home

english-install.exe

PC Cleaner Pro

PC Cleaner Inc.

The application english-install.exe by PC Cleaner has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from RevenueWire's affiliate distribution platform love2008.nwpc.revenuewire.net and multiple other hosts.
Publisher:
(c) PC Cleaners Inc  (signed by PC Cleaner Inc.)

Product:
PC Cleaner Pro

Version:
21.0.0.0

MD5:
90cae075a765f225b5807e52b020e3ba

SHA-1:
5a8c0cecd68b0786cb1c7ef952ee559ceb4e4908

SHA-256:
dfa13752cb3b4f913aaf2aca066087e839e05e37074cb77e1cf85a284b19c754

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/28/2024 12:35:14 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.PCCleaner.cPCClean.Installer.Meta (L)
16.6.10.14

File size:
5.4 MB (5,610,392 bytes)

Product version:
21.0.0.0

Copyright:
(c)2016 PC Cleaners Inc. All rights reserved.

Original file name:
PCInstaller.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\english-install.exe

Digital Signature
Signed by:
PC Cleaner Inc.

Authority:
Symantec Corporation

Valid from:
8/10/2015 8:00:00 PM

Valid to:
8/10/2016 7:59:59 PM

Subject:
CN=PC Cleaner Inc., O=PC Cleaner Inc., L=Laguna Niguel, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3D4B99D267157B4AE7602BBCE79FE9DE

File PE Metadata
Compilation timestamp:
5/27/2016 4:23:51 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:vY5Ndf0dG1TUMslgK3XkJGlCbzShZVIiz1GyqROwjcH9fZVBDdEn1X0WFDIXkbHe:w53mG5SlFnU+CHSW30wwHVBDu1vNq6XC

Entry address:
0xA8DE50

Entry point:
60, BE, 00, C0, 93, 00, 8D, BE, 00, 50, AC, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B...
 
[+]

Entropy:
7.7969

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
5.3 MB (5,582,848 bytes)

The file english-install.exe has been seen being distributed by the following 14 URLs.

http://love2008.nwpc.revenuewire.net/.../PCPro-English?315

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?error686

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?error-code-list-1-exact19073

http://love2008.nwpc.revenuewire.net/.../PCPro-English?new-fenzu-0-broad3887

http://www.nonabyte.net/.../download

http://pccleaner.com/scan3.php

http://love2008.nwpc.revenuewire.net/.../PCPro-English?adwod-E2new-9234

http://love2008.nwpc.revenuewire.net/.../PCPro-English?new-fenzu-4-0-broad2771-sitelink01-new-fenzu-4-0-broad

http://love2008.nwpc.revenuewire.net/.../PCPro-English?adw610

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?liutilities-dll-0-phrase323

http://love2008.nwpc.revenuewire.net/.../PCPro-English?new-fenzu-2-0-broad4372

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?cleanerrors-FileErrors-0-phrase904

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?error2998

http://pc-cleaners.com/English-install.exe

Remove english-install.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.