home

googleearthwin.exe

Google Inc

This is a setup program which is used to install the application. The file has been seen being downloaded from chip.digidip.net and multiple other hosts.
Publisher:
Google Inc  (signed and verified)

MD5:
f8a7093ec1b8a8e28e5856197bbaf54f

SHA-1:
b55ac4c75ae4e80f0334b3857ed3fcac7f9440ce

SHA-256:
f2706dff723d63304f37bfe416aebf6a75da947acb4a71a267e29da00b5fa1ab

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
12/24/2024 3:05:52 PM UTC  (today)

File size:
34.5 MB (36,182,856 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\googleearthwin.exe

Digital Signature
Signed by:
Google Inc

Authority:
VeriSign, Inc.

Valid from:
1/29/2014 1:00:00 AM

Valid to:
1/30/2016 12:59:59 AM

Subject:
CN=Google Inc, OU=Digital ID Class 3 - Java Object Signing, OU=Digital ID Class 3 - Java Object Signing, O=Google Inc, L=Mountain View, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2912C70C9A2B8A3EF6F6074662D68B8D

File PE Metadata
Compilation timestamp:
5/21/2015 2:37:50 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
786432:N7sPIf4uPORLS7IWpAVKSNq9xC2r1Z85DYHHlqVr:dsgf4sO87FAkSU1w5DyqVr

Entry address:
0x611E

Entry point:
E8, 9C, 23, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 5D, E9, 27, 24, 00, 00, 8B, FF, 51, C7, 01, EC, 27, 41, 00, E8, 53, 24, 00, 00, 59, C3, 8B, FF, 55, 8B, EC, 56, 8B, F1, E8, E3, FF, FF, FF, F6, 45, 08, 01, 74, 07, 56, E8, CC, FF, FF, FF, 59, 8B, C6, 5E, 5D, C2, 04, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, A3, 70, 85, 41, 00, 5D, C3, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A1, 08, 74, 41, 00, 33, C5, 89, 45, FC, 53, 8B, 5D, 08, 57, 83, FB, FF, 74, 07, 53, E8, 00, 25, 00, 00, 59, 83, A5, E0, FC, FF...
 
[+]

Code size:
65 KB (66,560 bytes)

The file googleearthwin.exe has been seen being distributed by the following 50 URLs.

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1440092577&v=3600&s=9580fc76b446b8f7e5428ac289fa475d

http://www.filepuma.com/file/1447194564c8862/google_earth_7.1.5.1557/.../0/

http://indir.gezginler.net/i/1621/.../

http://www.filepuma.com/file/1455743820c8862/google_earth_7.1.5.1557/.../0/

http://www.filepuma.com/file/1476888925c8862/google_earth_7.1.5.1557/.../0/

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1461422300&v=3600&s=5fe5aacf22896d25ea4f4d2472d4ff1b

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1442436540&v=3600&s=e8671f2ac6561eb397763f790ec616d0

http://w.x.baidu.com/alading/.../10222

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1441190781&v=3600&s=62756537bb1fa1d31c8abce60b3b44d3

http://www.filepuma.com/file/1441291567c8862/google_earth_7.1.5.1557/.../0/

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1456944624&v=3600&s=1ef6aaee928ccb3c7433292f37fd73ed

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1457407005&v=3600&s=1081c3c945bf2e6e187e331a98c2b954

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1444989503&v=3600&s=1f8a268ed83332aea28ddd74d9f53636

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1459283957&v=3600&s=0e074f4e0762c6cba23420cc7ff74a2d

http://www.downloadnd.com/files/.../GoogleEarth.exe

http://indir.gezginler.net/i/1621/.../

http://www.filepuma.com/file/1475953500c8862/google_earth_7.1.5.1557/.../0/

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1457256121&v=3600&s=1205359425513de0362f0df79de1d3ee

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1447091955&v=3600&s=500b2000b6b3d5a18172d42379702a9f

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1458642662&v=3600&s=682d066e4ba560c81db5c12cc36dd23e

http://indir.gezginler.net/i/1621/.../

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1443632007&v=3600&s=a1cf714e2ef0195577ae83c5f1f5f3a5

http://indir.gezginler.net/i/1621/.../

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1453322981&v=3600&s=f27d5b366655d3928994a4945738a50b

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1449525000&v=3600&s=75bdb6f341dbfb663033675ca48b5257

http://chip.digidip.net/visit?url=http://api.smartredirect.de/api_v2/ClickGate.php?p=Z5CZZT9icW&k=84ce162d0f33c0c5b3647aa9adc94c64&url=https://dl.google.com/earth/client/advanced/current/GoogleEarthWin.exe&s=buDL-dl-extDL&ppref=http://www.chip.de/.../c1_downloads_auswahl_15820971.html?t=1448188748&v=3600&s=88cfe8eca1d6ba4cf101fb44f9372099

http://www.filepuma.com/file/1475228200c8862/google_earth_7.1.5.1557/.../0/

http://download.52pk.com:8088/down.php?fileurl=aHR0cDovL2Rsc3cuYmFpZHUuY29tL3N3LXNlYXJjaC1zcC9zb2Z0LzRiLzEwMjIyL0dvb2dsZUVhcnRoV2luNy4xLjUuMTU1Ny4xNDM2MjU0ODg3LmV4ZQ==%&aid=13103&key=fa08cf1deae0f0e85f5df4a47203a675

http://indir.gezginler.net/i/1621/.../

http://www.ordi-netfr.com/cgi-bin/.../pg-redirect.pl?code=GoogleEarth52

Latest 30 of 173 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.