Fix-It_Registry_Optimizer_FR.exe

Fix-It Registry Optimizer

Smart PC Solutions, Inc.

The application Fix-It_Registry_Optimizer_FR.exe, “Fix PC problems and optimize performance ” by Smart PC Solutions has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from webtools.avanquest.com and multiple other hosts.
Publisher:
Avanquest Software   (signed by Smart PC Solutions, Inc.)

Product:
Fix-It Registry Optimizer

Description:
Fix PC problems and optimize performance

Version:
2.0

MD5:
ea40f1aaeb287671bdb6c0ceea7faf73

SHA-1:
a6c0c7d1822b472268b41e0bea044f6c53c79f26

SHA-256:
2abc8c3fc27042dc2fa23a7c53a572be4261a513604df6ae0c8fe71d10c3bd99

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
6/23/2018 5:08:57 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Optional.SmartPCSolutions.CC
14.6.10.14

File size:
1.3 MB (1,325,736 bytes)

Product version:
2.0

Copyright:
Avanquest Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\fix-it_registry_optimizer_fr.exe

Digital Signature
Authority:
VeriSign, Inc.

Valid from:
4/15/2009 8:00:00 PM

Valid to:
5/30/2011 7:59:59 PM

Subject:
CN="Smart PC Solutions, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Smart PC Solutions, Inc.", L=Alexandria, S=Virginia, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa (c)04, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
5267DCE6AF375FA7C4F1CA65BD87DF80

File PE Metadata
Compilation timestamp:
6/19/1992 6:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:g20nmlZY3jWkVP1j1BlEiTkWXwDZBmBUU6PGGRsNh2KuItGcesZ:g2nbYzWkVP1jPlxwn4NpNAmtD

Entry address:
0x9B24

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, A2, 95, FF, FF, E8, A9, A7, FF, FF, E8, D4, C9, FF, FF, E8, 1B, CA, FF, FF, E8, 0E, F3, FF, FF, E8, 75, F4, FF, FF, 33, C0, 55, 68, DB, A1, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, A4, A1, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 9B, FE, FF, FF, E8, 02, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 04, D0, FF, FF, 8B, 55, F0, B8, E4, CD, 40, 00, E8, 53, 96, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E4, CD, 40, 00, B2, 01, B8...
 
[+]

Entropy:
7.9876

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file Fix-It_Registry_Optimizer_FR.exe has been seen being distributed by the following 36 URLs.

http://webtools.avanquest.com/download.cfm?tracking=AQ_FR_AD_PA_ED_FIRO_0815&skip=1&em=1&email=[EMV FIELD]email[EMV /FIELD]&firstname=[EMV FIELD]FirstName[EMV /FIELD]&lastname=[EMV FIELD]LastName[EMV /FIELD]&go=http://fastcdn.avanquest.com/FIRO/.../Fix-It_Registry_Optimizer_FR.exe

http://software.avanquest.com/HP?b=psQj45_SKKm5Tj5z_4uYgzMPzhHfyQUx1swJ2NZYRBb9mHYbBwAxSyolviu20Izs&c=rczt9RpBrI0HU6XppNTvuA

https://www.google.com/url?hl=fr&q=http://.../HP?b=WqCt7CzfZDxDWDX6yX7X_uKn0-Ts-OX8H4NdX9CRo7lc4jubLvO7rgD71YsZtZQX&c=zk8OpYjc4c-Onfcrb1djSA&source=gmail&ust=1479031052659000&usg=AFQjCNFovfQIZ0bJe-zj62xHbwicUwCwcQ

https://www.google.com/url?hl=fr&q=http://.../HP?b=fGz3YHSnWvWJMrJi6nYH-3-hZ-1YCaKZ2eyGzTFMfzCfcmwA_xWZWQvHndy2MFzt&c=fKKAZtqCQ2DOt1zq5_FGgA&source=gmail&ust=1472984048598000&usg=AFQjCNGeT4XGoshp1CriAZPa_oP2o8wumg

