» google_chrome.exe
Overview
Analysis
File Details
Downloads (12)

google_chrome.exe

Soft Installer Program

Media Theory (New Media Holdings Ltd)

The application google_chrome.exe, “Soft Installer Program Setup ” by Media Theory (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

google_chrome.exe

Publisher:

Software Installer Web (signed by Media Theory (New Media Holdings Ltd))

Product:

Soft Installer Program

Description:

Soft Installer Program Setup

Version:

2.6.5.3

MD5:

0c07a7c6f989d537de2acbddb3e504b0

SHA-1:

d6c9ca87ef849784efeb0afefddf33fb13439da7

SHA-256:

8dab27491c00c3041c640ef8d20635fa1d1be96735759f1bc8d8a6cadb00c2e1

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/6/2024 6:29:48 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.NewMedia.Installer.Installer (M)

16.1.5.10

File size:

959.7 KB (982,776 bytes)

Product version:

2.6.1

File type:

Executable application (Win32 EXE)

Bundler/Installer:

installCore (using Inno Setup)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\low\content.ie5\{random}\google_chrome.exe

Digital Signature

Signed by:

Media Theory (New Media Holdings Ltd)

Authority:

GlobalSign nv-sa

Valid from:

5/25/2015 5:07:49 PM

Valid to:

5/25/2016 5:07:49 PM

Subject:

CN=Media Theory (New Media Holdings Ltd), O=Media Theory (New Media Holdings Ltd), L=Tel Aviv, C=IL

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121BA944A31E4793A274CC4ADECFF1E7349

File PE Metadata

Compilation timestamp:

6/20/1992 3:52:17 AM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

24576:PzUYA+88/qxmNIqyIHgVRP0zKfyxHQr98X:PzZANMgmuvIu8w

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE... 
[+]

Entropy:

7.9334

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

The file google_chrome.exe has been seen being distributed by the following 12 URLs.

http://www.toursheartflash.com/c?x=Zx71O6tuHMdnvIVQ8BXZoM7sNHwz8JPletcHSwZVKuU=&c=iokHHKZQ4/.../HTJRkkjl4duXOue92CvhSTafIuISPgP8VPX1NOxdQ5omnntqxHbw8lDp4Mz8Iw==&downloadAs=Google Chrome.exe

http://www.applicationstodayvault.com/c?x=k mphwy0DpHG06xpR0fmHtbTlBgq8O5ywR95v4f0UnI=&c=Rul5D1zzBugGsEoalmsK2j70ftghUQbMuRAC6ebIonPffmQ9uyxYueGnZ9WSQFI5ZhghzusovWz45dmU5GguvI1Ak3I9SaxO9UgnqbuZBhF2eIMHGOQap9/.../zIDkVsZlBlRDTI7ePw==&downloadAs=Google Chrome.exe

http://www.toursheartflash.com/c?x=txiFd3l2KRc526UrOz Bk0/vsjdsI85Tz4N7q2H97Uo=&c=/ThSQhVjwu UmimYvRUQmG/.../rSy2si2OpwQgMyfiEpAA==&downloadAs=Google Chrome.exe

http://www.toursheartflash.com/c?x=oy7ZMuI4orsGyWI 0TJW/WrCU4US/OCFu7yJsAsrs08=&c=1/.../jn6pag==&downloadAs=Google Chrome.exe

http://www.toursheartflash.com/c?x=Qv9M1qSRsK/CUjE4MDCYcYfk/j/rv413Tqdlb4Bmu1k=&c=bh0vQ9Zm52yWqC4LZRxgIe0skk/z3hCPTvznFraoHGSSqyu8T7BY8wFTUy54cLJCXSF2/.../3HVuvv3lgNNqXTnQNjD9N1YDvQkwQ==&downloadAs=Google Chrome.exe

http://www.toursheartflash.com/c?x=fT3s72Us9PEl3mumT2SGlhVIGfDlgLCmf7vZHLj97sU=&c=i/nqtSUutP2 m7/.../LudPd3tl d3Wija41lehiKwmuPP29CaAe3EcrKZJH6tELG5bxBz0S93 Sd048R7FMFZuGTDerLxVAdvdmNQjiGG4tAo3LzsHkfdWFMTAfamjGUgt57mW15GMsR1Q==&downloadAs=Google Chrome.exe

http://www.tagsignsclear.com/c?x=CaXJsUtRau81LGEW5uqJ5YZiC7irkxjKsB28GMIDnzo=&c=VhHZUlfjaYzYg9LkN9VYx8AtlQOY11wwwUuq6/.../rnglURaVRl3Ht8gyANtsDdOF Wk5Uqvj2P5bm3QN J7svrkUOivCcZt0Q==&downloadAs=Google Chrome.exe

http://www.tagsignsclear.com/c?x=SQyyGL0uZSIlutmynrXFm PM1XdziNt8kRF2j5UPt98=&c=6aVqjKEhNZCXJfg4WQwfEzr OpStYM6rV/.../RiWBQZ5InaRVEOarf6EOVPeIe55h6Aaur6kuLUwbppL2VjWwIqOjzCNP9BRvie E651SNcOSygEaAY2EFFzwxHnqrRqSGaORVFA==&downloadAs=Google Chrome.exe

http://www.toursheartflash.com/c?x=dhiet8EWmt9R9dX5Fdfd2xR26i78uiu1FwSM5 w95pA=&c=hYtufxmuB/aIiBBGB4/klCEpqvtVz WxKLhK32sdKkzikVJXzZPo eI5NziAYZmIFYn3nkzu1xwGL ezKQQTmLfrazSx4XmwR95OXnp/RvWwXjdOje6UmgROleDHnTu90ReRF1D/.../BKSxOK5bJaFQ==&downloadAs=Google Chrome.exe

http://www.signcleartowers.com/.../PSa06y9Q WqnYWmNjlwY c1owiUECMbobcyOmX5PO ZO5BjUUzvZltMt6c9GHGehfRlz5mScLPNPwOiuh5A9saIb2TybCY9cMieaj4YMO90Drhg98Ew==&downloadAs=Google Chrome.exe

http://www.grabpresentapplication.com/c?x=RvRmTV2xBvjtOCYBFSw2IgydqSfzjcxIDIBA1t6V3h4=&c=C6KgUaHJCIUSC3f/.../9Kmg4jwyINE95jmNDX8IpfOHmR7AQrARqQTfLvXGAw764VffpCT9n19vIPc6TPPDmpIvqNGHktXHIsBaoUN8bBsAtTRWPGZLerYliR Y8JFEQfukDLkA==&downloadAs=Google Chrome.exe

http://www.grabpresentapplication.com/c?x=BwyaUjbv0m83FqwyKU2VZ49op FOJyz1ymQZflupikE=&c=CnmYxx4QBMyMyfqB9RhM2TT vsWaGJ0lM23xbhn3CtelZ9Y5IeiL453D/.../TzPBs3Fk20mgpxZ4d6gX1uVUVv0DEI6wmoO5VQR5WYo6X18y2JCLldv6 u7c08bdm7ej Q==&downloadAs=Google Chrome.exe

Remove google_chrome.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.