home

afirst.exe

Ad First Catch

Part of an Adpeak program that shows ads in the browser without providing information about the ad's origin. Ads are injected as banners or text-links in random web pages. The application afirst.exe by Ad First Catch has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat.
Publisher:
Ad First Catch  (signed and verified)

MD5:
5e211308b0288f2b0fc322c1e702ece0

SHA-1:
1e93abe76da7ca2dfdd84d032470389f7362f514

SHA-256:
0f327980fb0b7093de4f833e03cc4637e3e5b5d48970ebaaca9e8c572dca1904

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
4/21/2025 3:43:48 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.AdPeak.AdFirstCatch
15.4.24.0

File size:
48.9 MB (51,310,496 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\windows\syswow64\compatibility verifier\afirst.exe

Digital Signature
Signed by:
Ad First Catch

Authority:
Ad First Catch

Valid from:
4/14/2015 10:46:48 PM

Valid to:
4/13/2016 10:46:48 PM

Subject:
CN=adfirst.nl, OU=Ads, O=Ad First Catch, S=Holland, C=NL

Issuer:
E=support@firstcatchads.nl, O=Ad First Catch, L=Amsterdam, S=Holland, C=NL

Serial number:
00E592A6D69AFA75B0

File PE Metadata
Compilation timestamp:
4/15/2015 4:24:36 AM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

CTPH (ssdeep):
786432:45Y/xWcAuov/kJGhnZ3ARl1NVx9NgWZ5ip5fjeWNQT:aExWBv/CGH3ARl1NVGWZ5iXfCPT

Entry address:
0x22B5979

Entry point:
E8, C2, 71, 01, 00, E9, 39, FE, FF, FF, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 8B, 44, 24, 08, 8B, 4C, 24, 10, 0B, C8, 8B, 4C, 24, 0C, 75, 09, 8B, 44, 24, 04, F7, E1, C2, 10, 00, 53, F7, E1, 8B, D8, 8B, 44, 24, 08, F7, 64, 24, 14, 03, D8, 8B, 44, 24, 08, F7, E1, 03, D3, 5B, C2, 10, 00, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, CC, 83, EC, 08, 0F, AE, 5C, 24, 04, 8B, 44, 24, 04, 25, 80, 7F, 00, 00, 3D, 80, 1F, 00, 00, 0F, 85, 59, 02, 00, 00, D9, 3C, 24, 66, 8B, 04, 24, 66, 83, E0, 7F, 66, 83...
 
[+]

Entropy:
6.7639

Code size:
42 MB (44,015,104 bytes)

Remove afirst.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.