http://software.avanquest.com/HP?b=N9pAt5Slv1ynLJuMmYDhAS5MBdHMTRDlm9jbbcP3I9A5CSyjmcRi_H0UVHMOMx2w&c=6IHgNpeJXd4RX3WoESA1oQ

http://software.avanquest.com/HP?b=pMbel_20ZN0aFIE31_Cc7Pos1QVIr4seFQGqrusDNoIV1qLeGEhAu9GjPg8B28aK&c=mzsgaAmGHRnbDYB97MNLzA

http://software.avanquest.com/HP?b=EKnuvbCGy98GstB7PxfjYJWtpQAm5nZHPQw9vG8cfcvOy8goZl7F0HHxTrXwHMRa&c=PKH5gKuSrCxF4lxjnScPTw

https://www.google.com/url?hl=fr&q=http://.../HP?b=BO8gLTnwjyF-CViTpTcus6ANT-TN0_b3AaH6qmAn5RLJ8cxMgT0OnGV4yu3DhPUj&c=RzjKkG1EudeC5UwVTKrxew&source=gmail&ust=1479216108996000&usg=AFQjCNGVwNTKetflsrbaN_PMhQil8fy0Yw

http://software.avanquest.com/HP?b=jG7ezO2peDPwUW71ZX0Umz_HdD4o1LuhNq-YshZDa_nzfT1zLC44zCc4b8mlNxD6&c=5mAeo5Cjo5jydrPVXXh5DQ

http://software.avanquest.com/HP?b=sJDe_T7aFNyje8R4PRhKBNvSi_xkHdjAJjL45Q3ojoYtmaBQzI0E2FPpZqNTmvyi&c=2Af1ZDHsiJGdN40kQdHelg

http://software.avanquest.com/HP?b=q4ymKp25XzjlxVbgA3HP41ZLOnFx0vRFogD62Wiy51qECuFa4OQmc4A9N0YFVpob&c=6XKsKsx7Ivk0HuE5ZQnRVg

https://www.google.com/url?hl=ru&q=http://.../HP?b=itIrRnWyqg9zVEeRURmDGSfEnCTyopmk5woBqje9fy44FZkPbF8j68ATp5YQRa5i&c=r-slY8T9heoeGiDIcn4Ysg&source=gmail&ust=1474619920999000&usg=AFQjCNECEp1c-2tuu6DNRk9I90Cr3Mx-kg

https://www.google.com/url?hl=fr&q=http://.../HP?b=jpyAZglJO3khlXQaew79d0QA33l3tYwVMXkNCnUvoIDNxS8ZqHmPZjMGPwaXsuof&c=5oUR47uzzjj8xpOwU_gcXg&source=gmail&ust=1467656769511000&usg=AFQjCNESvT-Vzni8GPEMl5w5O4nqFSoa7w

https://shop.avanquest.com/.../download_link.php?type=master&id=aca1473a8d394198579d071e708943d417062707

http://software.avanquest.com/HP?b=eKUeOiT5LBmmuIFa66ImepztyzYwpj7QLLyK4D8vKYcOGZXhKmKazRrmjUp24KrC&c=dHG7-4gUkOCC9rjGeJlivw

http://software.avanquest.com/HP?b=lnXwyoXQO9G-fP196q_xej16lXymhhT_V2j5L-RwH9GKBkONJUPCdzDUMCpSikvZ&c=7zOVKOR5qzBbBWDMRQn7Jw

http://software.avanquest.com/HP?b=HGVks4PfkhwaNxoBsNb7sAcSjoVb6dI6hCOpTyJi6u30ClHr9L-Lppvd7ZbUYI29&c=kXqn6kWQYrz49-KeQNvKkw

http://webtools.avanquest.com/download.cfm?tracking=AQ_FR_AD_PA_ED_FIRO_0616&skip=1&go=http://fastcdn.avanquest.com/FIRO/.../Fix-It_Registry_Optimizer_FR.exe

Latest 30 of 36 download URLs

Remove Fix-It_Registry_Optimizer_FR.exe - Powered by Reason Core Security