home

cleaner.exe

MD5:
dc58b2e2ec1f0e855656f10b068a1c85

SHA-1:
badb185ac8cb5fd263a66d67152248c47474711d

SHA-256:
bd54cbcf5f95dbdb0668f00f345ca930ea2265da0d713808105d90304544fdc8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/28/2024 9:28:34 PM UTC  (today)

File size:
666 KB (681,984 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\cleaner.exe

File PE Metadata
Compilation timestamp:
6/28/2013 11:00:42 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.0

CTPH (ssdeep):
12288:J15Yg95m27xVl+ISSAk+PCLzIAawES/IdhB7kDsJ563lIbn888888888888W888k:P5Yc5m27xVl+AAjPCLzIM/+7REIK

Entry address:
0x1414

Entry point:
EB, 10, 66, 62, 3A, 43, 2B, 2B, 48, 4F, 4F, 4B, 90, E9, 9C, 70, 48, 00, A1, 8F, 70, 48, 00, C1, E0, 02, A3, 93, 70, 48, 00, 52, 6A, 00, E8, 53, 4C, 08, 00, 8B, D0, E8, 6A, 8F, 07, 00, 5A, E8, 48, 8B, 07, 00, E8, 53, 94, 07, 00, 6A, 00, E8, 7C, A5, 07, 00, 59, 68, 38, 70, 48, 00, 6A, 00, E8, 2D, 4C, 08, 00, A3, 97, 70, 48, 00, 6A, 00, E9, 1B, 1D, 08, 00, E9, AE, A5, 07, 00, 33, C0, A0, 81, 70, 48, 00, C3, A1, 97, 70, 48, 00, C3, 60, BB, 00, 50, B0, BC, 53, 68, AD, 0B, 00, 00, C3, B9, EC, 00, 00, 00, 0B, C9...
 
[+]

Entropy:
6.4698

Code size:
536 KB (548,864 bytes)

The file cleaner.exe has been seen being distributed by the following 5 URLs.

https://doc-0c-14-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/elvv0tuq61u84pbn33f5ii6petfjdaeo/1397731500000/ZXhwbG9yZXI=/.../MEI5MjZtdnpvYjZmY1RVaGxTa3hzUjNsUlYwRQ==?a=dl&filename=AiSuite3Cleaner.zip&sec=AHSqidZHruQvRfJmYnULU7fhiqZy3US2IQlaKfpV5oAwlZgHBaYq-MXgqirSHY5N-9B4Hn8KRxZV&rel=zip;z1;Cleaner.exe

https://doc-08-28-docs.googleusercontent.com/docs/securesc/hn0m7jc9lbm1121gfmnmbgj8hniiui00/i10bidd2p9f3h5n47n32057bbqas7g5m/1405346400000/.../15005452910824326029/171tJ2bAwwIUUo3NA0bTxTrsYSrDdGLE0Resk9XK8By6_WxmNX8HmgNtEgNsG?e=download&h=16653014193614665626&nonce=0ed0n6fr3438s&user=15005452910824326029&hash=mlies65oto0n02dlunfthfn1ns5dq6uj

https://docs.google.com/nonceSigner?nonce=0ed0n6fr3438s&continue=https://doc-08-28-docs.googleusercontent.com/docs/securesc/hn0m7jc9lbm1121gfmnmbgj8hniiui00/i10bidd2p9f3h5n47n32057bbqas7g5m/1405346400000/.../15005452910824326029/171tJ2bAwwIUUo3NA0bTxTrsYSrDdGLE0Resk9XK8By6_WxmNX8HmgNtEgNsG?e=download&h=16653014193614665626&hash=m19g5af298i58q5hlc90vv7vsaf8hs49

https://doc-08-28-docs.googleusercontent.com/docs/securesc/hn0m7jc9lbm1121gfmnmbgj8hniiui00/i10bidd2p9f3h5n47n32057bbqas7g5m/1405346400000/.../15005452910824326029/171tJ2bAwwIUUo3NA0bTxTrsYSrDdGLE0Resk9XK8By6_WxmNX8HmgNtEgNsG?h=16653014193614665626&e=download

https://drive.google.com/uc?id=171tJ2bAwwIUUo3NA0bTxTrsYSrDdGLE0Resk9XK8By6_WxmNX8HmgNtEgNsG&export=download

Scan cleaner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.