home

downloader_for_36.0.1985.125_chrome_installer.exe

Totalpc

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application downloader_for_36.0.1985.125_chrome_installer.exe by Totalpc has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
Totalpc  (signed and verified)

MD5:
e8087f68214d890787c77928419a2cb1

SHA-1:
8326b437d450b4fc85975483a9107016d1e8ffd1

SHA-256:
d7437a5152266151b9a5c901c7b71719b6d4733b35a2be801f34d9e0818d3568

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/25/2024 6:46:44 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore.Totalpc (M)
16.1.18.17

File size:
759.1 KB (777,320 bytes)

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\programs\downloader_for_36.0.1985.125_chrome_installer.exe

Digital Signature
Signed by:
Totalpc

Authority:
COMODO CA Limited

Valid from:
7/22/2013 2:00:00 AM

Valid to:
7/23/2014 1:59:59 AM

Subject:
CN=Totalpc, O=Totalpc, STREET=29 Coopers Mill Avenue, STREET=Dundonald, L=Belfast, S=Antrim, PostalCode=BT161WR, C=GB

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C41049E590A85A4E45F8DF4839AFAE52

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
12288:98vpBvxyi5gZqnglkJkkIlLM+DyHf/fax1u9K5MPeWPB4RkIbwZlNNJ7rgP:98vzvxtgZ/mAfOHyx1u9K2PeWJB4wZla

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.