home

uninstaller.exe

Couponarific

This is the instaler for an an Adpeak program that shows ads in the browser without providing information about the ad's origin. Ads are injected as banners or text-links in random web pages. The application uninstaller.exe by Couponarific has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. This is the uninstaller utility registered in the Windows Control Panel for the program couponarific by couponarific. This file is typically installed with the program couponarific by CouponARific which is a potentially unwanted software program.
Publisher:
Couponarific  (signed and verified)

MD5:
a36277ee80b83463fa825ca9d8d35d46

SHA-1:
348bba64d382fd21bee683895a8d055b81c0674a

SHA-256:
02487d2cf77ab732c57261c67612efbfa44751109f2e4a5148422689228a2822

Scanner detections:
5 / 68

Status:
Adware

Analysis date:
12/25/2024 12:56:44 PM UTC  (today)

Scan engine
Detection
Engine version

AVG
Generic
2015.0.3259

Clam AntiVirus
Win.Trojan.Agent-825665
0.98/21511

Kaspersky
not-a-virus:AdWare.Win32.AdPeak
14.0.0.2790

Reason Heuristics
PUP.Couponarific.L
14.12.15.23

Trend Micro House Call
TROJ_GEN.R0C1H07L614
7.2.349

File size:
103.4 KB (105,872 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\Program Files\15f7a5a9-8bed-495e-a369-fa89a25f7c28\uninstaller.exe

Digital Signature
Signed by:
Couponarific

Authority:
GlobalSign nv-sa

Valid from:
10/6/2014 3:12:43 PM

Valid to:
10/7/2015 3:12:43 PM

Subject:
E=support@couponarific.com, CN=Couponarific, O=Couponarific, L=Seattle, S=WA, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D5217FDB68336D578AC0747743835652

File PE Metadata
Compilation timestamp:
10/6/2014 11:40:20 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
1536:0joUxZbE+HOI66qkryz9zIErWBH26P2XlvtYozOJmmLi1kn597WFhf:0dxNE+Hb+eyz9zIjUsozClfjk

Entry address:
0x335A

Entry point:
81, EC, D8, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, 30, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, BC, 70, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 09, A3, B8, 92, 42, 00, E8, 15, 2F, 00, 00, A3, 04, 92, 42, 00, 55, 8D, 44, 24, 38, 68, B4, 02, 00, 00, 50, 55, 68, A8, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, 7C, 93, 40, 00, 68, 00, 82, 42, 00, E8, 80, 2B, 00, 00, FF, 15, 34, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 6E, 2B, 00, 00...
 
[+]

Entropy:
7.0889

Packer / compiler:
Nullsoft install system v2.x

Code size:
24 KB (24,576 bytes)

Program Uninstaller
Program name:
couponarific

Display publisher:
couponarific

Display version:
2.0.1

Uninstall string:
C:\Program Files\15F7A5A9-8BED-495E-A369-FA89A25F7C28\uninstaller.exe -source="15F7A5A9-8BED-495E-A369-FA89A25F7C28" -clean="1"


The file uninstaller.exe has been discovered within the following program.

couponarific  by CouponARific
couponarific is a potentially unwanted adware program that injects ads into the user's browser. This includes inserting into web pages or displaying ads over parts of existing web page advertisements, banners, coupons or text links that would not otherwise appear.
83% remove it
 
Powered by Should I Remove It?

Remove uninstaller.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.