» regcureprosetup.exe
Overview
Analysis
File Details
Downloads (15)

regcureprosetup.exe

Paretologic Inc.

The application regcureprosetup.exe, “RegCure Pro Installer” by Paretologic has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from adclick.g.doubleclick.net and multiple other hosts.

File name:

regcureprosetup.exe

Publisher:

ParetoLogic, Inc. (signed by Paretologic Inc.)

Description:

RegCure Pro Installer

Version:

3.1.7.0

MD5:

d245a1ed1f21db4892dfe86af501a55c

SHA-1:

e120a7bdab69caaf2e5cc6f290fc75532fd2e933

SHA-256:

6a00843c236e59276b617426533cbd5657133bdb217b1987bf9990de1ef330a8

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

12/27/2024 3:42:52 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.ParetoLogic.Optional.Installer.Meta (L)

16.2.11.23

File size:

5.7 MB (5,938,328 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\regcureprosetup.exe

Digital Signature

Signed by:

Paretologic Inc.

Authority:

GlobalSign nv-sa

Valid from:

2/26/2013 12:53:32 AM

Valid to:

2/27/2015 12:53:32 AM

Subject:

CN=Paretologic Inc., OU=Paretologic Inc., O=Paretologic Inc., L=Victoria, S=British Columbia, C=CA

Issuer:

CN=GlobalSign CodeSigning CA - G2, O=GlobalSign nv-sa, C=BE

Serial number:

1121F9945D68B6DFDD557292B63C5A3015E1

File PE Metadata

Compilation timestamp:

2/24/2012 10:19:59 PM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

98304:ekl7tuuqrLk5x0HviP6p84R9FnTkOjVZyBB0PbwfV3CXPan5hL3O5ge:B7odwj0Piip8ur4OjVlbGVvL37e

Entry address:

0x39E3

Entry point:

81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 91, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, C0, 82, 40, 00, 6A, 08, A3, B8, 2E, 47, 00, E8, 37, 2A, 00, 00, 55, 68, B4, 02, 00, 00, A3, D0, 2D, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 93, 40, 00, FF, 15, 84, 81, 40, 00, 68, 04, 93, 40, 00, 68, C0, AD, 46, 00, E8, 19, 27, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 30, 4C, 00, 57, E8, 07, 27, 00, 00... 
[+]

Entropy:

7.9980

Packer / compiler:

Nullsoft install system v2.x

Code size:

28 KB (28,672 bytes)

The file regcureprosetup.exe has been seen being distributed by the following 15 URLs.

http://adclick.g.doubleclick.net/aclk?sa=L&ai=BTM15LEVQU6HyLKLR0AHMhYCYCon207MCAAAAEAEgg7-CAjgAWOmGnOimAWDJvvKM5KSsE7IBEHd3dy52aXN0YXg2NC5jb226AQlnZnBfaW1hZ2XIAQnaAV9odHRwOi8vd3d3LnZpc3RheDY0LmNvbS9zb2Z0d2FyZS8yNzU4NTAtaG93LXJlc3RvcmUtbWFpbC1pY29uLXN0YXJ0LW1lbnUtb3JpZ2luYWwtc2V0dGluZ3MuaHRtbKkC74FhrkEuvD7AAgLgAgDqAhkvMTAxNTU3OS9WRl9Gb290ZXJfNzIwXzYw-ALy0R6QA6QDmAOMBqgDAdAEkE7gBAGgBhY&num=0&sig=AOD64_0CcMlLNq1pf-0S_5dr-Xt7sc_5PA&client=ca-pub-7156303416008077&adurl=http://vfbottom.paretologic.revenuewire.net/regcure-pro/.../

http://vfbottom.paretologic.revenuewire.net/regcure-pro/.../

http://vfbottom.paretologic.safecart.com/regcure-pro/.../

http://vfbottom.paretologic.revenuewire.net/regcure-pro/.../

http://sfdirect.paretologic.revenuewire.net/regcure-pro/.../

http://sfdirect.paretologic.safecart.com/regcure-pro/.../

http://sflink.paretologic.revenuewire.net/regcure-pro/.../

http://sflink.paretologic.safecart.com/regcure-pro/.../

http://www.paretologic.com/download/regcurepro/.../179.php

http://dlc1.paretologic.com/regcurepro/.../RegCureProSetup.exe

http://sflink.paretologic.revenuewire.net/regcure-pro/.../

Remove regcureprosetup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.