home

googlechromesetup.exe

Installer

Software

The executable googlechromesetup.exe, “Installer Setup ” has been detected as malware by 11 anti-virus scanners. The program is a setup application that uses the Inno Setup installer, however the file is not signed with an authenticode signature from a trusted source. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download. The file has been seen being downloaded from www.quickappnew.com.
Publisher:
Software

Product:
Installer

Description:
Installer Setup

Version:
2.0.4.0

MD5:
10f8a41d8165ef06b05a3cc581aeaf8d

SHA-1:
2db5b6fabd2f9dd2b6925bfc860b3c795b67a009

SHA-256:
fbf53afe821ae8de6e9ca0b6e2c1f84f1ca5154bd4755ffde67023683af3e348

Scanner detections:
11 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
5/19/2024 7:26:19 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:SaliCode
160326-0

AVG
Win32/Sality
2015.0.4565

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
11.5.0.6191

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Prot
W32/Sality.gen2
4.6.5.141

F-Secure
Win32.Sality.3
5.15.21

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Trojan.Artemis!73F2ECB77E58
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.219.1294.0

Norman
Win32.Sality.3
10.04.2016 15:29:17

File size:
982.9 KB (1,006,528 bytes)

Product version:
1.4

Copyright:
Software Program

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\googlechromesetup.exe

File PE Metadata
Compilation timestamp:
6/19/1992 3:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:3oFKDcV6iHUGrkyc2NN1pHi50mVTAABuvp1v+dWrTHbo0gT:3KuZiHUbazi549m87o0S

Entry address:
0xA5F8

Entry point:
8B, D0, 80, DF, 8D, 68, 41, 40, AE, 00, 53, 69, F7, 5C, D6, 51, F5, 87, F1, F3, 4D, 42, EB, 0A, FE, CE, 80, FD, A6, BF, C1, AE, 76, A0, 76, 08, 69, CD, B6, 1F, 40, FE, 28, F9, 2D, 00, E5, 00, 00, FF, CD, 05, BF, 08, 00, 00, 81, ED, 31, 14, F1, CD, F3, 69, F0, 78, F5, EE, AD, 86, D9, 0C, 50, 84, F8, 8D, 35, 5F, 7F, 9F, 02, F6, C1, 75, 69, FA, 2F, FE, 94, 0F, C6, C6, D3, 69, D9, AB, 0C, 45, 3A, 89, E8, 49, BD, 3C, 00, 00, 00, 40, 81, C5, 77, 01, 00, 00, 69, C9, C9, 03, 00, 9D, 0F, AF, CB, F2, 71, 07, 0F, B7...
 
[+]

Entropy:
7.9471  (probably packed)

Code size:
39.5 KB (40,448 bytes)

The file googlechromesetup.exe has been seen being distributed by the following URL.

http://www.quickappnew.com/c?x=zd9MFROC4Ktb8b/k8f yIqLmb3eaJgKf4HCZcORplMo=&c=gREL2RAfdiBSjejPxt0VCCy7TGtd8GvrXoJL8n5ryMvZ8bQEaCp2pBtU1RTyMmIoHosZVzXUUv2SpiE3ygyMZdXiaboNJw0XWe5VobmbrV26PwbJQrYL6HKM4p KRzYEIoBoffrHc0hACu2YmL7Mmg==&downloadAs=GoogleChromeSetup.exe&fallback_url=http://allmyapps.com/binary/570/.../direct-download?token=90c4f1d505d730885cc98010575156fddefdb54b

Remove googlechromesetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.