home

googlechromesetup.exe

Internet

SuperMoca (New Media Holdings Ltd.)

The application googlechromesetup.exe, “Internet Setup ” by SuperMoca (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. With this installer, users are expecting to download Google's Chrome web browser but before that occurs they may be presented with additional offers, mostly potentially unwanted software or adware.
Publisher:
Installer   (signed by SuperMoca (New Media Holdings Ltd.))

Product:
Internet

Description:
Internet Setup

Version:
4.1.5.4

MD5:
e6b36171f23ad7e38ee12c84eb52b833

SHA-1:
40da6556ad73666d42e7cded188230ffb40bf748

SHA-256:
8be05995b4e04cc8aeef59f8d271c9b19b9b9b8d00a7e82203638f27275d0dd8

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/6/2024 8:28:46 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.Installer.Installer (M)
16.1.13.16

File size:
885.4 KB (906,608 bytes)

Product version:
3.2

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\googlechromesetup.exe

Digital Signature
Signed by:
SuperMoca (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 2:18:05 PM

Valid to:
3/23/2016 12:24:07 PM

Subject:
CN=SuperMoca (New Media Holdings Ltd.), O=SuperMoca (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121DDA99F01EE6D7FC1C948433B608BFC09

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:7Q8S0DAuzck3J7JJq0a7psH0iG65wvbF+alZgOF5u:77VMul51O7psS65wjc2ZLu

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, BF, A9, FF, FF, E8, 5E, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file googlechromesetup.exe has been seen being distributed by the following 9 URLs.

http://www.hostingnewcurrent.com/c?x=QbmRq57tGuh3Gw7ONM22O38cDIydmDTp6TSR0WQp46Q=&c=2Q2Uyyx0DYNpBR8Per2OuQIfN YvXnE/piLDdyA1ZdwCrIiEDLtV/z5MQxOjQsIF7RPYjamTPjq6yjtLKvQRhhUFVgBSb1pUc/i7OPoS7amZ2ddiyn8x/BVHhaO4vqrF&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstocksoftware.com/c?x=ysAzj214ZG n8AWfuXJLInhUeyeCUdMYK2I1T2dGnto=&c=37f9AwO8IO oJ aEyb mGO3sH2KIICglA05pUXHt wmrCiFjkx31Gb7GDwv1MoK0LS8nQi6hBmVbsFffbcNTM6mOvoKQIOy1AnuM53kjR92S6o32K9KoBR6UB9qQ4X4S&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.conecptapplicationcurrent.com/c?x=Tbzaq6pMemVVZeNUZ gR0vN4p9Z/A0OC/CO3Cj Byik=&c=DBEqkHf2S5owiNPpRDLy/j8jnF2R1hBb1DpbUrA4zzpsClJen8cyTSU4 NsAQsmvpe0cCSxS93HYEkuzXiJtWxtrXiYZTX4q3YP byYS15JtkUc VuiQLy5knvxpRz7J&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.citycleantour.com/c?x=tXnGsF90M7aNPlYg25GpjU394NEojfxq7xM68X9kfmw=&c=iSshmPCStalMcdPCI3lcAhA63nDhyG0oN4nhS42qhLIcQY4baUlZw mWPT1PTlFbg4Fcw7LkWl6LIsp4eaQ137gX/wVxaBwfo3aC0KZupc6/oaSm24oVbz6rE3a0GKkK&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.citycleantour.com/c?x=V9on 32REI2Lr3NoBuivjqPLtu/YSPToLrhjNgw2/hU=&c=dU/blcYmTHVPgMdPUcZ1Pq bR6DkhswweEy/R3F2UswVjSdfXKZNvBoYctNgjwRWgbhzSAnFXueeUKKN3jKq1 4bVc9QmzoalneNS42rDGcN3F0dF6296Y xMIzC6Pq5&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.presentflashlaboratory.com/c?x=qjCBLJILKvocb/sFgHJPO95IuRK1enjaX6W2cEpO99g=&c=K1Hfk3G4RpOaCccHO9LEpgA wb9n50cSNNdu2jC6WEyUByZLjAp5fRWc1Gz4CILU6cyZ74gyoAUUzm49yD3TI9HjUQrb1neooI53Gs8KmjLOITpZkpNdAnpD64BVkClL&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.filenewfactory.com/c?x=elEWBBGoEvIj/rJxxpErJXs0j0uG7hywNcALeTYrmjA=&c=BaW6tgcpxEAAB1/1dQbSIHhpw4QgylSNijCBVtwdw8HyAO8X vxbXGXhn2Lu9vXQZdu2QuLWR/t0uq1TskVIf oS d4ptc8GRPawcfZ/aJbUYglsR7mYv4/vYIPdBNoP&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.tourstocksoftware.com/c?x=RQTcqPHSP5dRpkPwLfnKb rGj2ZHTSZ0nIxiJQpg6F4=&c=JTk FnZcny s twb NyrAEUb9Q3CxABHFDOMgKy41c8J5g0xdkjm1V/I/u0cmr/84lPixvEOcw/l03/h5vzdWPmu3zwoGGvh4sktg2hwV/HrmYRY3uLrJBxmIj8flaUv&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

http://www.citycleantour.com/c?x=x9NHyJsgiNZxCO1v7us8X4hj7zJT7Dgp00CoLAzALf4=&c=FutUbILMjfexs TTMO9N0jqkE ZC14l3LGXSZvrd9M6rIwVi9G9Lg 6Bm XN5PcB7ik6BxmM6k2U7a0zZedotrRiPTO2d541ElNfsfArMZpCSJX50EvlIdYVWGAkuWX9&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

Remove googlechromesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.