5xZ0l8EPARbA6XnvqBU=&c=m7yJN4IxDjXGamqOFKlcrfMqCM kLCMbL FlC2WuOs2Q16ohwc2Qb6AzDGRrWlCsEtWj4nNRchKFT5/9ziJv1kkwDJ8hF4d/zSaOSCgiKdQ6D8uYuan8VtwgMrFcNpxo&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.giftbulkstock.com/c?x=Az1b8jrcaqe/9SjxXFmqlGYx4S44PkJJ2shJS4dsVzA=&c=0tYwiaZDbg3ebrrZ1 pWrPZEu4am46Y6IHVBJrLwDI9f w1zf2qCmSbXF8hEl6uqCjdt9PWAV5vNd6slCiNB4HtPzCDY0F1oSFNfl3CVp949tGvdqXk3Kw4LOG8myXKa&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.giftbulkstock.com/c?x=zFPQF8n0EaotYjvKN7N2IhwpDjF3TBjwzyfw8/5P4qM=&c=SwOyaL3usv1FoEbFsseHbPyipwjm02YdYYvtNWYMWgYmUEb8Bo7HesAMUj1GYhofmW00LjQnj8EYOjpvAVsGFUDVdI4npc7FxkpxE31kpCbrXrO4JdU6IBOyYkYhB6L5&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=W5ENljE/EuIF3BguA193Ds2zCfP8EWSO09S iHHMtJ0=&c=j0DBWF6h92 htiylD WLqRXKOXcksvm8qSK2nZqxpf3vZ8fsiiz2aUqd2YIrA/UHWga06WRusWwrNu3MwhPHenegWfehLVaXoSxIoNqGMiHfYWdyrB6FJhsU9qfLAXq3&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.giftbulkstock.com/c?x=smz2Rbykybx2ka0380mSwULe pMWytfXY8ylUi5pRaU=&c=tnTh5f5MzRRA7CTdzgy3Su5AK3uKOuz0LvtELnwbi8Mwb4ajBUeja2S3IbtrvoZOouh3p 1lg P4UtFimfhrxdmP0ssN7mB6PNhIN7oHfBdJNQoyNZMySWS1NpdAkGr3&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=CrZMfwrC2fgggtc6T/2X2vqLsVY9wwBphL2 JLXWUSs=&c=5J6axfRrjwZyA7546R1fdn/9PXgIULN1VgVywtXBMoV9kyFmaF8YdUEv QPuFqv5Uaym33iDH74bACcyk0R0Bv/fvxqAKmzO9RZ33toJzuLxxhyXFWMiDUV/84g1t Ck&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=bWK5DicWniuHqU1IjxQoqoyoYVrAoDtH8EiGROh9gMw=&c=VafI3Xrvj/bLtCLHeqfpmhG3E9zyWi4j678mhmlyqZO1WBe96D/3tJ3Aa2 qx9y4rnR2aGO6 Zx0xWPGstbFHGLkrLLvigICth/j axPvp4duJ731zaL05Tj73NMsnCF&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=llrZj2qWYsgL5DWFtbRpag eMhx5UmXnRyUhxYfhxdM=&c=ZVfBVRL0bVpfAft9xifXmkLw2IrQ978WBSopY/QN0HLarddjVJFrIjgoCnNNEUqsp9seFWLu3A2bgie/Y8oQg/R8WLBze7o78uh/QtFeQBSbMaOFbOGCGGvEIxib4l3N&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=rju3QtV3CUqYwaGlGhtiry2Y7dSudEsBM84pGSlROkM=&c=ura19HiW0FfFJCo6WkbVujvT0UQddzoPull08DrcSRCgN08rinL5iJtClBnz4JNOFcmL/wiMFRm7tHzQ7Qn5YM cUGPasJJ7z53cbFyLeZW0ILbE52NfT8TwcklW12JX&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=ZqgCTZQQkKgjHZBgE9tnf8h0aaUd3aV8KbS/xbYl5z4=&c=D3sWi7AD8Qm4prP7Yzl4ba8Hgw4Ja7CjxDW3b9hTU259JIJmGEjFOHRyB53tkrOP68E5HcJVN2u19OJgsDXueX9n9NGR 5F7Z2/8h JHNZ7o/dqOxhoJ2PXP1WlM4mk/&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=WmshsspVDNJlNlKYk93Cax J4k68qhrbmUSLxHlnynw=&c=gk8kUoawmXOAJ9kNaa3b0k1rUukgtELm0jgCbjLgapq5SSp4Br8khC9WK/JhRyDt/bM7r8s/9ue75LG6A DO5WDW3WI 8X/7PO/Ple8xaD n69pOk5wNnHspzm6RGeoZ&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.tourstagranch.com/c?x=yIYf/eD9bsikkLq0zE9AaQlVCmKxwLiykSa0DKl6v/E=&c=xJGzdAjyXFTRBcOPVKru5HCs2MNfUHMga2bLtvcE3askPcU7wIjBzruLLZen6aSLFSfKyPO6ie xo6kGXCUE8eQx4gxm/dyOOR6Irm4JnIROIsQNPypULspGxiWUue7r&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.megavaultconecpt.com/c?x=IJkJmFhycIaQVKgkoNHSE6u21rrHml4ar1vi9 5CHOM=&c=kvibpeFAsclUrihoxaLe2b9xt3L4X843bY7WryX4jXtI 9rvnTufYSkQ6i9MQ6GOox3SxXQcchtG1iORU6UY1NUD1kiH4u7rVa/rfai7NeYadpL43 0bBgvUnFKsZZDv&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

http://www.newsendtag.com/c?x=Z32S38hqA4dbpaitHsRjQ9AVirBoYZvHUajLyU8sSSM=&c=Dw5cR/e9EtRFWpa0jieikpb8r2m6BR6/E7G0sHvxdNfSnnAMRmMQWr5c m1UACCOkjMiEFFnh3wfhJCE4tiJ3Mx9Nmy9MQ5YcgLUPu4gh5Dt3H5zTvTCQk3L/1p4C1Rd&downloadAs=google-chrome-programas-gratis-net.exe&fallback_url=http://.../GoogleChrome_47_0_2526_73.exe

Remove google-chrome-programas-gratis-net.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.