» doulci activator.exe
Overview
Analysis
File Details

doulci activator.exe

Setup

CLIck Yes

This is the OutBrowse Revenyou installer which bundles offers for additional third party applications that may be unwanted and installed without consent. The application doulci activator.exe by CLIck Yes has been detected as adware by 25 anti-malware scanners. The program is a setup application that uses the OutBrowse Revenyou installer. According to AVG, this software downloads additional adware offers during setup.

File name:

Publisher:

CLIck Yes (signed and verified)

Product:

Setup

Version:

1.9.3.0

MD5:

e082ad5efc5b4fc363a6bf371c35fe58

SHA-1:

dfd5958148a3563b90d5d73db7ab07f1ca2aca1b

SHA-256:

b41c8b321277ebc9336b8bd181bdbc9e694f6a47cc48a3a34d35357f9c05dcda

Scanner detections:

25 / 68

Status:

Adware

Explanation:

Bundles additional adware offers during download and installation using the OutBrowse installer.

Description:

This 'download manager' is also considered bundleware, a utility designed to download software (possibly legitimate or opensource) and bundle it with a number of optional offers including ad-supported utilities, toolbars, shopping comparison tools and browser extensions.

Analysis date:

5/16/2024 8:13:50 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Dropped:Trojan.Generic.12858787

676

Agnitum Outpost

PUA.OutBrowse

7.1.1

Avira AntiVirus

PUA/Outbrowse.Gen

3.6.1.96

avast!

NSIS:OutBrowse-CT [PUP]

2014.9-150330

AVG

Downloader

2016.0.3154

Baidu Antivirus

PUA.Win32.OutBrowse

4.0.3.15330

Bitdefender

Dropped:Trojan.Generic.12858787

1.0.20.445

Dr.Web

Trojan.OutBrowse.115

9.0.1.089

Emsisoft Anti-Malware

Dropped:Trojan.Generic.12858787

8.15.03.30.06

ESET NOD32

Win32/OutBrowse.BU potentially unwanted

9.11395

Fortinet FortiGate

Riskware/OutBrowse

3/30/2015

F-Secure

Dropped:Trojan.Generic.12858787

11.2015-30-03_2

G Data

Dropped:Trojan.Generic.12858787

15.3.25

Malwarebytes

PUP.Optional.OutBrowse

v2015.03.30.06

McAfee

Artemis!E082AD5EFC5B

5600.6810

MicroWorld eScan

Dropped:Trojan.Generic.12858787

16.0.0.267

NANO AntiVirus

Riskware.Win32.OutBrowse.dorbcs

0.30.8.659

Quick Heal

Adware.NSIS.OutBrowse.A

3.15.14.00

Reason Heuristics

PUP.Bundler.Outbrowse

15.3.30.18

Sophos

Generic PUA EP

4.98

SUPERAntiSpyware

Adware.OutBrowse/Variant

9965

Trend Micro House Call

Suspicious_GEN.F47V0302

7.2.89

Trend Micro

TROJ_GE.58B8EAEF

10.465.30

Vba32 AntiVirus

AdWare.OutBrowse

3.12.26.3

VIPRE Antivirus

Adware.OutBrowse

38878

File size:

1.1 MB (1,129,232 bytes)

Product version:

1.9.3.0

Setup

Original file name:

Ionic.Zip-2015Feb26-071639-a6828842-d82c-490c-8004-66347b08d605.exe

File type:

Executable application (Win32 EXE)

Bundler/Installer:

OutBrowse Revenyou

Language:

Language Neutral

Common path:

C:\users\{user}\downloads\doulci activator\doulci activator.exe

Digital Signature

Signed by:

CLIck Yes

Authority:

thawte, Inc.

Valid from:

2/25/2015 5:30:00 AM

Valid to:

12/11/2015 5:29:59 AM

Subject:

CN=CLIck Yes, O=CLIck Yes, L=Dublin, S=Dublin, C=IE

Issuer:

CN=thawte SHA256 Code Signing CA, O="thawte, Inc.", C=US

Serial number:

7A36B03E986FC883E45A62C491D55C89

File PE Metadata

Compilation timestamp:

2/26/2015 12:46:39 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

8.0

.NET CLR dependent:

Yes

CTPH (ssdeep):

12288:2Miy4IadS4ms5I6e66fEheKhFscUctzNuCnNLHJPBG4drHwuJqEJHEftFsi8Z/YR:2bSaE4mvt/cjBNhnxTrEkHuilY6M8Oh

Entry address:

0x75F3E

Entry point:

FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00... 
[+]

Entropy:

7.5649

Developed / compiled with:

Microsoft Visual C# / Basic .NET

Code size:

464 KB (475,136 bytes)

Remove doulci activator.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.