» google-chrome.exe
Overview
Analysis
File Details
Downloads (1)

google-chrome.exe

Payments Interactive SL

This is the Tuguu DomaIQ download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The application google-chrome.exe by Payments Interactive SL has been detected as adware by 35 anti-malware scanners. The program is a setup application that uses the TUGUU DomaIQ Setup installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.

File name:

google-chrome.exe

Publisher:

Payments Interactive SL (signed and verified)

Version:

4.0.6.39

MD5:

0bb05ea2e6ea898fd5daf2b633046386

SHA-1:

2405fbdd8f494fba7d8418206fb548aeb6b7e9bd

SHA-256:

669e7a27e81641bd0c64f7aa93e7d6929c2b408de4cd76e5ca5f99974a3df866

Scanner detections:

35 / 68

Status:

Adware

Explanation:

Uses the DomainIQ download manager to bundle additional potentially unwanted software without adequate consent.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

5/2/2024 7:36:11 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Application.Bundler.DomaIQ.Q

5535153

Agnitum Outpost

PUA.DomaIQ

7.1.1

AhnLab V3 Security

Win-PUP/DomaIQ.Gen

2015.05.22

Avira AntiVirus

PUA/DomaIQ.Gen

8.3.1.6

avast!

PUP-gen [PUP]

150521-0

AVG

Adware DomaIQ.BL

2014.0.4311

Bitdefender

Application.Bundler.DomaIQ.Q

1.0.20.710

Bkav FE

W32.HfsAdware

1.3.0.6379

Clam AntiVirus

Win.Adware.Domaiq-206

0.98/20496

Comodo Security

Application.Win32.DomaIQ.KMS

22205

Dr.Web

Trojan.PackedENT.24553

9.0.1.05190

Emsisoft Anti-Malware

Application.Bundler.DomaIQ.Q

10.0.0.5366

ESET NOD32

MSIL/DomaIQ.B potentially unwanted application

7.0.302.0

Fortinet FortiGate

MSIL/Dropper_PackedENT.C!tr

5/22/2015

F-Prot

W32/MSIL_Troj.CL2.gen

4.6.5.141

F-Secure

Riskware.Application.Bundler.DomaIQ

5.14.151

G Data

Application.Bundler.DomaIQ

15.5.25

K7 AntiVirus

Trojan

13.204.15985

Kaspersky

not-a-virus:AdWare.Win32.DomaIQ

15.0.0.543

Malwarebytes

PUP.Optional.BundleInstaller.A

v2015.05.22.04

McAfee

Trojan.Adware-DomaIQ

17.6.569.0

MicroWorld eScan

Application.Bundler.DomaIQ.Q

16.0.0.426

NANO AntiVirus

Riskware.Win32.DomaIQ.ctukgd

0.30.24.1636

Norman

Application.Bundler.DomaIQ.Q

03.12.2014 13:20:04

nProtect

Trojan-Clicker/W32.DomaIQ.321256

15.05.21.01

Panda Antivirus

PUP/MultiToolbar.A

15.05.22.04

Quick Heal

Adware.DomaIQ.BA5

5.15.14.00

Reason Heuristics

PUP.Tuguu.Bundler

15.5.22.0

Sophos

PUA 'DomainIQ pay-per install'

5.14

SUPERAntiSpyware

PUP.DomaIQ/Variant

9861

Trend Micro House Call

TROJ_SPNV.03A214

7.2.142

Trend Micro

TROJ_SPNV.03A214

10.465.22

Vba32 AntiVirus

AdWare.DomaIQ.euz

3.12.26.4

VIPRE Antivirus

Threat.4150696

40432

Zillya! Antivirus

Adware.DomaIQ.Win32.453

2.0.0.2187

File size:

313.7 KB (321,256 bytes)

File type:

Executable application (Win32 EXE)

Bundler/Installer:

TUGUU DomaIQ Setup (using Nullsoft Install System)

Language:

English (United States)

Common path:

C:\users\{user}\downloads\google-chrome.exe

Digital Signature

Signed by:

Payments Interactive SL

Authority:

DigiCert Inc

Valid from:

10/14/2013 5:00:00 PM

Valid to:

12/19/2014 5:00:00 AM

Subject:

CN=Payments Interactive SL, O=Payments Interactive SL, L=Puntagorda, S=Santa Cruz de Tenerife / Canarias, C=ES

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

060CE3456FDDB3F98DA9EDA1B876842F

File PE Metadata

Compilation timestamp:

7/14/2013 1:09:38 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

6144:++K0e38i9eTAZ89t2DvCPY0zA9MaL09tAfzKLor0bNGjY7:neDeTAZ+okvYTL0MfeLo6oQ

Entry address:

0x30DC

Entry point:

81, EC, 84, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 90, 91, 40, 00, 89, 5C, 24, 20, C6, 44, 24, 14, 20, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 8C, 72, 40, 00, 6A, 08, A3, 78, 3F, 42, 00, E8, 73, 2D, 00, 00, A3, C4, 3E, 42, 00, 53, 8D, 44, 24, 38, 68, 60, 01, 00, 00, 50, 53, 68, 80, F4, 41, 00, FF, 15, 64, 71, 40, 00, 68, 80, 91, 40, 00, 68, C0, 36, 42, 00, E8, 1D, 2A, 00, 00, FF, 15, 1C, 71, 40, 00, BD, 00, 90, 42, 00, 50, 55, E8, 0B, 2A... 
[+]

Entropy:

7.8791

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

The file google-chrome.exe has been seen being distributed by the following URL.

http://ttb.filenaut.com/download/request/.../9AVXXMiu?SiteID=272

Remove google-chrome.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.