» googletoolbarinstaller_en32_signed.exe
Overview
Analysis
File Details
Downloads (4)

googletoolbarinstaller_en32_signed.exe

Google Toolbar for Internet Explorer

Google Inc

This is a self-extracting archive and installer. The file has been seen being downloaded from dl.google.com and multiple other hosts.

File name:

googletoolbarinstaller_en32_signed.exe

Publisher:

Google Inc. (signed by Google Inc)

Product:

Google Toolbar for Internet Explorer

Description:

Google Toolbar Installer

Version:

6, 6, 1409, 1944

MD5:

6e079bb9b5703fbdf965d2ad01405624

SHA-1:

a88d46fa5c0858baf6920df56038350c34eb2eb6

SHA-256:

896b7677d3c2153ec5d3d9f310c745cd2be22e8d50c8e6d891fde269614975ce

Scanner detections:

0 / 68

Status:

Clean (as of last analysis)
Whitelisted (by digital signature)

Analysis date:

4/24/2024 9:28:03 PM UTC (today)

File size:

2.2 MB (2,314,416 bytes)

Product version:

6, 6, 1409, 1944

Original file name:

GoogleToolbarInstaller.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\google\update\download\{c854aecb-97bb-4eab-a3a4-ad5863916eba}\googletoolbarinstaller_en32_signed.exe

Digital Signature

Signed by:

Google Inc

Authority:

VeriSign, Inc.

Valid from:

2/22/2010 12:00:00 AM

Valid to:

2/22/2012 11:59:59 PM

Subject:

CN=Google Inc, OU=Digital ID Class 3 - Java Object Signing, O=Google Inc, L=Mountain View, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

36B8DA6BF00D94F158301001ADD6527F

File PE Metadata

Compilation timestamp:

2/9/2011 8:00:28 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

8.0

CTPH (ssdeep):

49152:wuSbRpmwbvIYOo3N8iH3MwBD0PgHwulzKCM5PoslcId9:wuMNbv/L3N8iVD0P0wulzMoslp

Entry address:

0x32109

Entry point:

B8, 8C, C4, C6, 00, 50, 64, FF, 35, 00, 00, 00, 00, 64, 89, 25, 00, 00, 00, 00, 33, C0, 89, 08, 50, 45, 43, 6F, 6D, 70, 61, 63, 74, 32, 00, 98, 2F, D6, E1, 4F, 7A, E5, 26, AB, 55, 5B, 47, 6B, 62, B2, 3E, 74, 35, 7A, F4, 82, 67, FE, C8, 25, 4B, AB, 4A, EA, FE, 00, 44, 61, 31, 74, B7, 9D, 29, 69, E6, D6, F7, 54, 96, E1, 3D, C6, 2C, 09, 83, 79, 51, 19, 88, 70, 8F, E4, 37, C5, C2, FA, D6, 0A, FA, 0F, 4B, C2, 6A, 61, CF, 19, 44, B1, 94, ED, 0B, 34, E5, 55, 7C, 64, 36, 3C, 18, AD, FA, C5, B5, 09, 67, BB, 4C, CB... 
[+]

Entropy:

7.9966

Packer / compiler:

PECompact v2

Code size:

283 KB (289,792 bytes)

The file googletoolbarinstaller_en32_signed.exe has been seen being distributed by the following 4 URLs.

http://dl.google.com/toolbar/T4/data/zh-CN/big/.../GoogleToolbarInstaller.exe

http://download.informer.com/.../googletoolbarinstaller_en32_signed.exe

http://google-toolbar-for-internet-explorer.software.informer.com/.../

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.