home

chromesetup_fr.exe

Mafelobes

MICROMAX STUDIO, S.L.

The application chromesetup_fr.exe, “Mafelobes Setup ” by MICROMAX STUDIO, S.L has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from www.dlguardsoftware.com and multiple other hosts.
Publisher:
Bemadetuso   (signed by MICROMAX STUDIO, S.L.)

Product:
Mafelobes

Description:
Mafelobes Setup

Version:
4.1.5.1

MD5:
7a6ebb756a1ad81c85f49e9b830c8b99

SHA-1:
bacbb97e3814128f533033068b14307db9e04090

SHA-256:
9de03594457bc1c5c018ae52189df06dd44c10448d6bea9dc33104f77ba02f69

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
5/17/2024 12:29:53 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.MICROMAX.Installer (M)
16.4.16.19

File size:
942.9 KB (965,552 bytes)

Product version:
2.7

Copyright:
Fast

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\chromesetup_fr.exe

Digital Signature
Signed by:
MICROMAX STUDIO, S.L.

Authority:
GoDaddy.com, Inc.

Valid from:
9/1/2015 1:11:38 PM

Valid to:
9/1/2016 1:11:38 PM

Subject:
CN="MICROMAX STUDIO, S.L.", O="MICROMAX STUDIO, S.L.", L=Madrid, C=ES

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
79A6DBFB5606456E

File PE Metadata
Compilation timestamp:
6/20/1992 2:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:+W2WIKXCZ/YlZQFk7cZG8K22fs3wUQqoQzfQ4tlK+vJ3Y:+zJVAZU+EP2fCwUPoEfQCK+vJ3Y

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file chromesetup_fr.exe has been seen being distributed by the following 13 URLs.

