» google-chrome.exe
Overview
Analysis
File Details
Downloads (1)

google-chrome.exe

Program Setup

Advertiso GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google-chrome.exe by Advertiso GmbH has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

google-chrome.exe

Publisher:

SecuredDownload (signed by Advertiso GmbH)

Product:

Program Setup

Version:

1.0.5.a0.1_62513

MD5:

6f8f93c3bfdf1d12407b8fb4bc0d5186

SHA-1:

5e6e475822214f88e2ff4107b44047ef82a46c09

SHA-256:

5297de78ee677f3ab1efa8f8f78638656a9081e39779be2f0f7b2ecbdc480c5f

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/27/2024 4:26:29 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.installCore (M)

16.8.11.3

File size:

928.4 KB (950,648 bytes)

Product version:

1.0.5.a0.1_62513

SecuredDownload

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\google-chrome.exe

Digital Signature

Signed by:

Advertiso GmbH

Authority:

GlobalSign nv-sa

Valid from:

1/29/2016 1:18:13 AM

Valid to:

2/28/2017 1:18:13 AM

Subject:

CN=Advertiso GmbH, O=Advertiso GmbH, L=Hamburg, S=Hamburg, C=DE

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121DC03319C2856FEEAC8C45933D49AAE7A

File PE Metadata

Compilation timestamp:

6/19/1992 3:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

12288:XiY9c6T9vd3Xl7XVBKIQC3C/7pqYD2yZ2XHxsju/bDuiRORr+erEC0AWh8DsJ7uK:XiupRX1bEraNXH/DKRr+Fk6xcJ4oBWYI

Entry address:

0xA5F8

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55... 
[+]

Entropy:

7.9370

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

39.5 KB (40,448 bytes)

The file google-chrome.exe has been seen being distributed by the following URL.

http://www.bitstagcontent.com/I2QJiWFzLqDjcmTUNEoOWcvpUNijrC4ax7DfVO7pzPjWNCC kitv2PgNh7IYFjN3b7uLtEzaRP88Cqhs5I1CWHKXP3cceXa3iiAWaESli8VTuwsq pppvPa85KjaZjc1wFbp NV JYcL9KsigBKKD2tL6l_6EQjDPVPrh4m4duC2Xe5sNEXYgsVbpEzf 22mZd_4a63xqCyPj_Pw7rxGfn4vuTEc4AdrbppeuuKWybQmYIyuLEVZwbAUjfj6iz4S0W2igWifLAhdNep HqnDzwxr8v2UMhQrb4uD5Hx9w8hk9cJIy9wgmanO0ao synphKHAZ _BDabOyBTQlmAW71 eiGmlyfU8LeYwokpeu6WM5 Lo1t0NuXoJ2IjpkJ2SxmOwcgihdISg3tOaiT_2rujlna4XSnz9nSTIcr3Oet5O fnk6eKP4X2lJ5917xaWksXREoQjcFfecR_dsLTcbpCnc2riBpcDsv5I47QPKb96dmiTi_ME3WIBSDuv2ct0YZ8ooPwMKIQak NgLzi3ck_2 cBtmFJyPg2lFeE63fSho6_NglRZOqF1VUCZ3D89X98jzYMwOEWMmdJNpCah9NZU7O9lF2Xg86Z2iIh_pUcQxMuQ9Bf2Nc89B5OwCFZeny_2lOEMjd6LLIGW _L5JB2A2qOFYJu2QPOL0k6U_ZAl2MCJ_gcgSZBqCliZlWLPJt8EN5SK_FhF2SQP_wLJ_6YcgqA7Szjvo4nCFQyCJMJRMt0zJu4atGazmckAjNLPtK1gWaK4cRWXJpM2RRHRMynsSWbKFw==-GzgAAEQ3F5NzKqLmpyy8vxw24MCpQCIbBIfJ4XMWMeONFSVWI7FPY_TcfV1vEJYkyrF_AQ==

Remove google-chrome.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.