home

turbocleanpc@fbidau=56c38a19a66924.93533545.exe

Turbo Clean PC

SAND DOLLAR MEDIA LLC

The file turbocleanpc@fbidau=56c38a19a66924.93533545.exe by SAND DOLLAR MEDIA has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from anynewsupdate.com and multiple other hosts.
Publisher:
SAND DOLLAR MEDIA LLC  (signed and verified)

Product:
Turbo Clean PC

Version:
4.1

MD5:
78112bfca4a3b4a3e516bbc3f5145095

SHA-1:
ed3da546639fab26500240eac523a56e2258d6a3

SHA-256:
9741e663a221152e307433426c7a94f22f3c3aa83e8527533a6f71a21e13f0cf

Scanner detections:
1 / 68

Status:
Potentially unwanted

Analysis date:
11/23/2024 11:00:31 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Rainmaker.SANDDOLL.Installer.Meta (L)
16.6.13.20

File size:
1.6 MB (1,626,560 bytes)

Product version:
4.1

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\turbocleanpc@fbidau=56c38a19a66924.93533545.exe.part

Digital Signature
Signed by:
SAND DOLLAR MEDIA LLC

Authority:
Symantec Corporation

Valid from:
2/15/2016 10:00:00 AM

Valid to:
2/15/2017 9:59:59 AM

Subject:
CN=SAND DOLLAR MEDIA LLC, O=SAND DOLLAR MEDIA LLC, L=Deerfield Beach, S=Florida, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
6DAADE0DD074BCD2D9E0E26D9D97CCBA

File PE Metadata
Compilation timestamp:
6/20/1992 8:22:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
49152:Lan5yT4rExkRjuVQ6GCCydx/DhYw12kZj6LinXBgK:Gn5yTm5RCO6tY02kZj6GRgK

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, E8, CD, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, E8, CD...
 
[+]

Entropy:
7.9915

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file turbocleanpc@fbidau=56c38a19a66924.93533545.exe has been seen being distributed by the following 40 URLs.

https://anynewsupdate.com/tech99-dl?56c8ae2c49d873.08289587&rwp_fbid99=56c8ae2c49d873.08289587&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d38b32314613.28985231&rwp_fbid99=56d38b32314613.28985231&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d70d60e381a1.00893413&rwp_fbid99=56d70d60e381a1.00893413&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d4b387f28dc3.03379069&rwp_fbid99=56d4b387f28dc3.03379069&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56c683f397b6f4.56877654&rwp_fbid99=56c683f397b6f4.56877654&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d1bc47af7491.41238851&rwp_fbid99=56d1bc47af7491.41238851&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56ca64a2176344.99068260&rwp_fbid99=56ca64a2176344.99068260&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56c68bec19e172.94242446&rwp_fbid99=56c68bec19e172.94242446&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56ca7e8425f2c9.64399833&rwp_fbid99=56ca7e8425f2c9.64399833&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56c9e3163f8c37.31929833&rwp_fbid99=56c9e3163f8c37.31929833&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56ca11ffc68969.82832553&rwp_fbid99=56ca11ffc68969.82832553&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d6fa7ca66043.70966989&rwp_fbid99=56d6fa7ca66043.70966989&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d4966fe65a19.40477385&rwp_fbid99=56d4966fe65a19.40477385&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56c7613bb57425.76796123&rwp_fbid99=56c7613bb57425.76796123&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d20eae651227.20193703&rwp_fbid99=56d20eae651227.20193703&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d36abf0223e7.39356135&rwp_fbid99=56d36abf0223e7.39356135&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d06867823173.98821289&rwp_fbid99=56d06867823173.98821289&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d743b1267582.78989438&rwp_fbid99=56d743b1267582.78989438&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56ce56d51bf5c5.58883060&rwp_fbid99=56ce56d51bf5c5.58883060&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56c7e95b2f60f4.26116192&rwp_fbid99=56c7e95b2f60f4.26116192&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56cf985e19e774.14529580&rwp_fbid99=56cf985e19e774.14529580&rwp_al=cmp99&rwp_lpid=lp-tech99

https://any-news-update.com/tech99-dl?56dcdcd8f31dd4.58500524&rwp_fbid99=56dcdcd8f31dd4.58500524&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://anynewsupdate.com/tech99-dl?56c9110ee04e91.24447522&rwp_fbid99=56c9110ee04e91.24447522&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56c65eab5d5833.16325120&rwp_fbid99=56c65eab5d5833.16325120&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d0f875dc52b1.75385858&rwp_fbid99=56d0f875dc52b1.75385858&rwp_al=cmp99&rwp_lpid=lp-tech99

https://any-news-update.com/tech99-dl?56dc73aadc9a69.55667641&rwp_fbid99=56dc73aadc9a69.55667641&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://anynewsupdate.com/tech99-dl?56c8742e71cba1.81336448&rwp_fbid99=56c8742e71cba1.81336448&rwp_al=cmp99&rwp_lpid=lp-tech99

https://anynewsupdate.com/tech99-dl?56d4432191d145.43287122&rwp_fbid99=56d4432191d145.43287122&rwp_al=cmp99&rwp_lpid=lp-tech99

https://any-news-update.com/tech99-dl?56df018725f344.40018827&rwp_fbid99=56df018725f344.40018827&rwp_al=cmp99&rwp_lpid=a-n-u-lp-usa-3

https://anynewsupdate.com/tech99-dl?56cca94cb1ccc3.93930235&rwp_fbid99=56cca94cb1ccc3.93930235&rwp_al=cmp99&rwp_lpid=lp-tech99

Latest 30 of 40 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.