home

google-chrome.exe

Installation Wizard

Advertiso GmbH

The installer utilizes the installCore download manager which may bundle additional offers for various ad-supported toolbars, extensions and utilities. The application google-chrome.exe by Advertiso GmbH has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The installer is marketed through download protals and search ads as Google's Chrome web browser but will also install additional software offers which include adware, PUPs and browser toolbars.
Publisher:
SecuredDownload  (signed by Advertiso GmbH)

Product:
Installation Wizard

Version:
1.0.13.24053

MD5:
eee2212a585946456293819add3dd1ba

SHA-1:
7146eeb9e58f38315daca8f675e259267337cdb4

SHA-256:
1b37e722c52558364bd502ed6224e2d92ddbd7f23815af5db0e7b1e37401898b

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:
4/29/2024 6:19:12 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.installCore (M)
17.3.15.1

File size:
1.2 MB (1,304,568 bytes)

Product version:
1.0.13.24053

Copyright:
SecuredDownload

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\google-chrome.exe

Digital Signature
Signed by:
Advertiso GmbH

Authority:
GlobalSign nv-sa

Valid from:
1/20/2016 3:52:17 PM

Valid to:
5/17/2017 3:53:46 PM

Subject:
CN=Advertiso GmbH, O=Advertiso GmbH, L=Hamburg, S=Hamburg, C=DE

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
11218D42D633AAFCED2E0A8CAF0245EEE3D1

File PE Metadata
Compilation timestamp:
6/20/1992 12:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file google-chrome.exe has been seen being distributed by the following URL.

http://www.bitstagcontent.com/Uv63CUSWKADR _KFQLSF0 YaOkJN_ZwqiVDaq9fS1YBIDfnrF12PTxND TDRDfuH0qQUqIMjMOqBYjDKs97KUOp4P8R437Wb0rhQnMYy8QMvF4QgzNo35FvJZ3F42zf8hTPfFbgm38sjYYaeSD1nHdYKVsASwgC3FBlbon9jtG08hUm87c211G34CiEHMd_K_WcUaVEZsDldqAt07XnfYGlmLh6SdKJoSkyv_uyid8cXEZlIlEfyfl2yrBI QpY9xVxPQog9v355P09B0_AejGUBteLU56YpWykxAyAI2YEsNvT9sAi9ibYFnowpDTQRwGgZemjDpAlcbVXkPP06wHnapmaozAe9S0dTZ_L62k0EIdhofbcM9vqrQ5aqyh58jPuH9bhSLkISETUwntomACFdoQmVDQP7qLIkeLv8JTARfARVSTo3Id9lpK9o6wYixsOH8GM9 D_L5HGBofEI5dBbYp3w30mmVEVbzMNiflb16kgO54v YEcHzgcxvoj3OQ1l9gbx7_hDj2xs0HxerzAczf0nS66 erwepG48Ec6q8nxoVwtPuuCmb6BwTvKz6uTyJxWejTwPOC8oICtoqWMmP5nt4NrTfu3wND38twCTX4pmjLtS VBQ7A3RhJtXacd3Y5IUNzfyvwaRZn3rcq8nluRGKAK8_ IZe7L0oj9N0xloVYaFvS5PnQTzvfcWFa27EwT32ZlOSjrW1XMdc38OjWe5JtDmSuTlMpTtXzNFcEYFxXqhoS6e_rfgVMZX3F0rV35HunjTQi7THYCA4PRBK3iMZ5G4bP 1zB6OJMjIENJsxsFn bN8LQbUpAM9WHsTj2gG48a4U32GGh2fpkYMrDDDPQz B IdM84E AipPRBMhK6 uoc6H s8tTnPtQOFxYRgi2mgR2GDxW81mZRz2C8C3i BD_XzkGmfr9QCUfOGm8eCumIr3NenP5tCVWnNbMESY

Remove google-chrome.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.