home

clearlock.exe

Firseria

The setup program uses the Firseria/Solimba AppInstaller (DownloadMR) which is a monetization download manager that bundles additional adware offers, typically by wrapping legitimate applications. The application clearlock.exe, “Application Installer” by Firseria has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the Solimba DownloadMR installer. During install, it bundles potentially unwanted software on a user's computer at the same time without adequate consent.
Publisher:
Appsinstaller  (signed by Firseria)

Description:
Application Installer

Version:
3.1.3

MD5:
096c6860198407c71ff04be8874f998b

SHA-1:
861e6c0c73e4d3c1c90ef05cec04c80d42651fab

SHA-256:
e93cb9782841fbc0758bc12bb4d3fa6eff07494be12aafb5c7de28b9dc390f95

Scanner detections:
26 / 68

Status:
Adware

Explanation:
May bundle additional potentially unwanted software such as adware during setup.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
4/26/2024 9:56:04 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Application.Bundler.Firseria.A
935

Agnitum Outpost
PUA.Firseria
7.1.1

Avira AntiVirus
APPL/Firseria.A.46
7.11.160.182

avast!
Win32:PUP-gen [PUP]
140617-1

AVG
Adware BundleApp.AJ
2014.0.3986

Bitdefender
Application.Bundler.Firseria.A
1.0.20.975

Clam AntiVirus
Win.Adware.Agent-7596
0.98/19185

Comodo Security
Application.Win32.Firseria.NKP
18852

Dr.Web
Adware.Downware.2225
9.0.1.05190

ESET NOD32
Win32/FirseriaInstaller.F potentially unwanted application
7.0.302.0

F-Prot
W32/Morstar.A.gen
v6.4.7.1.166

F-Secure
Application.Bundler.Firseria
11.2014-14-07_2

G Data
Application.Bundler.Firseria
14.7.24

IKARUS anti.virus
PUA.Solimba
t3scan.1.6.1.0

K7 AntiVirus
Unwanted-Program
13.180.12719

Kaspersky
not-a-virus:AdWare.Win32.Fiseria
15.0.0.494

Malwarebytes
PUP.Optional.BundleInstaller.A
v2014.07.14.05

MicroWorld eScan
Application.Bundler.Firseria.A
15.0.0.585

NANO AntiVirus
Riskware.Win32.Downware.cvyseb
0.28.2.60881

Panda Antivirus
Trj/Genetic.gen
14.07.14.05

Reason Heuristics
PUP.Installer.Firseria.J
14.8.7.17

Sophos
Solimba Installer
4.98

SUPERAntiSpyware
Adware.BundleInstaller/Variant
10484

Vba32 AntiVirus
Downware.Morstar
3.12.26.3

VIPRE Antivirus
Threat.4782980
31208

Zillya! Antivirus
Adware.Fiseria.Win32.17
2.0.0.1858

File size:
293.2 KB (300,264 bytes)

Product version:
3.1.1

Copyright:
Copyright © 2014

Original file name:
installer.exe

File type:
Executable application (Win32 EXE)

Bundler/Installer:
Solimba DownloadMR

Common path:
C:\users\{user}\downloads\clearlock.exe

Digital Signature
Signed by:
Firseria

Authority:
GlobalSign nv-sa

Valid from:
11/11/2013 4:34:44 PM

Valid to:
11/12/2014 4:34:44 PM

Subject:
E=support@solimba.com, CN=Firseria, O=Firseria, L=Badalona, S=Barcelona, C=ES

Issuer:
CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:
112130C3B28D7C9C29B8B07321EF3F8A1462

File PE Metadata
Compilation timestamp:
3/6/2014 5:11:11 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
6144:Q5uRH38i5OBwdmR62zdpuQtv3NxjMjtG6ZLlYBi:Q0RH3nCwdmR62Vv3NuLZLlYBi

Entry address:
0xE4B9

Entry point:
E8, CD, 79, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 78, E4, 41, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, 24, E1, 41, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, 60, 54, 42, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, 64...
 
[+]

Code size:
115 KB (117,760 bytes)

The file clearlock.exe has been seen being distributed by the following URL.

http://nl.download366.com/clearlock/download/.../5608

Remove clearlock.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.