home

chrome-setup.exe

GOLDEN BANNERS

The application chrome-setup.exe by GOLDEN BANNERS has been detected as adware by 2 anti-malware scanners. The program is a setup application that uses the Tomorrow Software Installer installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars. The file has been seen being downloaded from files4.uberdownloads.net.
Publisher:
Active Fun Installer Setup  (signed by GOLDEN BANNERS)

Product:
Active Fun Installer Setup

Version:
46.1.4.7776

MD5:
186a81354354cae5322ed79d6930ec6f

SHA-1:
908a4eecdbcc9d7d46947da879c1a909316eac84

SHA-256:
e478a770c8d494e23ee5409437a97b6544f8bd305d12b8055851e9325098151a

Scanner detections:
2 / 68

Status:
Adware

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
4/26/2024 6:13:35 PM UTC  (today)

Scan engine
Detection
Engine version

herdProtect (fuzzy)
variant of setup.exe (Adware)
2015.8.28.13

Reason Heuristics
PUP.TomorrowSoftware.GOLDENBANNERS.Bundler (M)
15.7.26.15

File size:
875.6 KB (896,568 bytes)

Product version:
46.1.4.7776

Copyright:
Copyright (C) 2015

Original file name:
setup.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Tomorrow Software Installer

Language:
English (United States)

Common path:
C:\users\{user}\downloads\chrome-setup.exe

Digital Signature
Signed by:
GOLDEN BANNERS

Authority:
VeriSign, Inc.

Valid from:
6/9/2015 8:00:00 PM

Valid to:
6/9/2016 7:59:59 PM

Subject:
CN=GOLDEN BANNERS, O=GOLDEN BANNERS, L=San Francisco, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
1C9D6194236D472E93E5D8BC2B85866A

File PE Metadata
Compilation timestamp:
7/6/2014 6:38:04 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
24576:4CMLKmtvPyHu7FtwQpXZUy9pNg4W7HMc0cN+2QHCf7:BiKmHyOZt5pXYp7scRQS

Entry address:
0xC822

Entry point:
E8, 3C, 05, 00, 00, E9, 57, FD, FF, FF, CC, CC, CC, CC, 51, 8D, 4C, 24, 04, 2B, C8, 1B, C0, F7, D0, 23, C8, 8B, C4, 25, 00, F0, FF, FF, 3B, C8, 72, 0A, 8B, C1, 59, 94, 8B, 00, 89, 04, 24, C3, 2D, 00, 10, 00, 00, 85, 00, EB, E9, 8B, FF, 55, 8B, EC, 81, EC, 28, 03, 00, 00, A3, A8, 4B, 41, 00, 89, 0D, A4, 4B, 41, 00, 89, 15, A0, 4B, 41, 00, 89, 1D, 9C, 4B, 41, 00, 89, 35, 98, 4B, 41, 00, 89, 3D, 94, 4B, 41, 00, 66, 8C, 15, C0, 4B, 41, 00, 66, 8C, 0D, B4, 4B, 41, 00, 66, 8C, 1D, 90, 4B, 41, 00, 66, 8C, 05, 8C...
 
[+]

Entropy:
7.9571  (probably packed)

Code size:
51.5 KB (52,736 bytes)

The file chrome-setup.exe has been seen being distributed by the following URL.

http://files4.uberdownloads.net/download/.../dl?bc=1084890&pid=TR&brand=uberdownloads.net&aid=DLM&s=msn&c=Chrome_USA_Broad&country=US&cb=-1888130679&signature_id=85&osName=Windows&osVersion=7&browserName=Chrome&browserVersion=44&zTmp=1&executable=1186369

Remove chrome-setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.