{"id":4125,"date":"2015-01-29T11:47:57","date_gmt":"2015-01-29T11:47:57","guid":{"rendered":"http:\/\/www.freefixer.com\/b\/?p=4125"},"modified":"2018-05-29T12:01:00","modified_gmt":"2018-05-29T12:01:00","slug":"world-setup-new-media-holdings-ltd-11-detection-rate-installcore","status":"publish","type":"post","link":"https:\/\/www.freefixer.com\/b\/world-setup-new-media-holdings-ltd-11-detection-rate-installcore\/","title":{"rendered":"World Setup (New Media Holdings Ltd.) – 11% Detection Rate – InstallCore"},"content":{"rendered":"

Hello readers! Just wanted to give you heads-up on suspicious file I found right now. The file is named ChromeSetup.exe<\/strong> and digitally signed by World Setup (New Media Holdings Ltd.)<\/strong>.<\/p>\n

It’s possible to view additional information about the certificate by right-clicking on the file, choosing properties and then clicking on the Digital Signatures tab. According to the certificate we can see that World Setup (New Media Holdings Ltd.) appears to be located in Tel Aviv<\/strong>, Israel<\/strong> and that the certificate is issued by GlobalSign CodeSigning CA – G2.<\/p>\n

\"World<\/a><\/p>\n

The problem is that ChromeSetup.exe is not an official Google Chrome download. If it was, it would be digitally signed by Google Inc.<\/strong>. Here’s how the authentic Google Chrome<\/strong> looks like when you double click on it. Notice that the “Verified publisher” says “Google Inc”.
\n\"Chrome<\/a><\/p>\n

After uploading the World Setup (New Media Holdings Ltd.) file – ChromeSetup.exe – to VirusTotal<\/a>, it was clear that it’s probably better to stay away from\u00a0file than running it. The detection rate was 11% and some of the detection names were: ADWARE\/InstallCore.Gen<\/strong>, Application.Win32.InstallCore.DR<\/strong> and InstallCore (fs)<\/strong>.<\/p>\n

Since you probably came here after finding a download that was digitally signed by World Setup (New Media Holdings Ltd.), please share what kind of download it was and if it was detected by the antimalware scanners at VirusTotal<\/a>.<\/p>\n

Thanks for reading.<\/p>\n","protected":false},"excerpt":{"rendered":"

Hello readers! Just wanted to give you heads-up on suspicious file I found right now. The file is named ChromeSetup.exe and digitally signed by World Setup (New Media Holdings Ltd.). It’s possible to view additional information about the certificate by right-clicking on the file, choosing properties and then clicking on the Digital Signatures tab. According … Continue reading World Setup (New Media Holdings Ltd.) – 11% Detection Rate – InstallCore<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[54],"tags":[104,252,381,251],"_links":{"self":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4125"}],"collection":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/comments?post=4125"}],"version-history":[{"count":2,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4125\/revisions"}],"predecessor-version":[{"id":4129,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/posts\/4125\/revisions\/4129"}],"wp:attachment":[{"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/media?parent=4125"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/categories?post=4125"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.freefixer.com\/b\/wp-json\/wp\/v2\/tags?post=4125"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}