home

pdccq.exe

Andrew Kruzov

The is the installer for the WebPick InstalleRex download manager which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed without consent. The application pdccq.exe by Andrew Kruzov has been detected as adware by 25 anti-malware scanners. It uses Web-Pick's InstalleRex download manager and installer to bundle potentially unwanted ad-supported software which includes toolbars and browser extensions through a pay-per-install monetization scheme. It is also typically executed from an Internet Explorer cache folder.
Publisher:
Andrew Kruzov  (signed and verified)

MD5:
ea3617dfec7b988289d557394736bf74

SHA-1:
a0014b50d1b16a4a05b20ed0b4f7d64fff983bca

SHA-256:
113affbb271bc669773e1746743c2b775001062bd22c61ae5ec39b9742fb5762

Scanner detections:
25 / 68

Status:
Adware

Explanation:
Uses the InstalleRex from WebPick Internet Holdings to install bundled add-ons including toolbars and other web browser extensions.

Analysis date:
4/25/2024 6:58:19 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Dropper.101
1018

Agnitum Outpost
PUA.MultiPlug
7.1.1

AhnLab V3 Security
PUP/Win32.InstallRex
14.04.23

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.140.110

avast!
Win32:InstalleRex-BI [PUP]
2014.9-140423

AVG
Generic_r
2015.0.3496

Bitdefender
Gen:Variant.Adware.Dropper.101
1.0.20.565

Comodo Security
Application.Win32.Multiplug.R
18027

Dr.Web
Trojan.Crossrider.7187
9.0.1.0113

Emsisoft Anti-Malware
Gen:Variant.Adware.Dropper.101
8.14.04.23.07

ESET NOD32
Win32/AdWare.MultiPlug (variant)
8.9619

F-Secure
Gen:Variant.Adware.Dropper.101
11.2014-23-04_4

G Data
Gen:Variant.Adware.Dropper.101
14.4.24

IKARUS anti.virus
Win32.SuspectCrc
t3scan.2.2.29

K7 AntiVirus
Adware
13.176.11613

Kaspersky
not-a-virus:AdWare.Win32.MultiPlug
14.0.0.3974

Malwarebytes
PUP.Optional.MultiPlug.A
v2014.04.23.07

McAfee
PUP-FID!036216300503
5600.7152

MicroWorld eScan
Gen:Variant.Adware.Dropper.101
15.0.0.339

NANO AntiVirus
Riskware.Win32.MultiPlug.cvshxw
0.28.0.58720

Panda Antivirus
Trj/Genetic.gen
14.04.23.07

Reason Heuristics
PUP.AndrewKruzov.F
14.5.9.15

Rising Antivirus
PE:Malware.MultiPlug!6.13CF
23.00.65.14421

Sophos
InstallRex
4.98

VIPRE Antivirus
Installerex/WebPick
27914

File size:
1.5 MB (1,612,080 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\pdccq.exe

Digital Signature
Signed by:
Andrew Kruzov

Authority:
COMODO CA Limited

Valid from:
9/27/2013 1:00:00 AM

Valid to:
9/28/2014 12:59:59 AM

Subject:
CN=Andrew Kruzov, O=Andrew Kruzov, STREET=Savrasova 31, L=Kiev, S=Kiev, PostalCode=03110, C=UA

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
53C0E7306A4ED340CBA044D801891A67

File PE Metadata
Compilation timestamp:
4/16/2014 10:36:39 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
49152:nZ1yXTKqB8EMF4HrHcbbcuKEIRTcT3cx9O:sAN8Tcbb8Eg1nO

Entry address:
0x1089B

Entry point:
E8, 3E, 4A, 00, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 80, 21, 42, 00, E8, 1F, 21, 00, 00, E8, E0, 07, 00, 00, 0F, B7, F0, 6A, 02, E8, D1, 49, 00, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 90, 37, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
102.5 KB (104,960 bytes)

Remove pdccq.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.