Analyzing...

File Name: uninstall.exe

SHA1: b39f9342a7f51aeb9d9668e25bdf223cce35275d

MD5: c1dbf368101fa67e7a39e1de31de5198

First Seen Date: 2016-05-06 21:49:22.243192 ( 2016-05-06 21:49:22.243192 )

Number of Clients Seen: 29

Last Analysis Date: 2016-05-06 21:49:22.243224 ( 2016-05-06 21:49:22.243224 )

Human Expert Analysis Date: 2016-06-19 10:19:31.439955 ( 2016-06-19 10:19:31.439955 )

Human Expert Analysis Result: Clean

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2016-05-06 21:49:22.243224	Clean
Static Analysis Overall Verdict	2016-05-06 21:49:22.243224	Highly Suspicious
Dynamic Analysis Overall Verdict	2016-05-06 21:49:22.243224	Highly Suspicious
Human Expert Analysis Overall Verdict	2016-06-19 10:19:31.439955	Clean

Static Analysis

Static Analysis Overall Verdict	Result
Highly Suspicious

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Suspicious
TLS callback functions array detected	Clean

Anti-debug calls

FindWindowExA

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
Highly Suspicious

Suspicious Behaviors
Has no visible windows

Behavioral Information

CreateMutex

<NULL>

CreateFile

C:\

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

C:\Users\win7\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db

C:\Users\desktop.ini

C:\Users

C:\Users\win7

C:\Users\win7\AppData

C:\Users\win7\AppData\Local

C:\Users\win7\AppData\Local\Temp

C:\Users\win7\Searches\desktop.ini

C:\Users\win7\Videos\desktop.ini

C:\Users\win7\Contacts\desktop.ini

LoadLibrary

C:\Windows\system32\UXTHEME.dll

C:\Windows\system32\USERENV.dll

C:\Windows\system32\SETUPAPI.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

advapi32.dll

C:\Windows\system32\SHFOLDER.dll

ole32.dll

comctl32.dll

ADVAPI32.dll

propsys.dll

ntmarta.dll

SHELL32.dll

QueryFilePath

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Au_.exe

DeleteFile

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Tu_.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Uu_.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Vu_.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Wu_.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Xu_.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Yu_.exe

C:\Users\win7\AppData\Local\Temp\~nsuA.tmp\Zu_.exe

Precise Detectors Analysis Results

No Detector Result Received

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Human Expert Analysis Results

Analysis Start Date: 2016-05-25 02:08:19.548063 ( 2016-05-25 02:08:19.548063 )

Analysis End Date: 2016-06-19 10:19:31.439955 ( 2016-06-19 10:19:31.439955 )

File Upload Date: 2016-05-20 22:17:22.904980 ( 2016-05-20 22:17:22.904980 )

Update Date: 2016-06-19 10:19:31.457599 ( 2016-06-19 10:19:31.457599 )

Human Expert Analyst Feedback: VLC Uninstaller

Verdict: Clean

Additional File Information

Vendor Validation

Certificate Validation

PE Headers

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5