home

turbocleanpc@fbid99=56df1e6597dd44.12305779.exe

Turbo Clean PC

SAND DOLLAR MEDIA LLC

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from anynewsupdate.com and multiple other hosts.
Publisher:
SAND DOLLAR MEDIA LLC  (signed and verified)

Product:
Turbo Clean PC

Version:
4.1

MD5:
486fe0bfef2f2165f0f3a7e3b56923f6

SHA-1:
5f97d5824b2d30f5627fd8d5ee539c2219df9cc5

SHA-256:
c2bdc1bf1e7ca16680841b318b6b7beaa455989330c8743cfaff68bbb1945784

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/23/2024 10:24:01 PM UTC  (today)

File size:
1.8 MB (1,921,848 bytes)

Product version:
4.1

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\microsoft\windows\inetcache\ie\{random}\turbocleanpc@fbid99=56df1e6597dd44.12305779.exe.2v3fqit.partial

Digital Signature
Signed by:
SAND DOLLAR MEDIA LLC

Authority:
Symantec Corporation

Valid from:
2/14/2016 6:00:00 PM

Valid to:
2/14/2017 5:59:59 PM

Subject:
CN=SAND DOLLAR MEDIA LLC, O=SAND DOLLAR MEDIA LLC, L=Deerfield Beach, S=Florida, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6DAADE0DD074BCD2D9E0E26D9D97CCBA

File PE Metadata
Compilation timestamp:
6/19/1992 5:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:cahglavV2+QtZHgSlLVHKef86lJZh3i9VMNDOKF/1l9F3gbinXBgT:RS/7xRPkEN3i9GNDhTFpRgT

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Entropy:
7.9936

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file turbocleanpc@fbid99=56df1e6597dd44.12305779.exe has been seen being distributed by the following 32 URLs.

https://anynewsupdate.com/tech103-dl?56e5eaf87296f3.87387815&rwp_fbid103=56e5eaf87296f3.87387815&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1

https://anynewsupdate.com/tech104-dl?56e73d60b6bf35.60384134&rwp_fbid104=56e73d60b6bf35.60384134&rwp_al=cmp104&rwp_lpid=a-n-u-lp-w-2

https://any-news-update.com/tech99-dl?56e57f3349a2b3.21677788&rwp_fbid99=56e57f3349a2b3.21677788&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://anynewsupdate.com/tech104-dl?56ea59270c2241.63340303&rwp_fbid104=56ea59270c2241.63340303&rwp_al=cmp104&rwp_lpid=a-n-u-lp-w-2

https://any-news-update.com/tech103-dl?56f185b697b164.47953424&rwp_fbid103=56f185b697b164.47953424&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1-2

https://anynewsupdate.com/tech103-dl?56e3a24e13d4d9.80530701&rwp_fbid103=56e3a24e13d4d9.80530701&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1

https://anynewsupdate.com/tech103-dl?56e4385ac15577.51861245&rwp_fbid103=56e4385ac15577.51861245&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1

https://any-news-update.com/tech99-dl?56e62aed928c88.67866378&rwp_fbid99=56e62aed928c88.67866378&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

http://email.turbocleanpc.com/.../eJxdjUEOwiAQRU9TdpIZoFAWLNqk3mM6RWuChWBN4-3Frclfvby8z-Fu0suKNXiyTOIRFKAFrSy63oOR2iIa6ZV3Wk5mnuZRu87A8a5L5hRpLyw5P8UWIkUmXtjwwO5GhJZg8MQKIw-tIlLYjqN0euzUte0_0VA9L2s-95RpFTXUSCXWHhUAtMsPbTn_xC9SZTbL

https://anynewsupdate.com/tech104-dl?56e6ce80d9b9c8.81629971&rwp_fbid104=56e6ce80d9b9c8.81629971&rwp_al=cmp104&rwp_lpid=a-n-u-lp-w-2

https://any-news-update.com/tech-news-au-dl?56efda8f936ca5.05309657&rwp_fbid=56efda8f936ca5.05309657&rwp_al=cmp93&rwp_lpid=a-n-u-lp-au-2

http://safe-secure5.com/.../TurboCleanPC.exe

https://anynewsupdate.com/tech104-dl?56e458f9dc1899.40277434&rwp_fbid104=56e458f9dc1899.40277434&rwp_al=cmp104&rwp_lpid=a-n-u-lp-w-2

https://anynewsupdate.com/tech104-dl?56e34433e7a0d2.57447857&rwp_fbid104=56e34433e7a0d2.57447857&rwp_al=cmp104&rwp_lpid=a-n-u-lp-w-2

https://any-news-update.com/tech99-dl?56e4af79e03371.81830759&rwp_fbid99=56e4af79e03371.81830759&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://any-news-update.com/tech99-dl?56e777ccf27eb7.90866090&rwp_fbid99=56e777ccf27eb7.90866090&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://any-news-update.com/tech-news-ca-dl?56e5a5f30372b4.97969949&rwp_fbid=56e5a5f30372b4.97969949&rwp_al=cmp94&rwp_lpid=a-n-u-lp-ca-1

https://any-news-update.com/tech99-dl?56e4e5c080fa76.00286403&rwp_fbid99=56e4e5c080fa76.00286403&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://any-news-update.com/tech103-dl?56edfa28c8f194.03857603&rwp_fbid103=56edfa28c8f194.03857603&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1-2

https://anynewsupdate.com/tech103-dl?56e8686c7f41f2.77057091&rwp_fbid103=56e8686c7f41f2.77057091&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1

https://anynewsupdate.com/tech104-dl?56e787d9b515e1.09745864&rwp_fbid104=56e787d9b515e1.09745864&rwp_al=cmp104&rwp_lpid=a-n-u-lp-w-2

https://any-news-update.com/tech103-dl?56ebf949a74321.02144750&rwp_fbid103=56ebf949a74321.02144750&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1-2

http://s3.amazonaws.com/origin.safe-secure5.com/.../TurboCleanPC.exe

https://anynewsupdate.com/tech103-dl?56e0706e169d53.17647278&rwp_fbid103=56e0706e169d53.17647278&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1

http://www.turbocleanpc.com/rw-download

http://turbocleanpc.com/download

https://any-news-update.com/tech103-dl?56eb8f8b91cec2.98005142&rwp_fbid103=56eb8f8b91cec2.98005142&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1-2

https://any-news-update.com/tech103-dl?56edd8ce6832f6.05652421&rwp_fbid103=56edd8ce6832f6.05652421&rwp_al=cmp103&rwp_lpid=a-n-u-lp-w-1-2

https://s3.amazonaws.com/origin.safe-secure5.com/.../TurboCleanPC.exe

https://any-news-update.com/tech99-dl?56e353bebcf984.27814942&rwp_fbid99=56e353bebcf984.27814942&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

Latest 30 of 32 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.