home

propccleaner.exe

Rainmaker Software Group, LLC

The application propccleaner.exe, “This installer database contains the logic and data required to install Pro PC Cleaner.” by Rainmaker Software Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from safe-downloads.org and multiple other hosts.
Publisher:
Pro PC Cleaner  (signed by Rainmaker Software Group, LLC)

Product:
Pro PC Cleaner

Description:
This installer database contains the logic and data required to install Pro PC Cleaner.

Version:
2.5.5.43

MD5:
6bf8dae26fe84d7a38c14fd00159125b

SHA-1:
54902363e4565292c11fec00794681cbcc1ea7a5

SHA-256:
6a036baa2ee55a517d81f8fa3ed80162f329c9b838894f540c83233ebce19408

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/5/2024 12:45:17 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Rainmaker.ProPCCle.Installer.Meta (L)
16.6.13.20

File size:
6.3 MB (6,569,848 bytes)

Product version:
2.5.5.43

Copyright:
Copyright (C) 2014 Pro PC Cleaner

Original file name:
ProPCCleanerSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\propccleaner.exe

Digital Signature
Signed by:
Rainmaker Software Group, LLC

Authority:
Symantec Corporation

Valid from:
12/9/2013 6:00:00 PM

Valid to:
10/28/2014 6:59:59 PM

Subject:
CN="Rainmaker Software Group, LLC", O="Rainmaker Software Group, LLC", L=Wilmington, S=Delaware, C=US, SERIALNUMBER=5411289, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US

Issuer:
CN=Symantec Class 3 Extended Validation Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
2A74A7701A648821F2396E834CC25D4F

File PE Metadata
Compilation timestamp:
5/21/2014 4:03:40 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:W2BxX/sFFsoWHKetj35edg4W+U7134hJOn9SRi0mczRUMPvX/3Vlm8aO+6v5hqyJ:WWPR5edzW/KhJ29SgrczRtPHVlm6yFC

Entry address:
0xC4C6B

Entry point:
E8, 42, CC, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, 5E, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, C6, D5, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, 3A, 4E, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A2, D5, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 0B, 4E, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Entropy:
7.7892  (probably packed)

Code size:
1004 KB (1,028,096 bytes)

The file propccleaner.exe has been seen being distributed by the following 19 URLs.

http://safe-downloads.org/windows-update?s=570

http://safe-downloads.org/windows-gne?s=(null)&zid=73911&tid=634ade4638a942319f6f92fef9e43043

http://safe-downloads.org/windows-gne?s=[INSERT_YOUR_SUBID_HERE]&zid=123779&tid=e391acdb89b14e9bb411bbac6a2e5b69

http://safe-downloads.org/windows-gne?s=(null)&zid=112356&tid=4f2a1f8d003f4aa9ae82a0103233a87b

http://safe-downloads.org/windows-gne?s=(null)&zid=112360&tid=07ba2f0823cf48808a386500e8cbf1b2

http://safe-downloads.org/windows-gne?s=(null)&zid=73907&tid=3a4351ddc9e840baac756f1d72384f4e

http://safe-downloads.org/windows-gne?s=(null)&zid=73907&tid=49c916e720e84577ab2d2d44da978e42

http://safe-downloads.org/windows-adron

http://safe-downloads.org/windows-gne?s=(null)&zid=73908&tid=13422dc0e51d44ccb13482454451aacc

http://safe-downloads.org/windows-gne?s=(null)&zid=112359&tid=9d018b9acc7e460f873f1951969fdd0c

http://gne.rsg.safecart.com/propc/.../?s=(null)&zid=73910&tid=5a05437ff98340b682e11be42df3387b

http://gne.rsg.revenuewire.net/propc/.../?s=(null)&zid=73910&tid=5a05437ff98340b682e11be42df3387b

http://safe-downloads.org/windows-gne?s=(null)&zid=73910&tid=5a05437ff98340b682e11be42df3387b

http://safe-downloads.org/windows-update-adsup4?s=1179

https://my-safe-downloads.com/.../ProPCCleaner.exe

http://adsup2.rsg.safecart.com/propc/.../

http://adsup2.rsg.revenuewire.net/propc/.../

http://safe-downloads.org/windows-update?s=611

http://safe-downloads.org/windows-update

Remove propccleaner.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.