home

adwcleaner.exe

QUALITY SCORE SL

The application adwcleaner.exe by QUALITY SCORE SL has been detected as adware by 4 anti-malware scanners. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. The file has been seen being downloaded from base205.com and multiple other hosts.
Publisher:
Setup Manager  (signed by QUALITY SCORE SL)

Product:
Setup Manager

Version:
3.5.39.777

MD5:
65134b1d2cbe915ab6162982da70a2d3

SHA-1:
e43a54542946ad3462b960714417fd521ea18ef4

SHA-256:
c8525cf0eb7b7e5b3cf42e68310aa8631382cab4659e898507f753317a7e93e8

Scanner detections:
4 / 68

Status:
Adware

Analysis date:
11/23/2024 11:04:45 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

IKARUS anti.virus
AdWare.MSIL.Colooader
t3scan.1.9.5.0

Panda Antivirus
PUP/Multitoolbar
15.08.05.12

Reason Heuristics
PUP.QUALITYSCORE.Installer (M)
15.8.5.0

VIPRE Antivirus
Iminent
42614

File size:
126.1 KB (129,080 bytes)

Product version:
3.5.39.777

Copyright:
Copyright © 2014-2015

Trademarks:
Setup Manager

Original file name:
i3KC.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\adwcleaner.exe

Digital Signature
Signed by:
QUALITY SCORE SL

Authority:
COMODO CA Limited

Valid from:
1/20/2015 1:00:00 AM

Valid to:
1/21/2016 12:59:59 AM

Subject:
CN=QUALITY SCORE SL, O=QUALITY SCORE SL, STREET=CALLE SERRANO 213, L=MADRID, S=MADRID, PostalCode=28016, C=ES

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00AFDAFBF8A640E5E34B76A9CAFF494517

File PE Metadata
Compilation timestamp:
7/15/2015 5:23:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
3072:K6qAQ0n5Oow1zWAA8nalbkjvAPfpvpS8aXcGzb:K63FB+albkX9cS

Entry address:
0x1A5EE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 04, 00, 03, 00, 00, 00, 30, 00, 00, 80, 0E, 00, 00, 00, 60, 00, 00, 80, 10, 00, 00, 00, 90, 00, 00, 80, 18, 00, 00, 00, C0, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 02, 00, 00, 00, 48, 00, 00, 80, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 00, 00, F0, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
97.5 KB (99,840 bytes)

The file adwcleaner.exe has been seen being distributed by the following 5 URLs.

http://base205.com/getAds.php?signature=qualityscorei3&downloadName=adobe-acrobat-reader.exe

http://base205.com/getAds.php?signature=qualityscorei3&downloadName=navegador-gratis.exe

http://base205.com/getAds.php?signature=qualityscorei3&downloadName=firefox-2-3.exe

http://base205.com/getAds.php?signature=qualityscorei3&downloadName=maxthon-cloud-browser.exe

http://base205.com/getAds.php?signature=qualityscorei3&downloadName=happy-wheels-1-1-0.exe

Remove adwcleaner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.