» uninstallstrcnothingtodo]sourc.exea5e49ae
Overview
Analysis
File Details

uninstallstrcnothingtodo]sourc.exea5e49ae

Iota Installer

LiveSoftAction SRL

This is the SIEN AppScion Installer which bundles applications with offers for additional 3rd party software, mostly unwanted adware, and may be installed with minimal consent. The file uninstallstrcnothingtodo]sourc.exea5e49ae by LiveSoftAction SRL has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the SIEN SuperInstall installer. It is also typically executed from the user's temporary directory.

File name:

Publisher:

LiveSoft Action (signed by LiveSoftAction SRL)

Product:

Iota Installer

Version:

9.25.5.1

MD5:

00c3b6ac217d87e18b4dfa060af68d8c

SHA-1:

17f7e7ba0d231d353b936ab14d0c55427304eed8

SHA-256:

cd34dc1c20cfb3037c8841f67311d2184db4bf356250108b38951a1d948c7c0d

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

11/27/2024 7:00:36 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.Sien (M)

17.3.16.7

File size:

656.6 KB (672,376 bytes)

Product version:

9.25.5.1

Original file name:

Setup.exe

Bundler/Installer:

SIEN SuperInstall

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\temp\uninstallstrcnothingtodo]sourc.exea5e49ae

Digital Signature

Signed by:

LiveSoftAction SRL

Authority:

GlobalSign nv-sa

Valid from:

3/3/2015 10:24:08 AM

Valid to:

3/3/2016 10:24:08 AM

Subject:

CN=LiveSoftAction SRL, O=LiveSoftAction SRL, L=Bucuresti, C=RO

Issuer:

CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:

112115C730891244FB88071FE814148E0E53

File PE Metadata

Compilation timestamp:

6/19/2015 9:53:16 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

11.0

Entry address:

0x1A7AB0

Entry point:

60, BE, 00, C0, 51, 00, 8D, BE, 00, 50, EE, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.8915

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

560 KB (573,440 bytes)

Remove uninstallstrcnothingtodo]sourc.exea5e49ae - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.