Pass_1234_Setup.rar - chrome auto download?

We're seeing an unusual behavior where when users open chrome, it automatically downloads a file, Pass_1234_Setup.rar - this is a compressed and encrypted archive that has a malicious setup.exe file imbedded installing TR/Crypt.OPACK.Gen - and it appears like most major antimalware engines do not detect it.

This happens without any modification to the source installation of chrome, no extensions, no predefined webpages that open, etc.

Has anyone else seen this?

auto chrome download malware rar