uninstaller.exe Safe

Unsigned

This file has no digital signature. The publisher of this file could not be verified.

PE32 executable (GUI) Intel 80386 (stripped to external PDB)

File header First 32 bytes of this file

4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00

The determination of a file type is done with a signature or magic-numbers. Files are identified using by comparing the first set of bytes in the file header. Using this method type of files are recognised no matter the extension used. This information is useful to for example recognise executable files cloaked as images or movies.

Individual scanner results (0 %) :

Scanner	Engine		Result
	13.0.3114	20180814
	7.141118	20190210
	0.100.2	20190210
	1.1	20190210
	7.0-20	20190210
	4.6.5.141	20190210
	11.10 build 68	20190210
	5.53.0	20190210
	3107100	20180928

No malicious code found

Agics makes een analysis of the source code of the file. We look for comparisons with known malicious source code. This is a good way to detect new malicious files which are in fact variations of existing, and known malicious files.

Scan results:

SSDEEP

Context Triggered Piecewise Hashing, also called Fuzzy Hashing, can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length. Comparing a fuzzyhash is a good way to detect morphing malware. Malware which include random code in every copy to change its properties. Agics uses ssdeep to make create a fuzzyhash.

SSDEEP: 3072:7OwAFbmqOdDPx85L1A5mKmpIxFeeAsOZpPsvQRQ2oOrGeU7ambxmUE:41gUMHkUF4sA0vT2fGeU7ambxfE

No match found

Detection ration:

Not available on virusshare.com

Not on the nsrl list

Sandbox behaviour analysis:

The file is executed in a safe environment to track its behaviour. The behaviour analysis can help with detecting new malware which is not recognized by virusscanners yet. However it has a high chance on a false-positive, especially with installers, uninstallers and virusscanners.

Deletes its original binary from disk

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available

The binary likely contains encrypted or compressed data indicative of a packer

Detects VirtualBox through the presence of a file

The executable contains unknown PE section names indicative of a packer (could be a false positive)

Allocates read-write-execute memory (usually to unpack itself)

No internet connection

Imphash ffe3cc63e5a1efb4d2f4cc004c584646

Fingerprinting files can be done in various way. One way is to make a hash of the PE Imports. PE Imports are relative unique and this is a great way to find new variants of existing malware. The chance of false-positives is relative high. The resulting hash is often called an imphash.

Statistic analysis of the file

	Deviates from other files with the same name (imitation)
	File version is 0.0.0.0
	No certificate
	Other files with the same name do not have a certificate as well
	This is a very common file

Analysis: Low risk

A neural network is a type of artificial intelligence. It recognized patterns nog clear for a human viewer. Our neural network is surprisingly accurate in recognizing dangerous files. The value below is the predicted chance the file is malicious.

Read feedback on this file from other users. Help other users by providing feedback yourself.

You can earn reputation points !

You are currently not logged in. Login, or Create an account

Feedback users: