home

googleearth_setup.exe

Safe Down

This adware bundler is distributed through Adknowledge's advertising supported software managers. The application googleearth_setup.exe, “Premium Installer ” by Safe Down has been detected as adware by 30 anti-malware scanners. The program is a setup application that uses the Adknowledge Fusion installer. The file has been seen being downloaded from downloadd.org.
Publisher:
Premium Installer   (signed by Safe Down)

Product:
Premium Installer

Description:
Premium Installer

Version:
2.4.8.1

MD5:
21c3ac826339e9eb0e829cb04a985d8e

SHA-1:
a8ab802a6382dd829e292fce01fe845ee4da941e

SHA-256:
38bf77ccc193d23193df8e5df3206e937f954ff9a91aae44840543ec2066e632

Scanner detections:
30 / 68

Status:
Adware

Explanation:
This installer bundles various adware prorgams that may include toolbars and web browser advertising injectors/extensions.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/24/2024 10:28:11 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.iBryte.AO
6369393

AhnLab V3 Security
PUP/Win32.Eorezo
2015.01.04

Avira AntiVirus
Adware/iBryte.bxou
7.11.199.92

avast!
Win32:PUP-gen [PUP]
150102-1

AVG
Adware AdPlugin.BSQ
2014.0.4253

Bitdefender
Adware.iBryte.AO
1.0.20.15

Clam AntiVirus
Win.Adware.Kazy-29
0.98/19873

Comodo Security
Application.Win32.IBryte.BM
20582

Dr.Web
Trojan.DownLoader11.40661
9.0.1.05190

Emsisoft Anti-Malware
Adware.iBryte.AO
9.0.0.4799

ESET NOD32
Win32/Adware.iBryte.BO application
7.0.302.0

Fortinet FortiGate
W32/Badur.AY!tr
1/3/2015

F-Prot
W32/A-fc589d0e
v6.4.7.1.166

F-Secure
Adware.iBryte.AO
5.13.68

G Data
Adware.iBryte.AO
15.1.24

IKARUS anti.virus
Trojan-Downloader.Win32.Genome
t3scan.1.8.5.0

K7 AntiVirus
Unwanted-Program
13.1814525

Kaspersky
not-a-virus:AdWare.Win32.iBryte
15.0.0.543

Malwarebytes
PUP.Optional.OptimunInstaller
v2015.01.03.05

MicroWorld eScan
Adware.iBryte.AO
16.0.0.9

NANO AntiVirus
Trojan.Win32.Genome.diihrk
0.30.0.64448

Norman
Adware.iBryte.AO
02.01.2015 13:58:24

nProtect
Trojan-Clicker/W32.iBryte.82288
15.01.02.01

Panda Antivirus
Trj/Genetic.gen
15.01.03.05

Quick Heal
TrojanDwnlder.Genome.D4
1.15.14.00

Reason Heuristics
PUP.Installer.SafeDown.R
15.1.3.17

Total Defense
Win32/Tnega.ZGeSPKC
37.0.11366

Vba32 AntiVirus
AdWare.iBryte
3.12.26.3

VIPRE Antivirus
Threat.4778314
36340

Zillya! Antivirus
Adware.iBryte.Win32.3701
2.0.0.2025

File size:
80.4 KB (82,288 bytes)

Product version:
2.4.8.1

Copyright:
Copyright (C) Premium Installer

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Adknowledge Fusion

Language:
English (United States)

Common path:
C:\users\{user}\downloads\googleearth_setup.exe

Digital Signature
Signed by:
Safe Down

Authority:
COMODO CA Limited

Valid from:
3/18/2014 12:00:00 AM

Valid to:
3/18/2015 11:59:59 PM

Subject:
CN=Safe Down, O=Safe Down, STREET="4600 Madison Ave., FL 10", L=Kansas City, S=Missouri, PostalCode=64112, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00FA71459C161D5D538F7612ACFBFBB680

File PE Metadata
Compilation timestamp:
11/5/2014 9:23:43 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
768:aOKkRrbAeAvnLPu5BEAUMkCfJZKszmJSwO8I3eUZjwyDOJJb+QhEo8mi:PRrbAeAvn7uyMpZJwO8wPQ+Fmi

Entry address:
0x63C1

Entry point:
E8, 52, 05, 00, 00, E9, 36, FD, FF, FF, CC, FF, 25, C0, 81, 40, 00, 6A, 14, 68, C0, B7, 40, 00, E8, B6, 00, 00, 00, FF, 35, 2C, E4, 40, 00, 8B, 35, 9C, 81, 40, 00, FF, D6, 59, 89, 45, E4, 83, F8, FF, 75, 0C, FF, 75, 08, FF, 15, 98, 81, 40, 00, 59, EB, 67, 6A, 08, E8, B2, 05, 00, 00, 59, 83, 65, FC, 00, FF, 35, 2C, E4, 40, 00, FF, D6, 89, 45, E4, FF, 35, 28, E4, 40, 00, FF, D6, 59, 59, 89, 45, E0, 8D, 45, E0, 50, 8D, 45, E4, 50, FF, 75, 08, 8B, 35, 84, 81, 40, 00, FF, D6, 59, 50, E8, 75, 05, 00, 00, 89, 45...
 
[+]

Entropy:
5.7842

Code size:
24.5 KB (25,088 bytes)

The file googleearth_setup.exe has been seen being distributed by the following URL.

http://downloadd.org/uk/.../google-earth.php

Remove googleearth_setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.