home

google_chrome.exe

Installer

Prompt Funnel (New Media Holdings Ltd.)

The application google_chrome.exe, “Installer Setup ” by Prompt Funnel (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Generic installer   (signed by Prompt Funnel (New Media Holdings Ltd.))

Product:
Installer

Description:
Installer Setup

Version:
3.3.1.7

MD5:
e8c472bb925e4855d6ffdd9b9ddc0b9c

SHA-1:
c26597dea1eb585ff2f7d11feef5c039afc4ca52

SHA-256:
041dc660fedcfebac7f9ce75ea228db1ed6dfd577c732f85f9b6544438e86263

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
1/1/2025 4:27:42 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
15.12.31.5

File size:
962.1 KB (985,224 bytes)

Product version:
4.1.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google_chrome.exe

Digital Signature
Signed by:
Prompt Funnel (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
10/30/2015 9:05:08 PM

Valid to:
10/30/2016 9:05:08 PM

Subject:
CN=Prompt Funnel (New Media Holdings Ltd.), O=Prompt Funnel (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E192A11C95AAEEB64ABF0A45A725DEA8

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:XNxpIJFozfhCRmTNgk490fK0qIUt0/Sg5yGBFvg0JbnH7OyA3QX/:XNEozHTNg1nzmMKFvg0JDCXO

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Entropy:
7.9295

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file google_chrome.exe has been seen being distributed by the following 20 URLs.

http://www.flashconecptvault.com/c?x=cbBLVNt2VQNDw01XVC5kAM1nNAxA/41622sS2B7e9oY=&c=tZGsYvgYBKLC9GTE1lOoHa1N/kK2eo3Yl /TFXk35JyeEOAr1TyOzIC31XuASjB/3P00Yg0juI//pVi1YbK5XyQzYX6oehf/.../w1Z e0RmzeUVpTYrBiKsxB8LuCnHzLQ==&downloadAs=Google Chrome.exe

http://www.currenthostbundle.com/c?x=ZmymFoXmexrJzEB/t7IJOlto 7T0Ufd08Q52zo67uRA=&c=3DVUi6spJshAQI20W8 e1gAh9w6k8VgKrEOK5G0zFWIrGaPYUky/oCx52NYQkduFVQOENOieEGRO4iXYby1vs12U7YBgf87ZhCPqjZdX mrSWdo0QwHv57F/.../hLztnGH68sXKr8 qURyuqhyd w==&downloadAs=Google Chrome.exe

http://www.megacapitaltoday.com/c?x=qeW2z6utagD ffH/.../iIlnWwgS2BC4fERRYO8=&c=CjQiNL6CmmG8EU0aqRuozV1ok3fKdTuPTEJ9VhKOUBKJA4jmJq5IzzRaNGAfq8G0Dg2DgSnlaSCSkvzE5tdP6P2699unCIqBustPlFQPPuCtAYlhZg cCKypFBq4LFxig TUXadFqQXfj7scqoOuvw==&downloadAs=Google Chrome.exe

http://www.safebundleconcepts.com/c?x=650HooneAbDltiLtM hVwT2Obs2uNsOQQW8ApVOJ9WI=&c=I6h0oR9FFkxM4B/7qFx5IkfdbimcHXqqbX5Lq6ufxlGE2GaYpM66qXsdy3SShm/.../BVfm IMweqk1D06eFSRekcK02vI KTRC6IlFRuyWmZJd3oZrDgc8SX05 IcvkRJTZNA==&downloadAs=Google Chrome.exe

http://www.binariesclearpackage.com/c?x=N1Qnfi5QuF6tiuT5pGR4R/2L6VU/.../MELSeWPWyTdrmBQQlv9FutCIHLx437icqKEUbWtAtmbrisbyXVx6l6cZF3ISpg==&downloadAs=Google Chrome.exe

http://www.repositorysoftwaretowers.com/c?x=m878iGBlPyyyQKzOennoVRR4qI3JbW1revi74Vnx4Dw=&c=ACF42bPzhimSM9NOWwyPRvhXAr22Kk3Ga9Pf5bIMaZWa3JPs3BaIlvfy YtZ NmXQxOB0iq3I1Wpl5 CGHxn6PX7lFp5mqPkCOJyAzTT8b3uSSHy3T8Vxhe3OPfJ7ynwT539P9wfQlMXusmnQw30fA==&downloadAs=Google Chrome.exe

http://www.hosttagcurrent.com/c?x=6dxCzkkZtM/ykCPFjqb4PF8XuDaD9 NKWqGfOR9FSps=&c=tBOo06Ll7ifkXtlY4PehSZaWHuw8/cxnOKDjbBT458c4FQG8ZB7WE2s5AIiGW64hqQCowr2rxKJtu mRiF88Subfv/.../sRqc9gmoXuhitqA==&downloadAs=Google Chrome.exe

