» uninstall.exe
Overview
Analysis
File Details
Behaviors (1)
Network (1)

uninstall.exe

ExpressFiles Application

Faglaro Enterprises Limited

The application uninstall.exe by Faglaro Enterprises Limited has been detected as adware by 32 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. This is the uninstaller utility registered in the Windows Control Panel for the program ExpressFiles by http://www.express-files.com/. This will display context specific advertisements in the browser as well as attempt to modify the browser's search provider. While running, it connects to the Internet address 199.195.196.180.static.midphase.com on port 80 using the HTTP protocol.

File name:

uninstall.exe

Publisher:

http://www.express-files.com/ (signed by Faglaro Enterprises Limited)

Product:

ExpressFiles Application

Version:

1, 0, 0, 496

MD5:

00002d19b6b0262a02978cff838cc642

SHA-1:

dc50b491c9bb9f00b23768db91de77b57f2cd5d8

SHA-256:

1ec61a9ec7909194e848f850823ae4586612425b97f71ac9c8f4c9ae9af2a611

Scanner detections:

32 / 68

Status:

Adware

Explanation:

The installer may include an offer for the Babylon Toolbar (a homepage/search hijacker), which is potentially installed with minimal user consent.

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/27/2024 7:34:57 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Gen:Variant.Kazy.426646

393

AhnLab V3 Security

PUP/Win32.ExpressFiles

2013.11.02

Avira AntiVirus

ADWARE/Adware.Gen2

7.11.110.152

avast!

Win32:Downloader-TSH [PUP]

2014.9-160107

AVG

Faglaro Enterprises Limited

2017.0.2871

Bitdefender

Gen:Variant.Kazy.426646

1.0.20.35

Bkav FE

W32.Clod935.Trojan

1.3.0.4613

Clam AntiVirus

Win.Adware.Agent-8641

0.98/19423

Comodo Security

ApplicUnwnt

18025

Dr.Web

Adware.Downware.1440

9.0.1.07

Emsisoft Anti-Malware

Riskware.Win32.ExpressFiles.AMN

8.16.01.07.07

ESET NOD32

Win32/ExpressFiles (variant)

10.9854

Fortinet FortiGate

Riskware/Agent

1/7/2016

F-Prot

W32/ExpressFiles.A.gen

v6.4.7.1.166

F-Secure

Gen:Variant.Kazy.426646

11.2016-07-01_5

G Data

Win32.Application.ExpressFiles

16.1.24

IKARUS anti.virus

not-a-virus:Downloader.Win32.Agent

t3scan.2.2.29

K7 AntiVirus

Unwanted-Program

13.175.10814

Kaspersky

not-a-virus:Downloader.Win32.Agent

14.0.0.851

Malwarebytes

PUP.Optional.ExpressFiles.A

v2016.01.07.07

McAfee

Artemis!93AB60794E97

5600.6527

MicroWorld eScan

Gen:Variant.Kazy.426646

17.0.0.21

NANO AntiVirus

Riskware.Win32.Babylon.craswq

0.28.0.57029

Qihoo 360 Security

Win32/Virus.Adware.693

1.0.0.1015

Reason Heuristics

PUP.Blisbury.FaglaroEnterprises.Bundler (M)

16.1.7.19

Rising Antivirus

PE:PUF.ExpressFiles!1.9E64

23.00.65.16105

Sophos

Express Files

4.98

Trend Micro House Call

TROJ_GEN.F47V1101

7.2.7

Trend Micro

TROJ_SPNV.03KB13

10.465.07

Vba32 AntiVirus

Downloader.Agent

3.12.24.3

VIPRE Antivirus

ExpressFiles Installer

29654

XVirus List

Win32.Detected

2.8.7

File size:

6.5 MB (6,768,224 bytes)

Product version:

2,0,0,0

Original file name:

ExpressFiles.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SimpleFiles

Common path:

C:\Program Files\expressfiles\uninstall.exe

Digital Signature

Signed by:

Faglaro Enterprises Limited

Authority:

COMODO CA Limited

Valid from:

12/13/2012 1:00:00 AM

Valid to:

12/14/2015 12:59:59 AM

Subject:

CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

37B080A790663B8AF63D05448AD0343B

File PE Metadata

Compilation timestamp:

11/8/2013 3:31:56 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

98304:MlV8mMNm/MB+x7CRj8fpqc2C8m+zqjXEfHqQUReYNa1nPcmCZPVYS06A1eUgag:Y8mcmUM680c2xHyUfTU3Na1nP/CZ+Jfg

Entry address:

0x11B72

Entry point:

E8, AE, 6B, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, A4, 07, 43, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 47, 08, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, F0, 1C, 41, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF... 
[+]

Code size:

125.5 KB (128,512 bytes)

Program Uninstaller

Program name:

ExpressFiles

Display publisher:

http://www.express-files.com/

Display version:

1.9.7

Uninstall string:

"C:\Program Files (x86)\ExpressFiles\uninstall.exe"

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to 199.195.196.180.static.midphase.com (199.195.196.180:80)

Remove uninstall.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.