home

chromeinstaller.exe

Installer

Iminent

This is the SIEN AppScion Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application chromeinstaller.exe by Iminent has been detected as a potentially unwanted program by 4 anti-malware scanners. The program is a setup application that uses the SIEN SuperInstall installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Iminent  (signed and verified)

Product:
Installer

Version:
1.0.0.2

MD5:
a99126f9303fe9543c2731fd5a8c3d24

SHA-1:
7ca29bf1e418e4439a9604f3201f988b82400818

SHA-256:
1e486f6ef3f936aa0f525622639ae0b2100b1cffc26fab2cf382638807983f6c

Scanner detections:
4 / 68

Status:
Potentially unwanted

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/19/2024 8:33:38 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Adware.Plugin.56
9.0.1.037

ESET NOD32
Win32/Toolbar.Iminent (variant)
10.10670

Reason Heuristics
PUP.Sien.Iminent.Bundler (M)
16.2.6.6

VIPRE Antivirus
Iminent
34514

File size:
1.8 MB (1,921,600 bytes)

Product version:
1.0.0.2

Copyright:
(c) Iminent. All rights reserved.

Original file name:
IMinentToolbarInstallerCHR.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
SIEN SuperInstall

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\binaries\chromeinstaller.exe

Digital Signature
Signed by:
Iminent

Authority:
GlobalSign nv-sa

Valid from:
1/31/2012 7:55:45 AM

Valid to:
3/2/2014 6:55:45 AM

Subject:
CN=Iminent, O=Iminent, L=Paris, S=France, C=FR

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11214EA925C07E01E1C06B597DD4B36FAA8B

File PE Metadata
Compilation timestamp:
1/31/2013 7:47:14 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
49152:yKEoUImuHRxWT3HxcKrm4vTXitrPCvvAQCzEqYTNoP+63jMv7hvD:0oYuxxWT3HxcKrpOpCvvAWqYBoP+6Sd7

Entry address:
0x10E3C3

Entry point:
E8, 90, 89, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 8B, 45, 0C, 83, C0, 0C, 89, 45, FC, 64, 8B, 1D, 00, 00, 00, 00, 8B, 03, 64, A3, 00, 00, 00, 00, 8B, 45, 08, 8B, 5D, 0C, 8B, 6D, FC, 8B, 63, FC, FF, E0, 5B, C9, C2, 08, 00, 58, 59, 87, 04, 24, FF, E0, 8B, FF, 55, 8B, EC, 51, 51, 53, 56, 57, 64, 8B, 35, 00, 00, 00, 00, 89, 75, FC, C7, 45, F8, 31, E4, 50, 00, 6A, 00, FF, 75, 0C, FF, 75, F8, FF, 75, 08, E8, AD, F2, 01, 00, 8B, 45, 0C, 8B, 40, 04, 83, E0, FD, 8B, 4D, 0C, 89, 41, 04, 64, 8B, 3D...
 
[+]

Code size:
1.2 MB (1,294,848 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.softologic.com  (174.37.181.31:80)

TCP (HTTP SSL):
Connects to www.ibbalance.com  (173.192.190.227:443)

Remove chromeinstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.