http://www.sharepresentcontent.com/c?x=Mbz/4BSdw0AGQQSP2benENJZ0ku4qu4DGoOm1d8g/EQ=&c=qvyeF7v/NIzPU83JhopmsX 9ngzBBQW9Mq0Ib/g 6E9HQTHOYH OMa/.../TU3knZJOC HQGZ6VRqKEFtknPgCSf3wBrOgDBFW0wQ==&downloadAs=Google Chrome.exe

http://www.currenthostbundle.com/c?x=tmjvZVX9NgkXpMwx0/.../u3MwrBJCxOiNB5cjUQwd E4rd75XyvDz67fpwYdG3l2W1rFRM1j5TIG755k2dVVvUCaJKDjieGJQZk51132wGZltLbwtr4rI RkBX9rPH8PvxafmOYTw7OWWC0Gg==&downloadAs=Google Chrome.exe

http://www.signstoursbinaries.com/.../V3qRkM35fzOwQWiqoB8CXgwB8RNcrpc5Q8Ai5IUdmOmyuLiFlg==&downloadAs=Google Chrome.exe

http://www.headhostingbundle.com/c?x=Z Eu/VCUHiYqZdEp Nd7mn5RAh3/aFA50O5Rr/.../4abdMlukndnTXjUi4MtCWe0KvsVU0TihD46VUfOXhDKkQ==&downloadAs=Google Chrome.exe

http://www.bundlebitssafe.com/c?x=YpzCRlFgr3WnnsmfglhL6bbSgzOofNAYyLMSPw60V8w=&c=afe8h/Lt/72gHYEbiUhlm/.../eeiQwsqhBswVuSVvoIOBMKqaukCXbauj5rJBrQl24HkrfQoq2cYGCA5oAQ==&downloadAs=Google Chrome.exe

http://www.applicationstowersfactory.com/c?x=fcfigt483nuJdAkpprnSwJLVdRnt/uXalsobudpvUPI=&c=MFT8FB2FR/4v6iDbl66dp/czoKXnxDEHpnWqT9FJ7P6121StnxgypMsZy/.../B cA6qgqpmoCUWxi6Ty9WNZbBhW1VGQ7Ai5nIZJvJJOUw==&downloadAs=Google Chrome.exe

http://www.bundlebitssafe.com/c?x=wSvBAG6rFEtOzUYXcyzAVsGGJI9HmOiT7eEz XjjgrA=&c=3GGv3H6LALnnRuuHlWj2PU4w CTVcYvC0z yTXy82oIdEU gDvYrxO4GJsqRmLCikz1LDb/GTsA2z225p0ZPfnWbzK1cI4zzkzwJ5r5/.../UBGLHq5JZ4sz2lgpjWteLyITybrSA==&downloadAs=Google Chrome.exe

http://www.binariesclearpackage.com/.../jYeaerDU9mBTWQo1Q9zb apoeghPJA1qaNiAp5mlMDcYVD8x44oKI5nfqw==&downloadAs=Google Chrome.exe

http://www.safebundleconcepts.com/c?x=Jq0kuvAQ8850uK0RkVAosZyIjyZTJO83N3GZP7nO2rk=&c=pdjlWJBnDCmnvXqBm2OGP8jMfW0dTzLvI4JeI I5hAeIq9Pg0KBA UYWogQQKOpqkztKvtvNyBOe8DZS2B VDx/.../w==&downloadAs=Google Chrome.exe

http://www.signstoursbinaries.com/c?x=ePtMgW11Iqr75YZ8hkhvyvRL6OcSmr4YxfYCAGaOO3M=&c=l6y8/.../mSQQwtdDivyZ3kBgWVaGDlEYIz8hxerUkiDedQh3OMw096dhTxjp6 ZhHuQvqSlei1bQi7xVofnLCMf1WnuHhyInqVcnKyr0CdUhjcfxYzfPc9Q==&downloadAs=Google Chrome.exe

http://www.applicationstowersfactory.com/.../Z6n58jegLNoWa40CplbdenIBDMKIGgvCahFQveC3EleS13ss3IsY amsJAq d11x90o2PBBhjEY94xTglqZgqRCnul7fTps7A==&downloadAs=Google Chrome.exe

http://www.megacapitaltoday.com/c?x=dOlrdXLVH6PmfM5l3gHUqU2WQKdhxKdnvohPaigHCNg=&c=KXePMSjWUAIe8u21MiAp67aGvlxbTJ0dt4qQCz4DN8ZYkciLOkDKiSdvoL4MaWPyXbfexsQ4EJac201lyui0d9osSZR7GwNfWkATHgAu3IwcLQrKZlz2wRTRq0gVz3JB83eWXullrKFgfOZP1nsZSQ==&downloadAs=Google Chrome.exe

http://www.headhostingbundle.com/c?x=rR9iync4uz1vRqp0wSnxM7fGt7a2js0TcAnm2fU65vc=&c=E05l4mexnwhnkEnzWNX2dIA8DKwQDP/tHVFhBRSxY7MNqlmfPIuUJusK32ewdOQc9C kLoOJJkKo3oceq/ouRnxrWoOtabDvOHqBCzIDdGh3V29E2zAxB4ulb/.../5a8w==&downloadAs=Google Chrome.exe

Remove google_chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.