http://www.dlguardsoftware.com/c?x=GNmNV4MsZeAMppDWNZAtvYq7kkcUGMpC2c2LJ8hnpvI=&c=MXJ6RwNc9Y6uQToTy27uKw8st0edVSTQysjr1D35DSfU/yfU1iC6qGOqaBFyLmsNxKgao8ORyMKWUHyelkixvPa/pzXgo6 Ilfzb6ctXdnmjNt20gdXyEUPFqeRVC1Mn&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.cityclearvault.com/c?x=233are5AdE63xD0w4/D5hspAE4CoAJ0Wu8wuSn3OE54=&c=aEnLAJ1Mqu1Ip7Ma7 qI3xSxZ5FLbX4tsgYNjycNYAAV9JhQAkWl3ltoJy4pk0Hx5/FPQ3dQWAMvC6nM39TcPqPLwTMIIy4xpkIxGjQ7Yk1Baife3LTUcgOSoj2lfvsk&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bitsbytehost.com/c?x=pWjHyE6e25IQvujA6YCsDBWTrb2b0QI1nr1IZlkGHtg=&c=TPunWnrKD4Dsq1bjfiQIpgmKdEWbcu6WBAepVaSRIn0i7Qj9CTBLsFDgxygVD6z9gotoy9ZkF gljMlLdonU75Klm7pXjS VRfZcmtImiBEoxIoKiJhpM7nps kMSt/S&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.dlguardsoftware.com/c?x=sCO7 9aAHFEJlBmUxeuKntKScXFc3X3k3M1mTzVL0RI=&c=T4k5GWD2iJFuzEzKZJvaDoZTiI9EqTmjdb/f2Au5hyrcwDr6OoEPth9unz/Goh5 VGHviP nukALOcA7OqbNy SSnkOZ89kM5mOx v7ZutQRaq4zc8XpIKKBqjteDimG&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlessignscurrent.com/c?x=7SEv2p U6BNJrirOEBksHqezJT4nXMxNQf8AjMrJrBI=&c=9rJJF32y6e1HqEEuqamXMVWt0wgm4Co84yUu07GqIm7gYplMprBs2r6t0wWH/vxULRgGUb7iTTdmczE2WOfhAIeewmupeReypuplLMPswm6jTKFrSvR04fBJ9 ur4Osn&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlessignscurrent.com/c?x= rV1D6VNaOvpMsZY8 0nUxxJ6vVSvzkLnyNpsmBAz38=&c=A4lDhLkGmso hOVPlQpDLBIHzDWu6phBiWSGPxoB0mfpuBbS7K6D WD7XBmwJMZHKhH4VdPO0xKY7Wh1BuzQuf0FdZdflvdccoEebaRT2SY1J5ZkJ1qriOQcn/LEwiR/&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.cityclearvault.com/c?x=W/yjaqhcRSdkBwNrS7qG5FqaeBHTcXOy3d m4A1uplc=&c=RoIX2WhXKjBvS7ok ua DVvnwQVQorT5BhyQcafzvB55NcyyS2GvlR 95K6Fq7T0bRMQ kG32q4ADrH2CwWaDKTO9NdBUlEbkqTgLpedfV UwMZ8/zRuuqIBelGgQ1xv&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlessignscurrent.com/c?x=23Tc4LoZVWG213PrfTxgVgO4YZ6lE8iRLmYkTyh2lB8=&c=IPTf0O2Sgfw9CCeNTU7ikL8ZbFqQ4uBmXeE9a5T5vU8KkG7T3ONbjLNSsF/JQsaZZzLUDuqNO FwgU9aJU6ubIwnwvK1aM5PM1h5Emf/gwJfwfTddGRxUo2vqz5PapTA&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlessignscurrent.com/c?x= 26AWqX6HpHpYRGHW7SkVPOgEqz5s9cJDlW640dvi8s=&c= k /klvBUnB08/pNf1YLZxwQBjkoIKgIOWkZ8FJWj9Ed JbDcGjjesk/7y8DoZ1KUwSPgK76cpQ/SE5Z76MdMzjcZAwXoxWQpc37IwmJVsHhhC7wtKPHweWtgOAMx q&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.toursclearhost.com/c?x=O96Dxqj4Q92Snr9Pj6mIjhPhpkRhrm914PVuJcrhtc4=&c=WT4tIkr0z372EUSBgYLdwXAe/9Kv75erlBWXQd0j7rT5RiC9f7gDwPpMw5TpT pTn9Qvy/Nxa5d2ENhg9z3 TQJ5KwWZRgP7Z4zZbJsp2mtkqsxtiuZziGTR cGxcfdk&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.sendranchpresent.com/c?x=zMxc11J0YLiRh859VxFibTvfJqsyMr5 a8LEXrRU8Nc=&c=GLB8uBNHpzJ7SklpAKTO//i0AlBydJCpLO97QAXkg93b vTQWeyxJdvpViGAnnrS8sFxHwkiJJI1SZMfl6Ap13WW5Pmw2iWOKwcWHJo16ViVBkOvP4N9I4CHtiCJXBIa&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.cityclearvault.com/c?x=ScOdNNscozBfXuEQSlRSTuKl G08JG4O7bOxRs1K7qE=&c=DbEitNAYUSFPWTJew0wlNgzXkQe6 rTFsQKHRgRUEowJ IwMEVmS GoK9SjtzSuPA510E0Q0znPO3im5ohn2z ttTMZo9/iYkcXVJN9gVfQzxvuDJ/N8lEVmyJSqyzDf&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

http://www.bundlessignscurrent.com/c?x=F6S262pCLbywVbHanx DaSyksUGhw7IFDzds/rf8rQU=&c=WPwjbvL2ISUjC1fMDE5ZQpd9N6fTebzkH6TDeRoWPAruhtknHyQnGhXzwrKiHuimi9oceToMNauwBp2wdpebU2GzK3vRRwybztJxjUq3C86uAbDrH6U/u7QQI8Y4Y3dq&fallback_url=http://res.hufftos.com/.../ChromeSetup_fr.exe

Remove chromesetup_fr.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.