» UninstallTool.exe
Overview
Analysis
File Details
Network (1)

UninstallTool.exe

Uninstall Tool

crystalidea.com

File name:

UninstallTool.exe

Publisher:

CrystalIDEA Software (signed by crystalidea.com)

Product:

Uninstall Tool

Version:

3.3.3.5324

MD5:

2a92458bf02e0b36cf5a8cf9af34395f

SHA-1:

992c5960dd9c85838498aaa661019950d11149b9

SHA-256:

debebd4ff085b522bd1c0b553476ed5d217fa6ac6713faeaccaeac862ca9d000

Scanner detections:

1 / 68

Status:

Clean (1 probable false positive detection)

Explanation:

This is mosty likely a false positive detection, the file is probably clean.

Analysis date:

11/15/2024 11:46:25 PM UTC (a few moments ago)

Scan engine

Detection

Engine version

Bkav FE

HW32.TsCabk

1.3.0.4959

File size:

3.1 MB (3,299,832 bytes)

Product version:

3.3.3.5324

Original file name:

UninstallTool.exe

File type:

Executable application (Win32 EXE)

Language:

Language Neutral

Common path:

C:\Program Files\uninstall tool\uninstalltool.exe

Digital Signature

Signed by:

crystalidea.com

Authority:

Unizeto Technologies S.A.

Valid from:

1/13/2014 11:14:00 PM

Valid to:

1/12/2017 11:14:00 PM

Subject:

E=support@crystalidea.com, CN=crystalidea.com, O=crystalidea.com, C=US

Issuer:

CN=Certum Code Signing CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL

Serial number:

119B09803E11C7BE685861F72F128819

File PE Metadata

Compilation timestamp:

3/12/2014 12:52:29 AM

OS version:

5.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

9.0

CTPH (ssdeep):

49152:i+2me3BxeZkOSm5RAT3tkSmwVwRP8M1NyUTr2CK8TtDfyl5eiArq:i+2FxqkO/Hs3twawRR1pEw7e5LAG

Entry address:

0x31D0EF

Entry point:

E9, 89, 3A, 00, 00, 88, 99, 67, 5F, AE, 25, BF, 6C, 26, E2, 9D, EC, B1, D4, CB, 88, 45, C3, 59, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 12, 43, 89, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 39, 75, 17, 8B, 1E, 83, EE, FC, E9, FA, DE, FC, FF, E8, 72, 0A, FD, FF, E8, 7D, 50, FC, FF, 5D, 8B, 05, 68, F3, 6D, 00, 09, C0, 0F, 85, 59, 24, FD, FF, E9, A4, 1A, FE, FF, C1, C1, 1F, E9, EF, FD, FD, FF, 83, C4, F8, 89, 45, FC, 8B, 45, FC, 89, 45, F8, 8B... 
[+]

Entropy:

6.5917

Packer / compiler:

Xtreme-Protector v1.05

Code size:

1.8 MB (1,924,096 bytes)

The executing file has been seen to make the following network communication in live environments.

TCP (HTTP):

Connects to crystalidea.com (173.230.144.164:80)

Scan UninstallTool.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.