ccleaner.exe

installer.exe

Firseria

The setup program uses the Firseria/Solimba AppInstaller (DownloadMR) which is a monetization download manager that bundles additional adware offers, typically by wrapping legitimate applications. The application ccleaner.exe by Firseria has been detected as adware by 7 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. The installer uses the Solimba download manager to push adware offers during the download and setup process. Bundled adware includes search and shopping web browser toolbars. The installer is marketed through download protals and search ads as the free Piriform CCleaner but will also install additional software offers which include adware, PUPs and browser toolbars.
Remove ccleaner.exe - Powered by Reason Core Security
Publisher:
Firseria sl  (signed by Firseria)

Product:
installer.exe

Description:
setup_manager

Version:
3.1.12.9

MD5:
91c99fbce3e2d2b64d7b7ed56512635b

SHA-1:
da92cbdf96093953adccc455d762ee8fb203238d

SHA-256:
05e00f6dca679f91916435886f702f712114111d1d870996b959a771d947f891

Scanner detections:
7 / 68

Status:
Adware

Explanation:
Uses the Solimba installer to bundle adware offers.

Description:
This is an installer which may bundle legitimate applications with offers for additional 3rd-party applications that may be unwanted by the user. While the installer contains an 'opt-out' feature this is not set be defult and is usually overlooked.

Analysis date:
12/9/2016 6:26:43 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Solimba
2015.0.3447

G Data
Win32.Application.Morstar
14.6.24

Malwarebytes
PUP.Optional.AppsInstaller
v2014.06.10.02

Reason Heuristics
PUP.Installer.Firseria.I
14.8.15.15

Sophos
Solimba Installer
4.98

Vba32 AntiVirus
Downware.Morstar
3.12.26.0

VIPRE Antivirus
Threat.4782980
30086

Remove ccleaner.exe - Powered by Reason Core Security
File size:
494.9 KB (506,784 bytes)

Product version:
3.1.17

Copyright:
copyright © 2014

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Common path:
C:\users\{user}\downloads\ccleaner.exe

Digital Signature
Signed by:

Authority:
GlobalSign nv-sa

Valid from:
11/11/2013 10:34:44 AM

Valid to:
11/12/2014 10:34:44 AM

Subject:
E=support@solimba.com, CN=Firseria, O=Firseria, L=Badalona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130C3B28D7C9C29B8B07321EF3F8A1462

File PE Metadata
Compilation timestamp:
6/10/2014 4:14:57 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
12288:U2VuY9g81IOz/YUT3KlKPmgqwoxG1xHiWCIJCSc:U2VuY9rIOzcrwoxG/HZPc

Entry address:
0xE5CA

Entry point:
E8, 7C, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 10, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, C4, E0, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Code size:
115 KB (117,760 bytes)

Remove ccleaner.exe - Powered by Reason Core Security