home

google_chrome_installer.exe

Ladah

Superb Alpha (Fried Cookie Ltd.)

The Fried Cookie installer utilizes the InstallCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google_chrome_installer.exe, “Ladah Setup ” by Superb Alpha (Fried Cookie) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Superb Alpha (Fried Cookie Ltd.)  (signed and verified)

Product:
Ladah

Description:
Ladah Setup

Version:
5.1.3.1

MD5:
e2d38997c5491b66c469bb37084f2270

SHA-1:
28256fa270c1d6c6d408194ef9ccd49d801064f2

SHA-256:
9e0abca9ad5e74493aac48cbb17937e5f0789bab5ff3d36ffab3ab9000d62384

Scanner detections:
1 / 68

Status:
Adware

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
11/28/2024 6:40:41 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Installer.Installer (M)
16.2.18.14

File size:
1.1 MB (1,113,480 bytes)

Product version:
5.7

Copyright:
Web Lite Program

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\google_chrome_installer.exe

Digital Signature
Signed by:
Superb Alpha (Fried Cookie Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 1:00:57 PM

Valid to:
6/22/2016 4:48:43 PM

Subject:
CN=Superb Alpha (Fried Cookie Ltd.), O=Superb Alpha (Fried Cookie Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11217F30BAAF40AF8D13BE6DB4153600593E

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:NL0BH/iwl6SeF+TJusDI0NPFJ/cj3hxO/QM:NQdiwllTQsDfPF1O3hxmP

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file google_chrome_installer.exe has been seen being distributed by the following 10 URLs.

http://www.currentbinariescurrent.com/c?x=ZgszoWXe/dkPl56zsxJZxg9 bhSAHNfMHufJFDqAyz0=&c=oYJaw9vLYOk6IQ2WzeVm9H2AHmlNiylwsp0d/gxb//RPvKrFjp5J05oXmVmh0nME5zNASq6ndy5jiCZFjVseg0qNSOZJz ABUKnjjFpvBbR6ahHDWAOmOEOj6Rjihvu6&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=eWKCaCDxELKgatRswLQVLKJfWn9Oq6VEF1gYtroEe14=&c=VgYw2C8FtITJoxTYknTUE3arNicLz WKImKJbDanNLR rwNC5aeuiOSeWgxZl4g7r7h3g7J8ZdVAyJTmH PjegJ0dIhPAgLa8Fft9VfzpPY81ICTW8wSjs70jXN/3FsF&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=c00 LHr4HQ/RRD7gDIvFd832Qh/pWQtPtQ0UfKgjtNY=&c=Lhoir5yqkehskfiBJosTkYWeIl1Og71cHQvHWOg9zg0nVgway1 x SWt5q65g0vBlbubJmgf3/yUq2SjqbZeMyLRlnUCEWgj6LlTr39DFdKg/m3hnXQyVArRqmXYBDN3&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=1nADFmW 44Gi5oRNJyfsm0vJMqHlGLWNVm/UDY28YEg=&c=WRW31o8c6r3C04kQPfc9YYG9lGLILCYLAM7P2dCaSAWuY8CjsejwAV2sXA33tmyPNSg9cfZhUsJ1QqQFhXJ11xzmSmLcg/qi3eyHI8pDzr4CJHNNVuwSvZYjUznRi7GW&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.currentbinariescurrent.com/c?x=jOaBz0hjpITmmTCI/i9lf sN7eFaKexaLEEV07isz94=&c=qw8I3CgKWhGsreEwnFvzuYWW0LzaAgT2sFGrLii7ByWL7rvRO0asKxwFX7406SF3EwW2Gmy65Ub tSrGqFZYwfqKBWTLioJ5jDSUPji3MdnRKy7 9iWJNPI2jLOf8nI0&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.citybestbody.com/c?x=axH vMK9Y bA/p9UIf2pNTM oQ1mYwYREW83ctqvo4g=&c=qpmk34oq0LEr9zwqxgR5SRt0yuR9vVl6Awyi1172ue8XjYF llL8ykaQcTv0LevhDwvDC9a1jVwl34p7GuiyYS4sOuk3fiOKIKDZOx8KCfENdCsvD43L5H1/vcH8auSm&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=SbYwsfACq0lBOFE5B46q4SN1rLnyJjHK/r6RtjbdDd8=&c=Y4A QYSWl0AlQ47PHl3/IyT9Y4etMTzR3YZDRHiQ8vV5WNpB1y2K6vwWBPZJlxp6ilu9PmLvuXt7Lt1LMiSPzxfxze8dp1rAgy3Z4zReK0VQ6JRgfn6kMiV0NNu9toL6&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=n0g3gTjJ9Y1q0nSEbOHc8kv4a/L ZSvA 2YLhLCcrw0=&c=nZ3pako3ud uvLoTO7lLOSkQIv7005ZafeLLca2rP2Ccp2wMfe8YAD9HDDOSaV5Q gPn1AkrQ6M0xN1oRuW6 Z8TZxNycNCl0QOlE0Nm6EKZ5EIPxdXseh3sUYNW9jBg&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.appsgiftgrab.com/c?x=c1aWqC2bDKIu5NwBxM Ig/oYw84fiLasR/g9kZVPLIM=&c=aVKyXEfh0hptYubt7fHPvmqoTpNSz4OmvjD8DcdTo7Schk1Bwchl xC5Zs82qDhqi3qN617fJeAHs m2Sqvqh0O3/FAyuxwt5j5LqfzDsLEyUW8UJw8ZUBJd4msAasA &downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

http://www.townrepositorybundle.com/c?x=tTSs0vG7yE1zvBmb8LkiNG3Rj75R rMv/MnGnvJKe1U=&c=8n0yhFr5aIai1z8uWNc2Ph1UyGgbzBDv1y/ruEJMoK3o9P66rfMOyPzccxd2PBvvJwAthfx mgF1DwJC6dluPvlZJZQpxteN4p17NSf7Bjd5bkxDJExSg7O1eYk6T23t&downloadAs=Google Chrome Installer.exe&fallback_url=http://cdn.darwendlmfilesnow.com

Remove google_chrome_installer.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.