home

hpui.exe

Zhang Ling

The application hpui.exe by Zhang Ling has been detected as adware by 5 anti-malware scanners. This particular feature is designed to hijack the browser in an attempt to prevent other resources from modify the browser's search and home pages.
Publisher:
Zhang Ling  (signed and verified)

MD5:
0e4d70657a8757a8cc314ed40d4852eb

SHA-1:
6d8ba95d943867ccf6ad69c49f1cf5d2f108912c

SHA-256:
0f24fbc2e5996e387ecaf65218098742e3e6c391fdc5d52d7a1a7556d006516b

Scanner detections:
5 / 68

Status:
Adware

Analysis date:
12/25/2024 12:12:16 AM UTC  (today)

Scan engine
Detection
Engine version

AVG
Zhangling
2015.0.3381

Baidu Antivirus
Adware.Win32.Thinknice
4.0.3.14815

ESET NOD32
Win32/Thinknice.E potentially unwanted application
7.0.302.0

IKARUS anti.virus
PUA.SearchProtect
t3scan.1.7.5.0

Reason Heuristics
PUP.ZhangLing.E
14.8.15.18

File size:
714.4 KB (731,528 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\suptab\hpui.exe

Digital Signature
Signed by:
Zhang Ling

Authority:
WoSign CA Limited

Valid from:
6/6/2014 5:29:18 AM

Valid to:
6/6/2015 5:29:18 AM

Subject:
CN=Zhang Ling, E=chloezhangling@gmail.com, L=北京市, S=北京市, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
07DAC38DB37E09DF8C8634065592DFE3

File PE Metadata
Compilation timestamp:
8/14/2014 9:31:47 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

CTPH (ssdeep):
12288:55bW9NlcKcExaiYjLCFk0X9Mjv+2C+vpXK+PEJx:55UlcK3xa1C7X9yv+2Ta+Pwx

Entry address:
0x4724C

Entry point:
E8, 34, 5C, 00, 00, E9, 7F, FE, FF, FF, 53, 8B, DC, 51, 51, 83, E4, F0, 83, C4, 04, 55, 8B, 6B, 04, 89, 6C, 24, 04, 8B, EC, 8B, 4B, 08, 66, 8B, 53, 0C, 83, EC, 20, 83, 3D, 38, EF, 46, 00, 01, 7C, 48, 0F, B7, C2, 66, 0F, 6E, C0, F2, 0F, 70, C0, 00, 66, 0F, 70, D0, 00, 8B, C1, 25, FF, 0F, 00, 00, 3D, F0, 0F, 00, 00, 77, 3E, F3, 0F, 6F, 01, 66, 0F, EF, C9, 66, 0F, 75, C8, 66, 0F, 75, C2, 66, 0F, EB, C8, 66, 0F, D7, C1, 85, C0, 75, 34, 83, C1, 10, EB, D1, 66, 3B, C2, 74, 0B, 83, C1, 02, 0F, B7, 01, 66, 85, C0...
 
[+]

Code size:
347.5 KB (355,840 bytes)

Remove hpui.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.