home

PCHCstart.exe

PCHCstart

Sutherland Global Services, Inc.

The executable PCHCstart.exe has been detected as malware by 15 anti-virus scanners.
Publisher:
Sutherland  (signed by Sutherland Global Services, Inc.)

Product:
PCHCstart

Version:
1.00.0199

MD5:
05cc2af724b4060d81e8c02d478eabc0

SHA-1:
ba29b375dc8423ec14077b60c7fca170946f7461

SHA-256:
f94466215559a007a81fa70eaf95fd93223e442db59d1c04be8e3e3cf985d44d

Scanner detections:
15 / 68

Status:
Malware

Analysis date:
11/25/2024 2:32:04 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Trojan.Heur.vm1@fXcE9Dki
-11

Avira AntiVirus
TR/Spy.346744
7.11.162.10

avast!
Win32:Malware-gen
2014.9-170215

Bitdefender
Gen:Trojan.Heur.vm1@fXcE9Dki
1.0.20.230

Clam AntiVirus
Win.Trojan.Agent-323815
0.98/21411

Comodo Security
UnclassifiedMalware
18872

Emsisoft Anti-Malware
Gen:Trojan.Heur.vm1@fXcE9Dki
8.17.02.15.09

F-Secure
Gen:Trojan.Heur.vm1@fXcE9Dki
11.2017-15-02_4

G Data
Gen:Trojan.Heur.vm1@fXcE9Dki
17.2.24

IKARUS anti.virus
Gen.Trojan.Heur
t3scan.1.6.1.0

MicroWorld eScan
Gen:Trojan.Heur.vm1@fXcE9Dki
18.0.0.138

Norman
Suspicious_Gen2.JABEW
11.20170215

Qihoo 360 Security
Win32/Trojan.471
1.0.0.1015

Sophos
Mal/VB-F
4.98

Trend Micro House Call
Suspicious_GEN.F47V0715
7.2.46

File size:
338.6 KB (346,744 bytes)

Product version:
1.00.0199

Original file name:
PCHCstart.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\pchcstart.exe

Digital Signature
Signed by:
Sutherland Global Services, Inc.

Authority:
VeriSign, Inc.

Valid from:
7/16/2010 8:00:00 PM

Valid to:
7/17/2011 7:59:59 PM

Subject:
CN="Sutherland Global Services, Inc.", OU=GSI, OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Sutherland Global Services, Inc.", L=Rochester, S=New York, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
2E74A7AEFDAE01D74A58E3F10265B01D

File PE Metadata
Compilation timestamp:
2/23/2011 2:32:22 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

Entry address:
0x4914

Entry point:
68, 28, A6, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 40, 00, 00, 00, 00, 00, 00, 00, E1, 08, 9E, 74, 99, 8D, 15, 49, AB, A5, 4C, 7A, 58, 04, 3C, 68, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 73, 20, 41, 73, 20, 4C, 50, 43, 48, 43, 73, 74, 61, 72, 74, 00, 20, 42, 79, 56, 61, 6C, 00, 00, 00, 00, FF, CC, 31, 00, 0A, 26, B3, ED, 90, E2, 48, 0C, 47, B9, BE, 32, 1B, 5F, 30, D9, E6, 3B, F6, 68, 8F, CF, 5A, C1, 45, 90, 34, C6, E0, 84, 1E, 21, 0C, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00...
 
[+]

Entropy:
5.8496

Developed / compiled with:
Microsoft Visual Basic v5.0

Code size:
316 KB (323,584 bytes)

Remove PCHCstart.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.