» uninstall40618651.exe
Overview
Analysis
File Details
Downloads (33)

uninstall40618651.exe

ExpressFiles Application

Faglaro Enterprises Limited

The application uninstall40618651.exe by Faglaro Enterprises Limited has been detected as adware by 14 anti-malware scanners. The program is a setup application that uses the SimpleFiles installer. It uses the ExpressFiles installer to bundle additional adware offers such as toolbars and web browser addons. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from mywatchtones.com and multiple other hosts.

File name:

Publisher:

http://www.express-files.com/ (signed by Faglaro Enterprises Limited)

Product:

ExpressFiles Application

Version:

1, 0, 0, 496

MD5:

062bda96a95e8c746bd17b036d0f54e7

SHA-1:

7a268514cfc9b35c7492a03c6bcc4e6b3d70ec7f

SHA-256:

6a33342d8bb654cd13187bae160a58f5ad744aa3e4ba3965a8cd3cff66f0f215

Scanner detections:

14 / 68

Status:

Adware

Description:

This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:

12/25/2024 2:35:56 PM UTC (today)

Scan engine

Detection

Engine version

AhnLab V3 Security

PUP/Win32.ExpressFiles

2013.12.05

avast!

Win32:Downloader-TSH [PUP]

2014.9-131223

AVG

MalSign.Faglaro Enterprises Limited

2014.0.3616

Bkav FE

W32.Clod58d.Trojan

1.3.0.4562

ESET NOD32

Win32/ExpressFiles (variant)

7.9130

G Data

Win32.Application.ExpressFiles

14.12.22

herdProtect (fuzzy)

variant of uninstall23190235.exe (Adware)

2014.1.2.10

K7 AntiVirus

Unwanted-Program

13.174.10410

Malwarebytes

PUP.Optional.ExpressFiles.A

v2013.12.23.06

McAfee

Artemis!062BDA96A95E

5600.7272

Reason Heuristics

PUP.FaglaroEnterprisesLimited.R

14.8.7.22

Sophos

Express Files

4.95

Trend Micro House Call

TROJ_GEN.F47V1118

7.2.357

VIPRE Antivirus

ExpressFiles Installer

24002

File size:

6.3 MB (6,630,496 bytes)

Product version:

2,0,0,0

Original file name:

ExpressFiles.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

SimpleFiles

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\local\temp\uninstall40618651.exe

Digital Signature

Signed by:

Faglaro Enterprises Limited

Authority:

COMODO CA Limited

Valid from:

12/13/2012 12:00:00 AM

Valid to:

12/13/2015 11:59:59 PM

Subject:

CN=Faglaro Enterprises Limited, O=Faglaro Enterprises Limited, STREET=Boumpoulinas 11, L=Nicosia, S=Nicosia, PostalCode=1060, C=CY

Issuer:

CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

37B080A790663B8AF63D05448AD0343B

File PE Metadata

Compilation timestamp:

11/18/2013 10:58:21 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

98304:9GV8mMNm/MB+x7CRj8fpqc2C8m+zqjXEfHqQUReYNa19cmCZPVYS06A1eUgaK:S8mcmUM680c2xHyUfTU3Na19/CZ+JfK

Entry address:

0x11FB2

Entry point:

E8, AE, 6B, 00, 00, E9, 89, FE, FF, FF, CC, CC, CC, CC, 55, 8B, EC, 57, 56, 8B, 75, 0C, 8B, 4D, 10, 8B, 7D, 08, 8B, C1, 8B, D1, 03, C6, 3B, FE, 76, 08, 3B, F8, 0F, 82, A0, 01, 00, 00, 81, F9, 80, 00, 00, 00, 72, 1C, 83, 3D, C4, 17, 43, 00, 00, 74, 13, 57, 56, 83, E7, 0F, 83, E6, 0F, 3B, FE, 5E, 5F, 75, 05, E9, 47, 08, 00, 00, F7, C7, 03, 00, 00, 00, 75, 14, C1, E9, 02, 83, E2, 03, 83, F9, 08, 72, 29, F3, A5, FF, 24, 95, 30, 21, 41, 00, 8B, C7, BA, 03, 00, 00, 00, 83, E9, 04, 72, 0C, 83, E0, 03, 03, C8, FF... 
[+]

