home

ProPCCleanerSetup.exe

Rainmaker Software Group, LLC

The application ProPCCleanerSetup.exe, “This installer database contains the logic and data required to install Pro PC Cleaner.” by Rainmaker Software Group has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a setup and installation application and has been known to bundle potentially unwanted software. The file has been seen being downloaded from safe-downloads.org and multiple other hosts.
Publisher:
Pro PC Cleaner  (signed by Rainmaker Software Group, LLC)

Product:
Pro PC Cleaner

Description:
This installer database contains the logic and data required to install Pro PC Cleaner.

Version:
2.9.5

MD5:
b861a4fc9ec392cd99634f185fa6cad8

SHA-1:
22c4943f79827dcb9cf56959870088f6c8e479e0

SHA-256:
f5c1b3d1a7de58349b3d0274c1f1af8eace55240422628f4971fe64c2c715b57

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
12/25/2024 12:34:39 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Rainmaker.ProPCCle.Installer.Meta (L)
16.6.13.20

File size:
6.3 MB (6,645,072 bytes)

Product version:
2.9.5

Copyright:
Copyright (C) 2015 Pro PC Cleaner

Original file name:
ProPCCleanerSetup.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\propccleanersetup.exe

Digital Signature
Signed by:
Rainmaker Software Group, LLC

Authority:
Symantec Corporation

Valid from:
6/2/2015 8:00:00 PM

Valid to:
6/2/2016 7:59:59 PM

Subject:
CN="Rainmaker Software Group, LLC", O="Rainmaker Software Group, LLC", L=Wilmington, S=Delaware, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
39DD9E72DB3846967CA998B9714BE976

File PE Metadata
Compilation timestamp:
10/7/2014 11:05:58 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:QG7cl1155MF19Lz5BbJapO/nUZr9YXFbyFsG/ZZyf0gNLhLgVO9uvi639lPwnFY5:RuQj5AO/cRQbVG/ZZw+kT63zPqY8bsyE

Entry address:
0xC87EC

Entry point:
E8, 4A, CC, 00, 00, E9, 79, FE, FF, FF, 8B, FF, 55, 8B, EC, 51, 53, 56, 8B, F0, 33, DB, 3B, F3, 75, 1E, E8, 5D, 4D, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, C5, D5, FF, FF, 83, C4, 14, 8B, C6, E9, C2, 00, 00, 00, 57, 39, 5D, 0C, 77, 1E, E8, 39, 4D, 00, 00, 6A, 16, 5E, 53, 53, 53, 53, 53, 89, 30, E8, A1, D5, FF, FF, 83, C4, 14, 8B, C6, E9, 9D, 00, 00, 00, 33, C0, 39, 5D, 14, 66, 89, 06, 0F, 95, C0, 40, 39, 45, 0C, 77, 09, E8, 0A, 4D, 00, 00, 6A, 22, EB, CF, 8B, 45, 10, 83, C0, FE, 83, F8, 22, 77...
 
[+]

Entropy:
7.7874  (probably packed)

Code size:
1021.5 KB (1,046,016 bytes)

The file ProPCCleanerSetup.exe has been seen being distributed by the following 12 URLs.

http://safe-downloads.org/windows-g0gle?clk=AMSIH9ug0ggADToAmrDZ6YQxmes6QKzcza602VuFUd5VAAAAAAA

http://safe-downloads.org/windows-g0gle?clk=ANApMVaj0ggADToAkZ-LcGs6ehjQSZ7GQjK2tAidVw0xAQAAAAA

http://safe-downloads.org/windows-g0gle?clk=ADCkMHyj0ggADToAkZ-LcGs6ehjQSZ7GQjK2tAidejtvAQAAAAA

http://safe-downloads.org/windows-g0gle?clk=ALjUeqih0ggADToAmrCvJ22GZSnZTaoRN4uCyb0gZF0lAAAAAAA

http://safe-downloads.org/windows-g0gle?clk=AG7_uG6e0ggADToA2W2ZO82Gjl-bSqfgIZ7tFAV5wauLAwAAAAA

http://safe-downloads.org/windows-g0gle?clk=AEDb1lKj0ggADToAmrD3L8VY_ey3R42Vrb4APW7ILNMpAQAAAAA

http://safe-downloads.org/windows-g0gle?clk=AIyDIW-i0ggADToAk_jFg5xY4xQVRZhYRUHO8cOTmZ8IAQAAAAA

http://secure-file.info/.../ProPCCleanerSetup.exe

http://safe-downloads.org/windows-g0gle?clk=ACauHeuh0ggADToAkZ8WdLAHBazXS4CSIo_UVO-GysU5AAAAAAA

http://safe-downloads.org/windows-g0gle?clk=ABrLEF-i0ggADToAkZ8WdLAHBazXS4CSIo_UVO-GNaPKAAAAAAA

http://safe-downloads.org/windows-g0gle?clk=ANJ2X42j0ggADToAm1yNXR-C8ApxQLcC0nuNhH5oXFyFAQAAAAA

http://safe-downloads.org/windows-g0gle?clk=ANYM9Oig0ggADToAk_gwT58n49-PT7qwCQyPhjZm8u5uAAAAAAA

Remove ProPCCleanerSetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.