» pclunst.exe
Overview
Analysis
File Details
Behaviors (1)
Downloads (14)

pclunst.exe

PC Cleaner Pro

PC Cleaner Inc.

The application pclunst.exe by PC Cleaner has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup program which is used to install the application. This is the uninstaller utility registered in the Windows Control Panel for the program PC Cleaners by PC Cleaners. The file has been seen being downloaded from RevenueWire's affiliate distribution platform love2008.nwpc.revenuewire.net and multiple other hosts.

File name:

pclunst.exe

Publisher:

Product:

PC Cleaner Pro

Version:

21.0.0.0

MD5:

0dc4c225cff5f47ecd4f1914ee173878

SHA-1:

ca247f70891ee3211b278aeba807c3ca277819a5

SHA-256:

ffa6cbf477c4fa4abe3d061e7fb5bd7e37cf06eb5614b0a63df11d796eb647fe

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

11/5/2024 11:06:05 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.PCCleaner.cPCClean.Meta (L)

16.6.10.14

File size:

4.3 MB (4,466,072 bytes)

Product version:

21.0.0.0

Original file name:

PCInstaller.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\ProgramData\pclunst.exe

Digital Signature

Signed by:

PC Cleaner Inc.

Authority:

Symantec Corporation

Valid from:

8/10/2015 8:00:00 PM

Valid to:

8/10/2016 7:59:59 PM

Subject:

CN=PC Cleaner Inc., O=PC Cleaner Inc., L=Laguna Niguel, S=California, C=US

Issuer:

CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:

3D4B99D267157B4AE7602BBCE79FE9DE

File PE Metadata

Compilation timestamp:

1/27/2016 2:10:25 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

98304:lUTVdgV6km5EMXFt0HT9pHp1Q5ABJsm2U0qopdG4JFv8EqljySkUcDIEEC44nuFT:6a7m5EAuPrsS+t2tluSk5D7EA/JHF/VW

Entry address:

0x907AA0

Entry point:

60, BE, 00, D0, 8C, 00, 8D, BE, 00, 40, B3, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.7955

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

4.2 MB (4,435,968 bytes)

Program Uninstaller

Program name:

PC Cleaners

Display publisher:

PC Cleaners

Uninstall string:

"C:\ProgramData\pclunst.exe" -removeit

The file pclunst.exe has been seen being distributed by the following 14 URLs.

http://love2008.nwpc.revenuewire.net/.../PCPro-English?367

http://love2008.nwpc.revenuewire.net/.../PCPro-English?processlibrary-IN-0-broad18139

http://love2008.nwpc.revenuewire.net/.../PCPro-English?2error240

http://love2008.nwpc.revenuewire.net/.../PCPro-English?697

http://love2008.nwpc.revenuewire.net/PCPRO-Private/.../?new_dll_005

http://love2008.nwpc.revenuewire.net/.../PCPro-English?770

http://love2008.nwpc.revenuewire.net/.../PCPro-English?processlibrary-DH-0-phrase174

http://love2008.nwpc.revenuewire.net/.../PCPro-English?clean133-sitelink01-clean

http://love2008.nwpc.revenuewire.net/.../PCPro-English?error3085

http://love2008.nwpc.revenuewire.net/.../PCPro-English?tasklist-0-broad2404

http://pc-cleaners.com/English-install.exe

http://www.nonabyte.net/.../download

http://love2008.nwpc.revenuewire.net/.../PCPro-English?E2new-6326

http://love2008.nwpc.revenuewire.net/.../PCPro-English?error916

Remove pclunst.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.