home

google-chrome.exe

Installation Wizard

Advertiso GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google-chrome.exe by Advertiso GmbH has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
SecuredDownload  (signed by Advertiso GmbH)

Product:
Installation Wizard

Version:
1.0.13.24053

MD5:
a284f74b286dd0646fd31df7d63aefa0

SHA-1:
89bb213d2b0682f65c597c34c51d546c05715b43

SHA-256:
c28cb776b0ff9f3ff559359d5512aee077205579eec6c763311482b173989aad

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/23/2024 5:35:20 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
17.3.14.21

File size:
1.2 MB (1,215,400 bytes)

Product version:
1.0.13.24053

Copyright:
SecuredDownload

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\google-chrome.exe

Digital Signature
Signed by:
Advertiso GmbH

Authority:
thawte, Inc.

Valid from:
11/17/2015 1:00:00 AM

Valid to:
1/16/2017 12:59:59 AM

Subject:
CN=Advertiso GmbH, OU=IT, O=Advertiso GmbH, L=Hamburg, S=GERMANY, C=DE

Issuer:
CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:
0F837C8E75B288B7DC9955680D7F11D7

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google-chrome.exe has been seen being distributed by the following URL.

http://www.bitstagcontent.com/TGG2RkFIr7_I05DTkjCHd sS9O6_8xybAAzDZcS_DYpGqdRWPF_7oBz78a3qA66UtXXXKDqa6RHoEfAsBMVH7CtPMrtrFqeA3wfIPYXhXyfX2o8V0ctVO4FTjiWOp7NSoqcvTB0T4GGx1QGFTr2BNAdzrtUZpD15bzyeRHrgry3RNX3Mn1Xi poMEPB4TADF9jx3 5FIlIS4A6SlvFZZepm7x_UYNXIgRcv8KmCrDOZYncpr5rvfLHZFzhtYfZpKuq5MfPjc0__AupQBCUAW 9iwi4VQiDNABlT3k5WVLjSs_kV3HTu5cX9pxlUUBbhLlhPBVsk_TmRbTm3HySkZgI64IPI2qGW5Sws1FJ0qbb_7FipFAXElC8tWp8Fq4UiPYBCCANZ4YxLNV0cbAwggppuAk6Fz9EaIkBKrBetEFcSImXbarM_GLck0LAhXmqaPYV7BUdU2b7REsDiIBOt6SLPFeMPU6Ijon62shQ8bxEhhsf dkaqYgERld8RVqxRL7t99yJDP4BS3ehf7cRjIFimj_vogssFwW0XXIpaqzJDAtc_4VCIQSTckxKixst9ucFFYuiJIBBA3rXJI7FUCgqVkVeHeRsRJVLYhmZauGm2FnfJQw7p2wtEmUI X oDLwAehnxmUvY tHMfo0cajaVpjAsODXJVGem7OLNE9mz GEjjlzFrbLZhcZFHtxMSNNtPjmpAW9dENto_5C3PDDPGzdRndABvluFz2CshWuZxOK9l toCIsmyXtOHUn3rZZytjUiSsZKSQR8 LkkSVVe1RjFQ4vVykMmEFJC HKV jYyHSaJLoNVP57NctbWyFyjk8oV16YJGchYqW6wUzTJ3GnbnyKwVW5TcVh3q_ygcGHipAq71A2GurDnaY517wCetXM_fZZU9FRknwrKNE0xsl0PRdX86JK038d9TRgbcn9UrM09oofvzwMxHG0EwhWBwNFqbYOZ

Remove google-chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.