home

google-chrome.exe

File

DIrect downLoAD gTT

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application google-chrome.exe by DIrect downLoAD gTT has been detected as adware by 15 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup. The file has been seen being downloaded from getr.0116e.info.
Publisher:
DIrect downLoAD gTT  (signed and verified)

Product:
File

Version:
1.9.3.0

MD5:
3f13aa507cebe3c7cb7dc377c15c0c71

SHA-1:
4ef410378a1fcbe83c4263f1cc8dc0e411b44fb2

SHA-256:
b50fb8a8bed13b48d4b54c2493d988ab55d72d8d915286afadbeb92d2ca50a48

Scanner detections:
15 / 68

Status:
Adware

Explanation:
Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/24/2024 2:08:58 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.Outbrowse.BE
5582599

AhnLab V3 Security
PUP/Win32.OutBrowse
2015.05.17

AVG
Potentially harmful program Downloader.GIC
2014.0.4311

Bitdefender
Application.Bundler.Outbrowse.BE
1.0.20.680

Dr.Web
Trojan.OutBrowse.630
9.0.1.05190

Emsisoft Anti-Malware
Application.Bundler.Outbrowse.BE
10.0.0.5366

ESET NOD32
Win32/OutBrowse.CB potentially unwanted application
7.0.302.0

F-Secure
Riskware.Application.Bundler.Outbrowse
5.13.68

G Data
Application.Bundler.Outbrowse.BE
15.5.25

McAfee
Adware-OutBrowse.g
5600.6763

MicroWorld eScan
Application.Bundler.Outbrowse.BE
16.0.0.408

Reason Heuristics
PUP.Outbrowse.Bundler
15.5.16.15

SUPERAntiSpyware
Adware.OutBrowse/Variant
9871

Trend Micro House Call
Suspici.A885EC74
7.2.136

VIPRE Antivirus
Threat.4150696
39486

File size:
1.1 MB (1,124,472 bytes)

Product version:
1.9.3.0

Copyright:
File

Original file name:
Ionic.Zip-2015May14-163256-c4ba6ede-f61f-47d7-b9d0-dda408347d3e.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
OutBrowse Revenyou

Language:
Language Neutral

Common path:
C:\documents and settings\boule\mes documents\downloads\google-chrome.exe

Digital Signature
Signed by:
DIrect downLoAD gTT

Authority:
thawte, Inc.

Valid from:
5/10/2015 8:00:00 PM

Valid to:
1/27/2016 6:59:59 PM

Subject:
CN=DIrect downLoAD gTT, O=DIrect downLoAD gTT, L=Dublin, S=Dublin, C=IE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
32873010301397F02DFA0BC253BCF5A8

File PE Metadata
Compilation timestamp:
5/14/2015 12:32:56 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows Console

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
24576:LbSaE4mvt/zDGbBCapneOyX/F/NB9EA8O7gax:LbSv4mvlSVCapnw91B9Fgy

Entry address:
0x75F3E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
464 KB (475,136 bytes)

The file google-chrome.exe has been seen being distributed by the following URL.

http://getr.0116e.info/.../1431620384/1431620384?58665913867Yl1uMCw2bzovLSktHl43LSs0MSsgZTgpMDMvHW06KSBdLDUrMistNCNbZmJeY2NeOCovLSstLzEwLS0hYGJsZjcrIXJjajgp

Remove google-chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.