home

uninst_easyprotect.exe

easyprotect

Akorea

The application uninst_easyprotect.exe, “easyprotectuninstaller” by Akorea has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. This is a self-extracting archive and installer and has been known to bundle potentially unwanted software. This is the uninstaller utility registered in the Windows Control Panel for the program easyprotect by AKorea.
Publisher:
Akorea  (signed and verified)

Product:
easyprotect

Description:
easyprotectuninstaller

Version:
1, 0, 0, 1

MD5:
a95dbed5305180a7030176700dd09b91

SHA-1:
55c44fd88094bcdd23c039a92e615761f0314d70

SHA-256:
9f854a60b9cc6dd848dff2474543f757e92e8fa004cfb9fcab74552378ea7ec5

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/23/2024 9:26:55 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Akorea.Installer (M)
16.2.11.3

File size:
155 KB (158,744 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2013 AKorea All rights reserved.

Original file name:
uninst_easyprotect.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\easyprotect\uninst_easyprotect.exe

Digital Signature
Signed by:
Akorea

Authority:
Thawte, Inc.

Valid from:
5/5/2012 9:00:00 AM

Valid to:
7/5/2013 8:59:59 AM

Subject:
CN=Akorea, O=Akorea, L=Haeundae-gu, S=BUSAN, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2FAE031CEAF57B56615A3998DEB1D1FD

File PE Metadata
Compilation timestamp:
6/13/2013 5:29:44 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
3072:N375xGD3OwHT0upS4tgYiFH6rma5ewOrq3fILLBTo1+cAlBFXldOq5:VlIDeWNSfYG6rmgRdgLLBTowcwFXldOo

Entry address:
0xB5950

Entry point:
60, BE, 00, 20, 49, 00, 8D, BE, 00, F0, F6, FF, 57, 83, CD, FF, EB, 10, 90, 90, 90, 90, 90, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89...
 
[+]

Entropy:
7.8740

Packer / compiler:
UPX 2.90LZMA

Code size:
144 KB (147,456 bytes)

Program Uninstaller
Program name:
easyprotect

Display publisher:
AKorea

Display version:
1.2

Uninstall string:
C:\Program Files (x86)\easyprotect\uninst_easyprotect.exe


Remove uninst_easyprotect.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.