» uninstall.exe
Overview
Analysis
File Details
Behaviors (1)

uninstall.exe

Setup Factory Runtime

DOUBLE OPT MEDIA PARTNERS LLC

The application uninstall.exe, “Setup Application” by DOUBLE OPT MEDIA PARTNERS has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Setup Factory installer. This is the uninstaller utility registered in the Windows Control Panel for the program Worldwide Web Research by Double Opt Media.

File name:

uninstall.exe

Publisher:

Indigo Rose Corporation (signed by DOUBLE OPT MEDIA PARTNERS LLC)

Product:

Setup Factory Runtime

Description:

Setup Application

Version:

9.0.4.0

MD5:

13eeb95d91cf0b98d474b22f498dacf3

SHA-1:

eb036d0ff61b9da3a3c5c84b03fb66468508026b

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

12/25/2024 12:36:43 AM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.DoubleOpt Media .IndigoRo.Installer (M)

16.5.2.21

File size:

1.3 MB (1,352,216 bytes)

Product version:

9.0.4.0

Trademarks:

Setup Factory is a trademark of Indigo Rose Corporation

Original file name:

suf_rt.exe

File type:

Executable application (Win32 EXE)

Installer:

Setup Factory

Language:

English (United States)

Common path:

C:\Program Files\worldwide web research\uninstall.exe

Digital Signature

Signed by:

DOUBLE OPT MEDIA PARTNERS LLC

Authority:

DigiCert Inc

Valid from:

10/9/2014 8:00:00 PM

Valid to:

12/12/2017 7:00:00 AM

Subject:

CN=DOUBLE OPT MEDIA PARTNERS LLC, O=DOUBLE OPT MEDIA PARTNERS LLC, L=Wilmington, S=Delaware, C=US

Issuer:

CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0289DEB63998EB06A29C8E7F34C73E75

File PE Metadata

Compilation timestamp:

12/16/2011 1:23:46 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:gB/s9XkrGUtabZRNM5vnRCnofkCuDVw4miJV5AX+ec999treoEUXLYydFsoked/g:ksY+7u5ZCn0kDb14A9hCk0ydWeW

Entry address:

0x3C2C80

Entry point:

60, BE, 00, 30, 68, 00, 8D, BE, 00, E0, D7, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.9200

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

1.3 MB (1,310,720 bytes)

Program Uninstaller

Program name:

Worldwide Web Research

Display publisher:

Double Opt Media

Uninstall string:

"C:\Program Files\WorldWide Web Research\uninstall.exe" "/U:C:\Program Files\WorldWide Web Research\Uninstall\uninstall.xml"

Remove uninstall.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.