home

google toolbar setup.exe

Internet program

Agile Funnel (Alpha Criteria Ltd.)

The application google toolbar setup.exe, “Internet program Setup ” by Agile Funnel (Alpha Criteria) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.signssafebulk.com and multiple other hosts.
Publisher:
Web Program   (signed by Agile Funnel (Alpha Criteria Ltd.))

Product:
Internet program

Description:
Internet program Setup

Version:
4.3.5.8

MD5:
84085f95b535df577b5ce222db23355d

SHA-1:
b27639673b5f17bec1bf0f64f25d4300d0179c9e

SHA-256:
9f53bbdd49a019b7c3c3ad6506fb524e85dcf8354ea519b6b4abde8108d9a80a

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/27/2024 11:34:05 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
15.12.30.2

File size:
943.7 KB (966,376 bytes)

Product version:
5.7

Copyright:
Application Web installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\google toolbar setup.exe

Digital Signature
Signed by:
Agile Funnel (Alpha Criteria Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/16/2015 5:25:15 AM

Valid to:
9/2/2016 4:10:29 AM

Subject:
CN=Agile Funnel (Alpha Criteria Ltd.), O=Agile Funnel (Alpha Criteria Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121703663FFB88F568A112BD801328BD38D

File PE Metadata
Compilation timestamp:
6/19/1992 4:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:I5PtGKT3T947xcWA3V9qAS98gFN4fDjibF1vS:IdlTa9hAl9pSbF48

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9273

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google toolbar setup.exe has been seen being distributed by the following 9 URLs.

http://www.signssafebulk.com/c?x=bgEHN3zayG0njXu47RT2QDICcMXkFXpgcDYNtVEKXYw=&c=qG89C9ePtq 11B19k7ULnlF/YxQ4rrspkul4J8c14loa/5EqbYTmpbsFdyTiVXCroFkMQb8trL3vBHA6VleYCmT24aLuFJtgaki0w6xcopudV/w5 oi4D5mTfyBthY5BKMfSC4rybnJLGa PML10yw==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.grabupdatebundles.com/c?x=yI6JaNmfzlrgwwZUhO7kaESG/K/4yyc9HS91Fci/UsI=&c=yT3PtCR0uLi8 FpjnkwmD9ll/2FBz8x 3HVMpfCCniPQVlNP7e5RITadYAEayrqkWbCoUYB3pms2umvmHAfa 9ct8y3DXh96KbmxKu7wwi4QRGe6G4caOQK1C1XnqvrxwWbDSqtA3AgJl57TSGdf2Q==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.filescleartag.com/c?x=0t6rtsWvKk5qOvLwVX4uZZ7OxwflYtBbakDRqQdOFgE=&c=fW1izpwuFktIX2At5vDk4rZkW/ p6/yn6cxxV4NV9bgswBuCcvbNNBCcnekLH0Q1SxpYEv5265BBxbCkW8xqEG2deMeT1tJmlxhTRi3H2z1beaasS/AhchZkn1hnkaSlPmQBHglZirkkA3KmtwTQOw==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.signssafebulk.com/c?x=wTG7rYJ387cJdn3Jb5Z7LdFPcrf Yk8gSp3kyWLmZTw=&c=BgQaqh/PgU6ut7NqQ/kSdmWQIyNt82hvcbcrqcIAQX71lGltcfUryQwQ FfIBAo3pqLDOlBEbDOAitjrM6j8VSYjMm3VwF7MEbqUkAOdGxeymEai0UIjEotulUmlsk 3Y3rqTJH5JZ06SaA8iYUwMA==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.currentbundlescontent.com/c?x=5DkAUmMWnbVbnOBhJcRVzTyvagB/epXhFmkQnwJv2M0=&c=FfFC/jlz/1zgy7xvT39z5Z9Z1U0jfl8qDgooMTftVHARZnZitEq5AGHGnZ ZmxXJv2bgnJpO9vv7kgFb7w5Notw2Byv8ZGFOkmJBj7qwgynGKQvQu3OKk23XM3/jCEKvMSSAcg XktdzlqcH5y4z9Q==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.vaulttowerssigns.com/c?x=rnquqVAhormYPWnEG86r3mpfYzxM5Kd34FUS/n9Z1Ts=&c=N7TIQV3uk0XEpX hQYye8XCP2SONoEIz/OWV9ZhX7nZJMHX2elGar0FQcLUVpP/BC/k6a4Q0SEpJkPf0i/mnrNWGZZG23919ghY0gZdLw 4x6HAJrjesBFQGbG 4Gr9c8zHcyaBkdLKp6WhlFsEWig==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.filescleartag.com/c?x=yEvLkkJq7F7Ae4xAoJtQ5pvyHyk5/Ds5G ppObMXGm8=&c=RiGPug1qFWjxOIMIYiif1Zwly7Zb1S9NofqNrU92WclACPpWARxnvAUcEjAy3W drI6V2y6kjpwm bQ92bHJjyqHF0PthhXX2CDK7toYJbqhDZDvN5kveQ0f50BwCJ5Yo mocXoR FwUCTM74pvrVA==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.grabpresentapplication.com/c?x=foBrOKgnW0nq0WZpbJGKIa0kvZJd8i/4Zu 6u1548H0=&c=p/BLqua wxR7IZZBDb5oUHQS Yf5tL/xugXxUy2ebzFdvjMN//SH1yg/jpsjs2yO/j5ARCIIM2OKeFJ4gXdyP100HxSrwI24QNczWAPO9eUw3j4BXXSG6NISCkQd5Bti3RyRiuaIkqcZvh6qrmqbqQ==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

http://www.chuckledownloadstag.com/c?x=EywB8NBo1qLVQgT6wkbrHvgRqm2hDtEQX0AMdO770rA=&c=fRMSM7xBIpcO8C3ifiLfb28KuGnay2bs2/IF1cPuhrQRYRfd3bb0Cvb8tGLUS 3OhWTcvvRLEUlrd 7RBIMxEDldLxPbAeAq8DKsbpxyTO09LZLLvjyrknGNN31q6KDIUID3vuS10 r1xQaSbs9CGA==&downloadAs=Google Toolbar Setup.exe&fallback_url=http://cdn.downtoad.com/.../googletoolbar.exe

Remove google toolbar setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.