home

software_reporter_tool.exe

Chrome Cleanup Tool

Google

The executable software_reporter_tool.exe has been detected as malware by 11 anti-virus scanners. Infected by an entry-point obscuring polymorphic file infector which will create a peer-to-peer botnet and receives URLs of additional files to download.
Publisher:
Google

Product:
Chrome Cleanup Tool

Version:
4.32.1

MD5:
d3fec33ee12b3812fb53018c277676db

SHA-1:
84fb6e6020ddffa495cfdb64f06e7b7fb95584b0

SHA-256:
fd4fc667155fcfa9bcf1f17f49f6972aea5c3f8fc741cc2bab653793d8c1760b

Scanner detections:
11 / 68

Status:
File is infected by a Virus

Explanation:
The file is infected by a polymorphic file infector virus.

Analysis date:
4/25/2024 9:17:53 AM UTC  (today)

Scan engine
Detection
Engine version

avast!
Win32:Kukacka
160118-1

AVG
Win32/Sality
2015.0.4522

Dr.Web
Win32.Sector.30
9.0.1.05190

Emsisoft Anti-Malware
Win32.Sality
10.0.0.5366

ESET NOD32
Win32/Sality.NBA virus
7.0.302.0

F-Secure
Win32.Sality.3
5.15.21

Kaspersky
Virus.Win32.Sality
15.0.0.562

McAfee
Virus.W32/Sality.gen.z
18.0.204.0

Microsoft Security Essentials
Threat.Undefined
1.213.5033.0

Norman
Win32.Sality.3
11.01.2016 17:30:26

Sophos
Virus 'Mal/Sality-D'
5.22

File size:
1.4 MB (1,439,048 bytes)

Product version:
4.32.1

Copyright:
Copyright 2015 Google Inc. All Rights Reserved.

Original file name:
chrome_cleanup_tool.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\coccoc\browser\user data\swreporter\4.32.1\software_reporter_tool.exe

File PE Metadata
Compilation timestamp:
10/14/2015 8:59:25 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
24576:fuwbv6iQkYVIrEvZuQn6TXqlF6n7WYDqjs:BykYVIrdY6TXqr6n7hqs

Entry address:
0x6706E

Entry point:
60, 0F, BA, F5, 77, 11, C7, 0F, AF, DA, FF, CE, 3B, F1, 78, 06, 88, C2, F6, C5, 9F, 49, 0F, CF, 18, E7, 3B, C3, C1, CF, B1, 05, 64, FF, FF, 1A, 10, CD, F3, 88, FB, 0F, C1, FB, D0, DE, C1, EB, D7, 0F, C1, F9, E8, 48, 00, 00, 00, 0F, CB, 81, F2, 7D, F2, A9, E8, 0F, CA, 0F, BA, F3, 1E, D3, E7, 0F, C1, CD, 0F, B6, EE, 69, ED, E2, 50, 99, D5, C0, D5, EA, 8B, FE, C0, E2, 4F, 0F, AD, FA, 69, D2, CF, 61, F3, 07, 8B, F7, 69, EA, D6, DF, A9, 50, 84, EF, 69, CD, BA, 9C, 11, EB, 0F, CD, 8A, CF, 0F, BB, D5, 33, C6, D0...
 
[+]

Entropy:
5.4656

Code size:
528 KB (540,672 bytes)

Remove software_reporter_tool.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.