File scan report
Verdict Malicious
Is 3utools-
Five major antivirus engines identify OfferCore adware; signer-matched prior sample rated malicious; rare-new file with no exonerating behaviour.
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
If you already installed it, uninstall it and anything that came with it.
What to do now4 steps
This is unwanted software (adware or a bundled program), not an infection. Remove it and undo any changes it made.
If you haven't installed it
Don't install this file. Delete it, then empty the Recycle Bin.
If you already installed it
Uninstall it and any program you don't recognise that arrived at the same time (Settings > Apps on Windows).
Remove browser extensions you didn't add, and reset your browser's home page, new-tab page and search engine if they changed.
Run a scan with your antivirus to catch anything bundled with it.
If you opened or installed it
Unwanted software is not a full infection, but it should go. These free MalwareTips guides show how to remove it.
- Remove adware and unwanted programsStop unwanted ads on Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
12 of 70 flagged
- Flagged 12
- No detection 58
- No result 5
- Code signing SOFTONIC INTERNATIONAL SA
- Test run Not run
- First seen 4mo ago
Chapter 02
Why we think so
6 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Five major antivirus engines (Microsoft, ESET, DrWeb, Kaspersky, Symantec) flag this sample as adware or unwanted program, with multiple naming the OfferCore family. Our historical records show a prior file signed by the same publisher (SOFTONIC INTERNATIONAL SA) was rated malicious for OfferCore. The filename (3utools) does not match the signer's known products, and no sandbox or external intelligence corroborates benign behaviour.
The sample exhibits strong malicious signals across multiple detection vectors. Five major antivirus engines converge on adware/PUA classification, with Microsoft and ESET explicitly naming OfferCore, a known potentially unwanted application family. The signer-matched RAG entry (b5cea4d097ed…) was previously rated malicious for the same OfferCore family under the same publisher, establishing a pattern. The filename '3utools-9.06.006-installer.exe' does not correspond to Softonic's legitimate product line, suggesting repackaging or brand spoofing. The file is brand-new (0 days old, 1 submission) with no signer reputation history in our database, and no sandbox execution data or external intelligence provides exonerating evidence. While one major antivirus engine (Kaspersky) applied a testFile label, the other four major detections lack this marker, indicating genuine adware rather than test-file confusion.
What We Detected
Five major antivirus engines flagged this executable as adware or potentially unwanted application, with multiple engines naming the OfferCore family. Microsoft Defender identified it as 'PUADlManager:Win32/OfferCore', and ESET flagged 'Win32/OfferCore.E potentially unwanted application'. DrWeb, Kaspersky, and Symantec also reported malicious detections.
Threat Behavior
OfferCore is a known adware family that typically bundles unwanted offers, toolbars, or download managers into legitimate-looking installers. The filename '3utools-9.06.006-installer.exe' suggests it impersonates a popular iOS management tool, but the file is signed by 'SOFTONIC INTERNATIONAL SA', a publisher not known for 3utools distribution. Our historical records show a prior sample signed by the same publisher was rated malicious for OfferCore, establishing a pattern of this signer distributing adware-laden installers.
What To Do Now
Do not execute this file. If already downloaded, delete it immediately. If the file was executed, run a full system scan with your antivirus software and monitor for unwanted browser toolbars, search-engine hijacking, or unexpected software installations. Consider resetting your browser settings to remove any injected extensions or homepage changes.
Where this verdict could be wrong3 caveats
- Kaspersky flagged the sample with testFile=true label, suggesting it may be a rule-based false positive or test artifact. However, only 1 of 5 major antivirus engines applied this label; the other 4 major antivirus engines (DrWeb, ESET, Microsoft, Symantec) flagged without test-file markers, indicating genuine adware detection rather than test-file confusion.
- similarHashes[1] (import-table fingerprint match) was rated 'safe' (av on av fp pattern) with only 2/70 engines malicious, suggesting the import-table fingerprint alone may be prone to false positives. However, the signer-matched RAG entry (b5cea4d097ed…) is a stronger signal — same publisher, same engine count, same family — and it was rated malicious, outweighing the import-table fingerprint-only safe verdict.
