» ccleaner professional plus 4.exe
Overview
Analysis
File Details
Network (1)

ccleaner professional plus 4.exe

ProductName

IT Resources LLC

The application ccleaner professional plus 4.exe by IT Resources has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. While running, it connects to the Internet address ekiaiooqqk.c06.mtsvc.net on port 80 using the HTTP protocol.

File name:

Publisher:

Soft company (signed by IT Resources LLC)

Product:

ProductName

Description:

Files downloader

Version:

3.1.3.3

MD5:

2ada15809a79a43231c3fd111b4e4ed6

SHA-1:

f5bbdfd438685cfaba90aeb19ab5c82aa070ad97

SHA-256:

df600c72c7116fe6ed740979b79c7fc7221875984ca2f608f69efca3a48197bb

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

4/29/2024 5:10:39 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

Adware.Bundler

17.2.1.19

File size:

4.4 MB (4,661,440 bytes)

Product version:

3.3.1

All right copyright

Trademarks:

Trademarks are all reserved

Original file name:

OriginalFilename

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\ccleaner professional plus 4.exe

Digital Signature

Signed by:

IT Resources LLC

Authority:

COMODO CA Limited

Valid from:

1/10/2017 7:00:00 PM

Valid to:

2/25/2017 6:59:59 PM

Subject:

CN="""IT Resources"" LLC", OU=IT, O="""IT Resources"" LLC", STREET="v street Academic Tupolev, 17", L=Kiev, S=Kiev, PostalCode=04128, C=UA

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00C51140A460E80FCA0136B9466E66F754

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

Entry address:

0x17E21C

Entry point:

55, 8B, EC, 83, C4, D8, 53, 56, 57, 33, C0, 89, 45, E0, 89, 45, E4, 89, 45, E8, B8, D4, D7, 57, 00, E8, C6, 98, E8, FF, 33, C0, 55, 68, 47, E6, 57, 00, 64, FF, 30, 64, 89, 20, E8, 03, 4F, E8, FF, A1, 74, CA, 65, 00, E8, B9, 70, E8, FF, 85, C0, 7E, 4A, 89, 45, EC, C7, 05, 78, CA, 65, 00, 01, 00, 00, 00, A1, 78, CA, 65, 00, 83, 3C, 85, 70, 4A, 65, 00, 00, 74, 23, A1, 78, CA, 65, 00, 8B, 04, 85, 6C, 4A, 65, 00, 83, C0, 01, 71, 05, E8, 63, 5E, E8, FF, 8B, 15, 78, CA, 65, 00, 89, 04, 95, 70, 4A, 65, 00, FF, 05... 
[+]

Entropy:

7.5170

Developed / compiled with:

Microsoft Visual C++

Code size:

1.5 MB (1,562,624 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to ekiaiooqqk.c06.mtsvc.net (205.186.187.146:80)

Remove ccleaner professional plus 4.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.