» corrupt_extractor_service_setup.exe
Overview
Analysis
File Details

corrupt_extractor_service_setup.exe

Corrupt Office Data/Text Extract Service

Paul Dudley Pruitt

The application corrupt_extractor_service_setup.exe, “Corrupt Office Data/Text Extract Service Setup ” by Paul Dudley Pruitt has been detected as a potentially unwanted program by 2 anti-malware scanners. The program is a setup application that uses the Inno Setup installer. The installer uses the InstallMonetizer platform which will donwload and install adware toolbars and other potentially unwanted software offers during setup.

File name:

Publisher:

S2 Services (signed by Paul Dudley Pruitt)

Product:

Corrupt Office Data/Text Extract Service

Description:

Corrupt Office Data/Text Extract Service Setup

MD5:

4c6d6fdef350db6760b3f07584837e67

SHA-1:

10c0a978f3524b7ac85892283c32dd8a30217fe3

SHA-256:

80648465cda2d67a92842d5440474731e0380c8143d4dd21453a0629ce33dded

Scanner detections:

2 / 68

Status:

Potentially unwanted

Explanation:

Uses the InstallMonetizer distribution platform to bundle adware.

Analysis date:

4/25/2024 8:47:13 AM UTC (today)

Scan engine

Detection

Engine version

ESET NOD32

Win32/InstallMonetizer.AF

9.9883

Reason Heuristics

PUP.InstallMonetizer.Bundle (M)

16.3.10.15

File size:

25.9 MB (27,115,304 bytes)

Product version:

1.0

File type:

Executable application (Win32 EXE)

Installer:

Inno Setup

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\corrupt_extractor_service_setup.exe

Digital Signature

Signed by:

Paul Dudley Pruitt

Authority:

COMODO CA Limited

Valid from:

7/30/2012 8:00:00 PM

Valid to:

7/31/2013 7:59:59 PM

Subject:

CN=Paul Dudley Pruitt, OU=Sole Proprietor, O=Paul Dudley Pruitt, STREET=9006 Friars Rd, L=Bethesda, S=MD, PostalCode=20817, C=US

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

42F265C90903BF10583E7F12FCD956B8

File PE Metadata

Compilation timestamp:

6/19/1992 6:22:17 PM

OS version:

1.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

2.25

CTPH (ssdeep):

786432:DwW6In0P0cR5lUtzzkS4OpEcvIyoDa8V08a:j6GehR5lUZkS4sEcvjpuNa

Entry address:

0x9C40

Entry point:

55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD... 
[+]

Entropy:

8.0000

Packer / compiler:

Inno Setup v5.x - Installer Maker

Code size:

37 KB (37,888 bytes)

Remove corrupt_extractor_service_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.