Code size:

126.5 KB (129,536 bytes)

The file uninstall40618651.exe has been seen being distributed by the following 33 URLs.

http://mywatchtones.com/.../do.php?s=mp3bear_4&q=accendi la tua voce

http://bit.ly/HTj7Hl

http://91.205.157.43/.../?wmid=128&uid=125&q=Supersubmarina - Santacruz (2012)

http://91.205.157.43/.../?wmid=99392&uid=783&q=tara vina shyam mane

http://91.205.157.43/.../?wmid=128&uid=125&q=London Symphony Orchestra & John Alldis Choir - A Festival of Christmas Carols - 1979

http://bit.ly/15AnEDV

http://www.ebookl.com/download?url=http://desyncs.com/.../?sub=350&q=286212-atkins-physical-chemistry-8th-edition-solution-manual

http://www.bedownloads.org/file.php?name=French in Action 1987 52 DVDrips

http://awarefinance.com/.../agouti?.ecuador=besson&.d2lsY29tIGRlY28gc3R1ZGlvIGUzIHRvcnJlbnRiZmRjbQd2l=Y2VudGVyfDEzNzk3MjAyNDI

http://91.205.157.43/.../?wmid=99080&uid=589&q= Archimède Titanium 2

http://install.express-downloader.com/.../zy2zajEtvWI3

http://data.express-downloader.com/.../zy2zajEtvWI3

http://91.205.157.43/.../?wmid=98848&uid=360&q=746602-trust-intelligent-recommendation-24-oct-2013

http://desyncs.com/.../?sub=350&q=746602-trust-intelligent-recommendation-24-oct-2013

http://www.ebookl.com/download?url=http://desyncs.com/.../?sub=350&q=746602-trust-intelligent-recommendation-24-oct-2013

http://install.express-downloader.com/.../oaptYam0Kyf90WU4v5A1Vb2APxvt1Gkd79cXXeHEVArVyV0P3c5b

http://data.express-downloader.com/.../oaptYam0Kyf90WU4v5A1Vb2APxvt1Gkd79cXXeHEVArVyV0P3c5b

http://91.205.157.43/.../?wmid=99677&uid=909&q=Wham - Last Christmas

http://mywatchtones.com/.../do.php?s=mp3bear_5&q=Wham - Last Christmas

http://download-client.com/.../?wmid=99143&uid=643&q=JLS - Goodbye The Greatest Hits (Deluxe Edition) (2CD) ALBUM.zip

http://pushtraffic.net/.../?wmid=99122&uid=340&q=Y.U.Pro.7.5.2013.02.rar

http://data.express-downloader.com/j5GcGVeemUlpmvoRP5bjcz P 3cg7qsqZOKqInOs3GYu sMkV7KeNk w0GYT6cNRCKiGWgPTwV8O1s9fAts=

http://install.express-downloader.com/j5GcGVeemUlpmvoRP5bjcz P 3cg7qsqZOKqInOs3GYu sMkV7KeNk w0GYT6cNRCKiGWgPTwV8O1s9fAts=

http://91.205.157.43/.../?wmid=128&uid=125&q=VA - The Workout Mix 2013 (2012)

http://data.express-downloader.com/j5GTdiKd6W9u0e1oZcq6LHvI9Qp7uPl5JvXubzL60WIs5cMgT7mNZhPk23lZrZMUQ7WRWgPSwU1Cl8BeCdA1SgjaN0Fx

http://install.express-downloader.com/j5GTdiKd6W9u0e1oZcq6LHvI9Qp7uPl5JvXubzL60WIs5cMgT7mNZhPk23lZrZMUQ7WRWgPSwU1Cl8BeCdA1SgjaN0Fx

http://www.media4shared.net/.../file.php

http://91.205.157.43/.../?wmid=98816&uid=349&q=file.rar

http://data.express-downloader.com/j5GjXm7V50lnxutIZ9G1fjuM42Fhtbs8e625ciPw2WIo6pEkH HaYxLt3mwS6Mc=

http://install.express-downloader.com/j5GjXm7V50lnxutIZ9G1fjuM42Fhtbs8e625ciPw2WIo6pEkH HaYxLt3mwS6Mc=

Latest 30 of 33 download URLs

Remove uninstall40618651.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.