PC_Cleaner_setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PC_Cleaner_setup.exe
Size 10.2MB
Sample260620-q78gcaft7j
SHA256 e3ab7fe58e6b96e9064f24d4b975f56c47bf47301ffa26aed188d9ea95472a1f
MD5 3afb4352a97f3b1b9e07eddf2a9ed843
SHA1 b7b7f4209e4aa0678d8f10811ca53c1c17a68a6b
SHA512 bb57742bf63bc1fe24c08e6144a8a769c50e0ffef6a2991ba7ed74e4bf0b125fa095c35629740d027f82e6c49be970bef1ccc81f3d0c6dd70fc29710870b613a
SSDEEP 196608:31BIIaaF4VIreZkisrqpaR+O7Dks+Afv8xxKlR:3EIaLVaPDw2ws+yvFj
TLSH
T134B6F133B306C471E68201F189299BFE923DED795B2540C3E3D43E6A99B52D11632F9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

PC_Cleaner_setup.exe

.exe 10.2MB

PC_Cleaner_setup.exe

IMPHASH 275ced9277d3eed523e12e8dfbfd3cc2
SHA256 e3ab7fe58e6b96e9064f24d4b975f56c47bf47301ffa26aed188d9ea95472a1f
MD5 3afb4352a97f3b1b9e07eddf2a9ed843
SHA1 b7b7f4209e4aa0678d8f10811ca53c1c17a68a6b
SHA512 bb57742bf63bc1fe24c08e6144a8a769c50e0ffef6a2991ba7ed74e4bf0b125fa095c35629740d027f82e6c49be970bef1ccc81f3d0c6dd70fc29710870b613a
SSDEEP 196608:31BIIaaF4VIreZkisrqpaR+O7Dks+Afv8xxKlR:3EIaLVaPDw2ws+yvFj
TLSH
T134B6F133B306C471E68201F189299BFE923DED795B2540C3E3D43E6A99B52D11632F9B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

eb:1d:aa:b9:da:db:ad:6e:0f:29:05:41:e5:6a:18:53:8b:61:46:8a:e4:5b:27:6d:72:f3:95:c7:df:83:4b:74

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1417258-2,CN=PC Helpsoft (7270356 Canada Inc),O=PC Helpsoft (7270356 Canada Inc),L=Montreal,ST=Quebec,C=CA,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024341

Chains

Apr 23, 2026

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

Serial Number

4a:53:8c:28

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 7, 2009 - Dec 7, 2030

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

Serial Number

a1:06:4f:64:0e:bb:2e:45:6a:a1:3a:40:4c:a3:dd:29

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 20, 2025 - Jun 20, 2026

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1956006

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\TemporaryBuilds\azure-adaware-pool-build-de-1\21\s\_build\bin\x86\Release\installer.pdb

wininet

InternetCanonicalizeUrlW

shell32

ShellExecuteExW SHGetFolderPathW

kernel32

EnterCriticalSection InitializeCriticalSection InitializeCriticalSectionEx SetEvent CloseHandle CreateEventA LocalFree FormatMessageW FormatMessageA OutputDebugStringA OutputDebugStringW CopyFileW GetModuleFileNameW FindResourceW LoadResource LockResource DeleteCriticalSection GetCommandLineW SetUnhandledExceptionFilter WideCharToMultiByte GetLastError MultiByteToWideChar LoadLibraryW GetProcAddress FreeLibrary HeapQueryInformation VerifyVersionInfoW WaitForMultipleObjects GetEnvironmentVariableA SleepEx GetCurrentThreadId GetConsoleMode LeaveCriticalSection GetStringTypeExA GetUserDefaultLCID LoadLibraryA FindClose FindNextFileW FindFirstFileW WaitForSingleObject CreateMutexW AllocConsole Sleep GetModuleHandleW GetEnvironmentVariableW SizeofResource GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute WaitForSingleObjectEx IsDBCSLeadByteEx IsValidCodePage GetLocaleInfoA EnumSystemLocalesA FoldStringW LCMapStringW CompareStringW GetDateFormatW GetTimeFormatW GetLocaleInfoW GetCurrencyFormatW ReleaseSemaphore GetSystemInfo OpenEventA ResetEvent WaitForMultipleObjectsEx GetProcessHeap HeapAlloc HeapFree QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer ResumeThread TlsAlloc TlsGetValue WriteConsoleA TlsFree GetModuleHandleA CreateWaitableTimerA WriteConsoleW CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW SetFileAttributesW MoveFileExW GetTickCount GetFileSizeEx GetFileType GetFileTime ReadFile SetFilePointerEx FileTimeToSystemTime GetCurrentDirectoryW CreateDirectoryW FindFirstFileExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI DeviceIoControl CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStringTypeW RaiseException InitOnceComplete InitOnceBeginInitialize FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent ReleaseSRWLockShared AcquireSRWLockShared SetLastError LoadLibraryExW WriteFile GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount ExitProcess GetCommandLineA GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect IsValidLocale EnumSystemLocalesW GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers ReadConsoleW HeapReAlloc GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize SetEndOfFile CreateSemaphoreA DuplicateHandle ProcessIdToSessionId GlobalFree GetComputerNameW GetStringTypeExW CreateJobObjectW CreateIoCompletionPort SetInformationJobObject AssignProcessToJobObject GetQueuedCompletionStatus GetExitCodeProcess CreateProcessW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess GetDynamicTimeZoneInformation GetCurrentProcessId LCMapStringA TlsSetValue

user32

LoadStringA GetSystemMetrics PostMessageW SetWindowTextW SendMessageW LoadIconW MessageBoxW LoadStringW GetWindowRect SetWindowPos

ole32

CoInitializeEx CoCreateInstance CoUninitialize StringFromGUID2 CoSetProxyBlanket CoInitializeSecurity

oleaut32

SysAllocStringLen VariantTimeToSystemTime SysStringLen VariantCopy SysFreeString SysAllocString VariantInit VariantClear

shlwapi

SHDeleteKeyW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpSetTimeouts WinHttpGetProxyForUrl

msi

ord190 ord281 ord116 ord115 ord141 ord118 ord205 ord70

bcrypt

BCryptHashData BCryptCreateHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDeriveKeyPBKDF2 BCryptDestroyHash BCryptGenerateSymmetricKey BCryptGenRandom

advapi32

RegCloseKey RegOpenKeyExW GetUserNameW OpenProcessToken RegSetValueExW RegGetValueW RegDeleteValueW RegCreateKeyExW RegDeleteTreeW CloseServiceHandle OpenSCManagerW OpenServiceW DeleteService CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData RegQueryValueExW LookupAccountSidW ConvertStringSidToSidW RegQueryInfoKeyW RegEnumValueW RegOpenCurrentUser OpenThreadToken RegOpenUserClassesRoot CryptDestroyHash CryptDestroyKey CryptImportKey CryptEncrypt QueryServiceStatusEx GetTokenInformation ImpersonateLoggedOnUser RevertToSelf

ntdll

VerSetConditionMask

ws2_32

gethostname WSAGetLastError closesocket htons socket accept bind connect getpeername getsockname getsockopt recv send setsockopt WSASetLastError WSAIoctl WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents ntohs WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo ioctlsocket recvfrom sendto listen htonl

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

143KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PC_Cleaner_setup.exe

wininet

shell32

kernel32

user32

ole32

oleaut32

shlwapi

winhttp

msi

bcrypt

advapi32

ntdll

ws2_32

crypt32

iphlpapi

secur32

wtsapi32

generic