» uninstall.exe
Overview
Analysis
File Details
Behaviors (1)

uninstall.exe

Setup Factory Runtime

DOUBLE OPT MEDIA PARTNERS LLC

The application uninstall.exe, “Setup Application” by DOUBLE OPT MEDIA PARTNERS has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Setup Factory installer. This is the uninstaller utility registered in the Windows Control Panel for the program Worldwide Web Research by Double Opt Media.

File name:

uninstall.exe

Publisher:

Indigo Rose Corporation (signed by DOUBLE OPT MEDIA PARTNERS LLC)

Product:

Setup Factory Runtime

Description:

Setup Application

Version:

9.0.4.0

MD5:

ab9190381f80cdcc2dcbfe6cbbedb10d

SHA-1:

f241a7f0d7d2ec4459092a696ce5704074264017

SHA-256:

fe62b315ce744b9ac9357cbc1892e13d09baa728c60c61bdb9261d51975c94f3

Scanner detections:

1 / 68

Status:

Adware

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

5/5/2024 3:00:08 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP.DoubleOpt Media .IndigoRo.Installer (M)

16.4.23.8

File size:

1.3 MB (1,352,216 bytes)

Product version:

9.0.4.0

Trademarks:

Setup Factory is a trademark of Indigo Rose Corporation

Original file name:

suf_rt.exe

File type:

Executable application (Win32 EXE)

Installer:

Setup Factory

Language:

English (United States)

Common path:

C:\Program Files\worldwide web research\uninstall.exe

Digital Signature

Signed by:

DOUBLE OPT MEDIA PARTNERS LLC

Authority:

DigiCert Inc

Valid from:

10/9/2014 7:00:00 PM

Valid to:

12/12/2017 6:00:00 AM

Subject:

CN=DOUBLE OPT MEDIA PARTNERS LLC, O=DOUBLE OPT MEDIA PARTNERS LLC, L=Wilmington, S=Delaware, C=US

Issuer:

CN=DigiCert High Assurance Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0289DEB63998EB06A29C8E7F34C73E75

File PE Metadata

Compilation timestamp:

12/16/2011 12:23:46 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:xB/s9XkrGUtabZRNM5vnRCnofkCuDVw4miJV5AX+ec999treoEUXLYydFsoked/g:nsY+7u5ZCn0kDb14A9hCk0ydWe+

Entry address:

0x3C2C80

Entry point:

60, BE, 00, 30, 68, 00, 8D, BE, 00, E0, D7, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, 0B, 75, 28, 8B, 1E, 83, EE, FC, 11, DB, 72, 1F, 48, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, EB, D4, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, EB, 52, 31, C9, 83, E8, 03, 72, 11, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 75, D1, F8, 89, C5, EB, 0B, 01, DB, 75, 07, 8B... 
[+]

Entropy:

7.9200

Packer / compiler:

UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:

1.3 MB (1,310,720 bytes)

Program Uninstaller

Program name:

Worldwide Web Research

Display publisher:

Double Opt Media

Uninstall string:

"C:\Program Files (x86)\WorldWide Web Research\uninstall.exe" "/U:C:\Program Files (x86)\WorldWide Web Research\Uninstall\uninstall.xml"

Remove uninstall.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.