- The signer's lack of a saved history means we have no historical data on 'SOFTONIC INTERNATIONAL SA' in our database. This could indicate a newly-registered or rarely-seen publisher. However, the signer-matched RAG entry proves this signer has published at least one prior malicious sample (OfferCore), establishing a pattern rather than exonerating the publisher.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- File is digitally signed (verified by Authenticode)
- No dropped malicious files it created detected
- No contact with known malicious hosts
- Five major antivirus engines flag as adware/PUA
- OfferCore family identified by multiple engines (Microsoft, ESET)
- Signer-matched prior sample rated malicious for same family
- Filename (3utools) does not match signer's known products — brand mismatch
- Rare-new file (0 days old, 1 submission) with no signer reputation history
- No sandbox execution data or external intelligence to corroborate benign behaviour
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
No completed test run is saved for this file.
Threat context
How bundlers and adware work
This is a bundler: a real-looking installer that hides extra software inside. When you run it, it installs things you never asked for, such as ad injectors, browser toolbars or fake 'PC cleaner' apps. The people behind it get paid for every app it installs.
Bottom line:It is not usually built to destroy files, but it slows the PC, floods it with ads and can be hard to remove completely.
Chapter 04
Technical details
12 of the 70 antivirus engines that checked it flag it; signed by SOFTONIC INTERNATIONAL SA.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 12
- DrWeb (major engine)Adware.Downware.20879
- ESET-NOD32 (major engine)Win32/OfferCore.E potentially unwanted application
- Kaspersky (major engine)not-a-virus:HEUR:Downloader.Win32.Softonic.gen
- Microsoft (major engine)PUADlManager:Win32/OfferCore
- Symantec (major engine)ML.Attribute.HighConfidence
- AhnLab-V3PUP/Win.Generic.R752265
- CrowdStrikewin/grayware_confidence_60% (D)
- Elasticmalicious (high confidence)
File fingerprint
- Last analyzed
- Jun 9, 2026, 2:22 AM UTC
- SHA-256
72d1a1020553defb17e87b311fab15c96076959bcce805669306cc67102787f3- SHA-1
9122d6139cad20ae576f1aadde929d25b86ad2f7- MD5
4898819536428897b9ef6612c7bde7af
About this file
3utools-9.06.006-installer.exe is a Win32 EXE file of 2.1 MB.
- Type and size
- Win32 EXE · 2.1 MB
- Signer
- SOFTONIC INTERNATIONAL SAValid code signature.
- First seen
- Jun 9, 2026On VirusTotal.
- Submitted by
- 1 sourceRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 8.00 of 8
First scanned
Antivirus consensus
12 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 12 detections come from 11 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-117 engines5flagged
- Tier-236 engines4flagged5 vendors sharing 4 engines
- Low-trust17 engines2flagged
View all 75 engine results
- AhnLab-V3Malicious: PUP/Win.Generic.R752265
- CrowdStrikeMalicious: win/grayware_confidence_60% (D)
- DrWebMalicious: Adware.Downware.20879
- ElasticMalicious: malicious (high confidence)
- ESET-NOD32Malicious: Win32/OfferCore.E potentially unwanted application
- K7AntiVirusMalicious: Unwanted-Program ( 005ce0ab1 )
- K7GWMalicious: Unwanted-Program ( 005ce0ab1 )
- KasperskyMalicious: not-a-virus:HEUR:Downloader.Win32.Softonic.gen
- MalwarebytesMalicious: PUP.Optional.Softonic
- MicrosoftMalicious: PUADlManager:Win32/OfferCore
- SymantecMalicious: ML.Attribute.HighConfidence
- WebrootMalicious: Win.Adware.Com
- AcronisClean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- EmsisoftClean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- KingsoftClean
- LionicClean
- MaxSecureClean
- McAfeeDClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 9 questions people ask most about this file.
Is 3utools-9.06.006-installer.exe malware?
What is 3utools-9.06.006-installer.exe?
How many antivirus engines detected 3utools-9.06.006-installer.exe?
I already downloaded and installed 3utools-9.06.006-installer.exe — what should I do?
How do I remove 3utools-9.06.006-installer.exe?
What kind of program is 3utools-9.06.006-installer.exe?
Is 3utools-9.06.006-installer.exe digitally signed?
What is the SHA-256 hash of 3utools-9.06.006-installer.exe?
How up to date is this analysis of 3utools-9.06.006-installer.exe?
Community
Member reviews and reports for this exact file hash.
