home

chrome_setup.exe

Chrome Installer

Bullet Media Inc

The application chrome_setup.exe, “Deploy Chrome along with various offers” by Bullet Media Inc has been detected as adware by 8 anti-malware scanners. This version of the file will bundle a Mindspark/MyWebSearch Toolbar, a potentially unwanted web browser extension.
Publisher:
Bullet Media Inc  (signed and verified)

Product:
Chrome Installer

Description:
Deploy Chrome along with various offers

Version:
23

MD5:
b87770d5176ac77171ccdd81ca0e881f

SHA-1:
05d04d93ae7d07ce77db64abb92c5088d28a7d4d

SHA-256:
8aba83d6ef60b393792d9e32cedebeae080000ffcdd1795f3aea443395a59478

Scanner detections:
8 / 68

Status:
Adware

Analysis date:
5/3/2024 5:09:01 AM UTC  (today)

Scan engine
Detection
Engine version

Bitdefender
Gen:Variant.Strictor.33443
1.0.20.1430

Emsisoft Anti-Malware
Gen:Variant.Strictor.33443
8.15.10.13.04

ESET NOD32
Win32/Toolbar.MyWebSearch (variant)
9.8649

F-Secure
Gen:Variant.Strictor.33443
11.2015-13-10_3

G Data
Gen:Variant.Strictor.33443
15.10.22

IKARUS anti.virus
Win32.SuspectCrc
t3scan.2.0.3.0

MicroWorld eScan
Gen:Variant.Strictor.33443
16.0.0.858

Reason Heuristics
PUP.BulletMedia.Installer (M)
15.10.13.4

File size:
1.6 MB (1,630,600 bytes)

Product version:
23

Copyright:
©BrowsersInfo

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\chrome_setup.exe

Digital Signature
Signed by:
Bullet Media Inc

Authority:
GlobalSign nv-sa

Valid from:
10/23/2012 1:12:03 AM

Valid to:
11/28/2013 12:43:21 AM

Subject:
CN=Bullet Media Inc, OU=SecureInstaller, O=Bullet Media Inc, L=San Francisco, S=CA, C=US

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112116EBEA49F373F8BAAB4A68F77907F38F

File PE Metadata
Compilation timestamp:
7/20/2013 2:42:49 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:wM7YKmIr51DH4awRTPMuW5Ql3KKM5po/Y/XXngoty0IETeiGQ6k6ThD74f8gEQUA:w6zLUj3Kp0/KngoYfXnTSXrUNukuZl

Entry address:
0x1053F0

Entry point:
55, 8B, EC, 83, C4, F0, B8, 14, 31, 50, 00, E8, E4, 21, F0, FF, 8B, 0D, 64, F5, 50, 00, 8B, 09, B2, 01, A1, DC, 2C, 4C, 00, E8, 28, 96, F5, FF, 8B, 15, 58, F6, 50, 00, 89, 02, A1, 64, F5, 50, 00, 8B, 00, E8, 2C, 2E, F6, FF, A1, 64, F5, 50, 00, 8B, 00, B2, 01, E8, C6, 4C, F6, FF, 8B, 0D, 4C, F3, 50, 00, A1, 64, F5, 50, 00, 8B, 00, 8B, 15, 48, 72, 4F, 00, E8, 1E, 2E, F6, FF, A1, 64, F5, 50, 00, 8B, 00, E8, 4A, 2F, F6, FF, E8, 39, FB, EF, FF, 90, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
7.0912

Developed / compiled with:
Microsoft Visual C++

Code size:
1 MB (1,064,448 bytes)

Remove chrome_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.