home

airc493.exe

Couponarific

This is the instaler for an an Adpeak program that shows ads in the browser without providing information about the ad's origin. Ads are injected as banners or text-links in random web pages. The application airc493.exe by Couponarific has been detected as adware by 9 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It is also typically executed from the user's temporary directory. The file has been seen being downloaded from cdn.airdlr1.com.
Publisher:
Couponarific  (signed and verified)

MD5:
22b12f9b7c2be50152af3eecfe2d7273

SHA-1:
4c05faa57d3659fbda6e61a68acc33c8d4c39670

SHA-256:
39f0c75810397be1490270d11bb664f25fb368188c08fd091dd7370c9f5862a2

Scanner detections:
9 / 68

Status:
Adware

Explanation:
Injects advertisements in the web browser in the form or banner ads and popups.

Analysis date:
12/24/2024 11:54:48 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Avira AntiVirus
APPL/Adpeak.682992
7.11.190.0

avast!
Adware-gen [Adw]
141130-1

AVG
Generic6
2015.0.3272

Dr.Web
infected with Trojan.DownLoad3.35130
9.0.1.05190

ESET NOD32
Win32/Adware.Adpeak.Q application
7.0.302.0

Kaspersky
not-a-virus:AdWare.Win32.AdPeak
15.0.0.543

NANO AntiVirus
Trojan.Win32.DownLoad3.djkwer
0.28.6.63850

Reason Heuristics
PUP.Couponarific.H
14.12.10.9

VIPRE Antivirus
Threat.4150696
35224

File size:
345.8 KB (354,144 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\appdata\local\temp\airc493.exe

Digital Signature
Signed by:
Couponarific

Authority:
GlobalSign nv-sa

Valid from:
10/6/2014 4:12:43 PM

Valid to:
10/7/2015 4:12:43 PM

Subject:
E=support@couponarific.com, CN=Couponarific, O=Couponarific, L=Seattle, S=WA, C=US

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121D5217FDB68336D578AC0747743835652

File PE Metadata
Compilation timestamp:
10/7/2014 12:40:14 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:doGzI1XxOH/R4dEgummZ8r/GJ8PG2PKILNB4jXwLWuBAQzAuMaJ/LhnU0:dbwOH/R4dEgn28I27LNSwLW6jnU0

Entry address:
0x31FF

Entry point:
81, EC, D8, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 92, 40, 00, 89, 6C, 24, 14, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, 34, 71, 40, 00, 55, FF, 15, AC, 72, 40, 00, 6A, 09, A3, 78, 92, 42, 00, E8, FD, 2E, 00, 00, A3, C4, 91, 42, 00, 55, 8D, 44, 24, 38, 68, B4, 02, 00, 00, 50, 55, 68, 70, 06, 42, 00, FF, 15, 7C, 71, 40, 00, 68, C0, 92, 40, 00, 68, C0, 81, 42, 00, E8, 68, 2B, 00, 00, FF, 15, 38, 71, 40, 00, BB, 00, 40, 43, 00, 50, 53, E8, 56, 2B, 00, 00...
 
[+]

Entropy:
7.9491

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file airc493.exe has been seen being distributed by the following URL.

http://cdn.airdlr1.com/downloads/offers/.../nov26air.exe

Remove airc493.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.