home

adwcleaner_4.002.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from toolslib.net and multiple other hosts.
Description:
Aut2Exe

Version:
4.0.0.2

MD5:
ff33d8cdf04b1d15f3808d49406bea43

SHA-1:
a84f23127df8df711358ed795b2e1840ddabcfa0

SHA-256:
7122c7eb901b44763adf3890f650bfebaaf4d146125e7ae926ba26455f1c0ad8

Scanner detections:
1 / 68

Status:
Clean  (1 probable false positive detection)

Explanation:
This is mosty likely a false positive detection, the file is probably clean.

Analysis date:
12/25/2024 2:13:32 PM UTC  (today)

Scan engine
Detection
Engine version

AegisLab AV Signature
Troj.MSIL.Disfa
2.1.4+

File size:
1.9 MB (1,998,336 bytes)

Product version:
3.3.12.0

Copyright:
©1999-2014 Jonathan Bennett & AutoIt Team

File type:
Executable application (Win32 EXE)

Language:
French (France)

Common path:
C:\users\{user}\downloads\adwcleaner_4.002.exe

File PE Metadata
Compilation timestamp:
10/27/2014 6:13:39 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
49152:lUTsami4k92xXzUsbHTodQ1cu0Q4nu9qAP3uH7qwK/na:laCzUkTd18Q4naq6uH75K/a

Entry address:
0x26B190

Entry point:
60, BE, 00, 70, 61, 00, 8D, BE, 00, A0, DE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
340 KB (348,160 bytes)

The file adwcleaner_4.002.exe has been seen being distributed by the following 50 URLs.

https://toolslib.net/downloads/finish/1/get/.../

https://toolslib.net/downloads/finish/1/get/.../

https://toolslib.net/downloads/finish/1/get/.../

http://download.bleepingcomputer.com/dl/f206325b178e1ebc0f774673b16e0ca4/544f967f/windows/security/security-utilities/a/.../AdwCleaner.exe

http://filepony.de/.../AdwCleaner_4.002.exe

http://download.bleepingcomputer.com/dl/26ff5c4e290acd35ee103921e38f007f/54513b76/windows/security/security-utilities/a/.../AdwCleaner.exe

https://toolslib.net/downloads/finish/1/get/.../

https://toolslib.net/downloads/finish/1/get/.../

http://download.bleepingcomputer.com/dl/6e7e031c0e445c366cb3cb1451980cd1/544fbf1a/windows/security/security-utilities/a/.../AdwCleaner.exe

http://www.comment-supprimer.com/?file=0&did=5236&vp_edd_act=download&expire=MTQxNTQzODEwNA==

http://lb.cdn.m6web.fr/d/c/a/c09b3401052baa22e41403c87be71d52/54534cd1/soft/.../adwcleaner_4-002_fr_430277.exe

http://www.infospyware.us/.../AdwCleaner.exe

https://toolslib.net/downloads/finish/1/get/.../

https://toolslib.net/downloads/finish/1/get/.../

https://toolslib.net/downloads/finish/1/get/.../

http://filepony.de/.../AdwCleaner_4.002.exe

http://download.bleepingcomputer.com/dl/87ae13305767d4fcb49b818e0e3fcaa4/544e43b6/windows/security/security-utilities/a/.../AdwCleaner.exe

https://mega.nz/persistent/.../mVtmzSQQ

http://www.como-eliminar.com/?file=0&did=3797&vp_edd_act=download&expire=MTQxNTA5MzcyNA==

http://download.bleepingcomputer.com/dl/a571d36a183ea5cf7fdca1e0ea137134/54507f6e/windows/security/security-utilities/a/.../AdwCleaner.exe

https://toolslib.net/downloads/finish/1/get/.../

https://toolslib.net/downloads/finish/1/get/.../

http://download.bleepingcomputer.com/dl/286a7d986a98c24d46e104d80cd13691/5450fee3/windows/security/security-utilities/a/.../AdwCleaner.exe

http://download.bleepingcomputer.com/dl/c5b513430e03576dd3d806186ed871d7/544e5f50/windows/security/security-utilities/a/.../AdwCleaner.exe

http://download.bleepingcomputer.com/dl/650a60324fdca2676244d3c15fc9aff1/5450e3f1/windows/security/security-utilities/a/.../AdwCleaner.exe

http://lb.cdn.m6web.fr/d/c/a/da8118ecb73a4d2b90db3dbc6217c9f3/545dde1d/soft/.../adwcleaner_4-002_fr_430277.exe

https://toolslib.net/downloads/finish/1/get/.../

http://download.bleepingcomputer.com/dl/6d3e9b528ba31542d28ecc9440d2eed0/544e5fcb/windows/security/security-utilities/a/.../AdwCleaner.exe

https://toolslib.net/downloads/finish/1/get/.../

http://lb.cdn.m6web.fr/d/c/a/d02b5e79c5893ebcfd532df60f39af4d/545125e7/soft/.../adwcleaner_4-002_fr_430277.exe

Latest 30 of 190 download URLs

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP SSL):
Connects to ip190.ip-5-39-63.eu  (5.39.63.190:443)

Scan adwcleaner_4.002.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.