home

airbfc0.exe

Severe Weather Alerts

Weather Notifications LLC

Part of an adware web browser extension that delivers advertisements such as coupons, price-comparisons, display media, affiliate links, banners, popups/popunders and other links. The application airbfc0.exe by Weather Notifications has been detected as adware by 5 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from d1s8azhe8rpvoz.cloudfront.net and multiple other hosts.
Publisher:
Weather Notifications, LLC  (signed by Weather Notifications LLC)

Product:
Severe Weather Alerts

Description:
Application

Version:
1.23.0.0

MD5:
d18c6edb768e000117eeeea3d5fc89be

SHA-1:
775ceb1bd0d24df850773b5b57ea588983aa18d2

SHA-256:
acbee4955a1ecf53baa95bb0e3b0c8b87fe320797d626f47041af8feec31d91a

Scanner detections:
5 / 68

Status:
Adware

Analysis date:
11/23/2024 4:44:35 AM UTC  (today)

Scan engine
Detection
Engine version

Bkav FE
W32.Clodbc4.Trojan
1.3.0.4613

ESET NOD32
MSIL/Adware.StrongVault (variant)
7.9176

Malwarebytes
PUP.Optional.SevereWeatherAlerts
v2013.12.16.04

Reason Heuristics
PUP.WeatherNotifications.H
14.8.8.1

VIPRE Antivirus
SevereWeatherAlerts
24412

File size:
453 KB (463,880 bytes)

Copyright:
Weather Notifications, LLC © 2013. All Rights Reserved.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\airbfc0.exe

Digital Signature
Signed by:
Weather Notifications LLC

Authority:
COMODO CA Limited

Valid from:
6/13/2013 8:00:00 PM

Valid to:
6/14/2014 7:59:59 PM

Subject:
CN=Weather Notifications LLC, O=Weather Notifications LLC, STREET=250 Park Ave Ste 504, L=Minneapolis, S=MN, PostalCode=55415, C=US

Issuer:
CN=COMODO Code Signing CA 2, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
0D57C9460FE0C441B8FDD693F1AC6CD7

File PE Metadata
Compilation timestamp:
12/5/2009 5:50:52 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
12288:lnzefKdEN7vYCiXUrTNRw8FC4UaY7HYeesMFAa+i8H6:lnzMKavYsTNRrUz7oxili8H6

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9400

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file airbfc0.exe has been seen being distributed by the following 7 URLs.

http://d1s8azhe8rpvoz.cloudfront.net/bundles/.../swa1_23.exe

http://drzwu57ht9dxd.cloudfront.net/bundles/.../swa1_23.exe

http://srv1.statistics-host.com/static/.../swa1_23.exe

http://dm930xmxv1gqs.cloudfront.net/bundles/.../swa1_23.exe

http://d3emsmln8xfj03.cloudfront.net/bundles/.../swa1_23.exe

http://cdn.airdlr4.com/downloads/offers/.../swa1_23.exe

http://i.vertitechnologygroup.com/inst/software/59C7764D-AD0C-443F-8B8E-84D838032F56/.../swa1_23.exe

Remove airbfc0.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.