home

PCBooster.exe

PCBooster

JH Software Private Limited

The application PCBooster.exe, “This installer database contains the logic and data required to install PCBooster.” by JH Software Private Limited has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. It is also typically executed from the user's temporary directory.
Publisher:
Portable Booster [MicroSoft]  (signed by JH Software Private Limited)

Product:
PCBooster

Description:
This installer database contains the logic and data required to install PCBooster.

Version:
1.0.0

MD5:
c598c1c2c9fd09fe682919d91ae45113

SHA-1:
d3f4a572fa71f70bc5b5a19b1d9499be28f50540

SHA-256:
86657aa41a03db95b06aff3ad7a763033ea984b4c5f5319e00bb9803c91d67cb

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
11/23/2024 12:00:13 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.JHSoftwa.Installer (M)
16.5.10.2

File size:
5.3 MB (5,595,952 bytes)

Product version:
1.0.0

Copyright:
Copyright (C) 2014 Portable Booster [MicroSoft]

Original file name:
PCBooster.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\pcbooster.exe

Digital Signature
Signed by:
JH Software Private Limited

Authority:
Thawte, Inc.

Valid from:
7/27/2014 8:00:00 PM

Valid to:
7/19/2015 7:59:59 PM

Subject:
CN=JH Software Private Limited, OU=IT, O=JH Software Private Limited, L=New Delhi, S=Delhi, C=IN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
1EB0D774DCDE92063F522689F4040A38

File PE Metadata
Compilation timestamp:
7/30/2014 4:40:34 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:WqKMgb6ViwLMXubATd5+ygPRCnT/r7OO+Hl8zkXyPterEf7520KrjYCsY0geuubz:CXmA+bO5+ZRCnT/r7o3ElN2jYmeDP3b

Entry address:
0xC875C

Entry point:
E8, 47, CC, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, 5D, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, C5, D5, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, 39, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A1, D5, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 0A, 4E, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Entropy:
7.7487  (probably packed)

Code size:
1021.5 KB (1,046,016 bytes)

Remove PCBooster.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.