» simple pc optimizer.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)
Network (12)

simple pc optimizer.exe

Simple PC Optimizer

Vapc Lux Sarl

The application simple pc optimizer.exe by Vapc Lux Sarl has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a scheduled task under the Windows Task Scheduler triggered to execute each time a user logs in. This file is typically installed with the program Simple PC Optimizer by SimpleStar. While running, it connects to the Internet address 113-125-232-198.static.unitasglobal.net on port 80 using the HTTP protocol.

File name:

Publisher:

SimpleStar (signed by Vapc Lux Sarl)

Product:

Simple PC Optimizer

Version:

2,14,0,20

MD5:

a1c487f85df78bdfadb2ad2f1ce1aa29

SHA-1:

68d13a40f129a2f9c57885f316fd1ba1cd28d494

SHA-256:

2b3b7d7d70c4e936c751248ad1b6c3053ee5f34889de37ff6e00c43ba9a50223

Scanner detections:

1 / 68

Status:

Potentially unwanted

Analysis date:

12/23/2024 11:02:08 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.SimpleStar (L)

16.12.16.18

File size:

8.3 MB (8,687,576 bytes)

Product version:

2.14.0.20

Original file name:

SimpleStarSPC.exe

File type:

Executable application (Win64 EXE)

Language:

English (United States)

Common path:

C:\Program Files\simple pc optimizer\simple pc optimizer.exe

Digital Signature

Signed by:

Vapc Lux Sarl

Authority:

GlobalSign nv-sa

Valid from:

2/11/2016 4:11:14 PM

Valid to:

2/10/2017 4:57:32 PM

Subject:

E=Ludovic.trogliero@vapc.lu, CN=Vapc Lux Sarl, O=Vapc Lux Sarl, L=Luxembourg, C=LU

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112130BA28CC6DC89090DD3923776478D67D

File PE Metadata

Compilation timestamp:

12/15/2016 4:17:13 PM

OS version:

5.2

OS bitness:

Win64

Subsystem:

Windows GUI

Linker version:

10.0

Entry address:

0x226640

Entry point:

48, 83, EC, 28, E8, 3B, 04, 00, 00, 48, 83, C4, 28, E9, 1E, FD, FF, FF, FF, 25, 70, 68, 05, 00, FF, 25, 5A, 68, 05, 00, FF, 25, 4C, 68, 05, 00, 48, 8B, C4, 48, 89, 58, 08, 48, 89, 68, 10, 48, 89, 70, 18, 48, 89, 78, 20, 41, 54, 48, 83, EC, 20, 4D, 8B, 51, 38, 48, 8B, F2, 4D, 8B, E0, 41, 8B, 02, 48, 8B, E9, 49, 8B, D1, 48, 03, C0, 48, 8B, CE, 49, 8B, F9, 49, 8D, 5C, C2, 04, 4C, 8B, C3, E8, E2, F8, FF, FF, 44, 8B, 1B, 44, 8B, 55, 04, 41, 8B, C3, 41, 83, E3, 02, BA, 01, 00, 00, 00, 23, C2, 41, 80, E2, 66, 44... 
[+]

Code size:

2.5 MB (2,599,424 bytes)

Scheduled Task

Task name:

Start Simple PC Optimizer for LAPTOP-6ECRSMBR@joopv(logon)

Trigger:

Logon (Runs on logon)

The file simple pc optimizer.exe has been discovered within the following program.

Simple PC Optimizer by SimpleStar

www.simplestar.com/support/simple-pc-optimizer

About 8% of users remove it

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to ec2-52-20-215-251.compute-1.amazonaws.com (52.20.215.251:80)

TCP (HTTP):

Connects to ec2-34-194-231-165.compute-1.amazonaws.com (34.194.231.165:80)

TCP (HTTP):

Connects to ec2-52-206-15-116.compute-1.amazonaws.com (52.206.15.116:80)

TCP (HTTP):

Connects to ec2-107-23-113-215.compute-1.amazonaws.com (107.23.113.215:80)

TCP (HTTP):

Connects to ec2-54-174-121-249.compute-1.amazonaws.com (54.174.121.249:80)

TCP (HTTP SSL):

Connects to a92-122-180-180.deploy.akamaitechnologies.com (92.122.180.180:443)

TCP (HTTP):

Connects to ec2-52-73-235-184.compute-1.amazonaws.com (52.73.235.184:80)

TCP (HTTP):

Connects to ec2-54-85-189-79.compute-1.amazonaws.com (54.85.189.79:80)

TCP (HTTP):

Connects to ec2-52-202-118-91.compute-1.amazonaws.com (52.202.118.91:80)

TCP (HTTP):

Connects to a23-46-123-27.deploy.static.akamaitechnologies.com (23.46.123.27:80)

TCP (HTTP):

Connects to a23-44-155-27.deploy.static.akamaitechnologies.com (23.44.155.27:80)

TCP (HTTP):

Connects to 113-125-232-198.static.unitasglobal.net (198.232.125.113:80)

Remove simple pc optimizer.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.