» 2pEIPlug.DLL
Overview
Analysis
File Details

2pEIPlug.DLL

Coupon Alert Installer Plugin

Mindspark Interactive Network

This is the web browser plugin for the Mindspark (Ask.com) toolbar. The module 2pEIPlug.DLL, “Coupon Alert Installer Plugin for 32-bit Windows” by Mindspark Interactive Network has been detected as a potentially unwanted program by 12 anti-malware scanners.

File name:

2pEIPlug.DLL

Publisher:

CouponAlert (signed by Mindspark Interactive Network)

Product:

Coupon Alert Installer Plugin

Description:

Coupon Alert Installer Plugin for 32-bit Windows

Version:

1,2,11,2

MD5:

e5884d575e4731bf7034f31b22e48ccf

SHA-1:

692f43033ac44655d02b158080e6aad076cecb81

SHA-256:

5ba4ecb30fbe82154b30468b50613b89069d92834723f05e9d34f74f75d9e782

Scanner detections:

12 / 68

Status:

Potentially unwanted

Explanation:

Part of the MyWebSearch/Mindspark/Ask web browser extension and toolbar.

Analysis date:

5/10/2024 4:07:41 AM UTC (today)

Scan engine

Detection

Engine version

Agnitum Outpost

PUA.Toolbar.MyWebSearch

7.1.1

avast!

Win32:Mindspark-A [PUP]

140617-1

AVG

Zango

2015.0.3398

Dr.Web

Adware.MyWebSearch.50

9.0.1.05190

ESET NOD32

Win32/Toolbar.MyWebSearch.AC potentially unwanted application

7.0.302.0

Fortinet FortiGate

Riskware/Toolbar

8/1/2014

F-Prot

W32/MyWeb.G

v6.4.7.1.166

herdProtect (fuzzy)

variant of 4jeiplug.dll (Adware)

2014.4.11.10

NANO AntiVirus

Trojan.Win32.MyWebSearch.crfjnq

0.28.2.61148

Panda Antivirus

Adware/WebSearch

14.07.29.11

Reason Heuristics

PUP.Installer.MindsparkInteractiveNetwork.I

14.8.8.2

VIPRE Antivirus

Threat.200876

31208

File size:

78.9 KB (80,768 bytes)

Product version:

1,2,11,2

Original file name:

2pEIPlug.DLL

File type:

Dynamic link library (Win32 DLL)

Language:

English (United States)

Common path:

C:\Program Files\couponalert_2pei\installr\1.bin\2peiplug.dll

Digital Signature

Signed by:

Mindspark Interactive Network

Authority:

VeriSign, Inc.

Valid from:

4/9/2012 7:00:00 PM

Valid to:

5/6/2015 6:59:59 PM

Subject:

CN=Mindspark Interactive Network, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Mindspark Interactive Network, L=White Plains, S=NewYork, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

098417F7EA6406EC7B320590E17A65B7

File PE Metadata

Compilation timestamp:

11/19/2013 2:58:37 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

1536:r+Qj2ZsAhXvLsRdBKTPTzzGUh1ajf3m+x6ExOql:LwsWjsRdBKTPTz/h1ajf3m+x6Erl

Entry address:

0x640C

Entry point:

8B, FF, 55, 8B, EC, 83, 7D, 0C, 01, 75, 05, E8, BD, 2F, 00, 00, FF, 75, 08, 8B, 4D, 10, 8B, 55, 0C, E8, EC, FE, FF, FF, 59, 5D, C2, 0C, 00, 8B, FF, 55, 8B, EC, 83, EC, 18, 53, 56, FF, 75, 0C, 8D, 4D, E8, E8, 98, F2, FF, FF, 8B, 5D, 08, BE, 00, 01, 00, 00, 3B, DE, 73, 54, 8B, 4D, E8, 83, B9, AC, 00, 00, 00, 01, 7E, 14, 8D, 45, E8, 50, 6A, 01, 53, E8, CA, 14, 00, 00, 8B, 4D, E8, 83, C4, 0C, EB, 0D, 8B, 81, C8, 00, 00, 00, 0F, B7, 04, 58, 83, E0, 01, 85, C0, 74, 0F, 8B, 81, CC, 00, 00, 00, 0F, B6, 04, 18, E9... 
[+]

Entropy:

6.2798

Code size:

44 KB (45,056 bytes)

Remove 2pEIPlug.DLL - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.