» Forecaster.exe
Overview
Analysis
File Details
Programs (1)

Forecaster.exe

Forecaster Weather Prediction Tool

Core Systems

Part of an adware web browser extension that delivers advertisements such as coupons, price-comparisons, display media, affiliate links, banners, popups/popunders and other links. The application Forecaster.exe, “Forecaster Weather Prediction Tool” by Core Systems has been detected as adware by 4 anti-malware scanners. This file is typically installed with the program Local Temperature by Core Systems which is a potentially unwanted software program.

File name:

Forecaster.exe

Publisher:

Local Temperature (signed by Core Systems)

Product:

Forecaster (R) Weather Prediction Tool

Description:

Forecaster Weather Prediction Tool

Version:

1.1.0.11

MD5:

3191e6fa7aeb2fdd4b9af96c5e56a891

SHA-1:

9d6d521ff2deb7e16fc4fb9c983042149345bf82

SHA-256:

e7208baa9c5c5b8ae08f855e0838b4ca6440e7b5bf1681e2bdfe393f9cd18547

Scanner detections:

4 / 68

Status:

Adware

Analysis date:

11/23/2024 8:20:06 AM UTC (today)

Scan engine

Detection

Engine version

Malwarebytes

PUP.Optional.LocalTemperature.C

v2015.10.10.11

Reason Heuristics

PUP.Weather.CoreSystems (M)

15.10.10.23

Trend Micro House Call

Suspicious_GEN.F47V0412

7.2.283

VIPRE Antivirus

Bonzuna

40002

File size:

159.9 KB (163,752 bytes)

Product version:

1.1.0.11

Original file name:

Forecaster.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\localtemperature\forecaster.exe

Digital Signature

Signed by:

Core Systems

Authority:

GoDaddy.com, Inc.

Valid from:

6/17/2014 3:26:02 PM

Valid to:

6/17/2015 3:26:02 PM

Subject:

CN=Core Systems, O=Core Systems, L=Austin, S=Texas, C=US

Issuer:

CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:

4B1F1B2C0AF57F

File PE Metadata

Compilation timestamp:

6/18/2010 5:47:59 AM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows Console

Linker version:

10.0

CTPH (ssdeep):

3072:pT96QCrt0BHn9NbopVSmKxiZHF8s7MtlVTu:p8TGHn3UpVSmrNcl5u

Entry address:

0xD4E9

Entry point:

E8, 97, 6A, 00, 00, E9, 95, FE, FF, FF, 8B, FF, 55, 8B, EC, 56, 8B, 75, 08, 56, E8, CF, 14, 00, 00, 50, E8, 18, 6B, 00, 00, 59, 59, 85, C0, 74, 7C, E8, EB, C3, FF, FF, 83, C0, 20, 3B, F0, 75, 04, 33, C0, EB, 0F, E8, DB, C3, FF, FF, 83, C0, 40, 3B, F0, 75, 60, 33, C0, 40, FF, 05, 20, 6F, 42, 00, F7, 46, 0C, 0C, 01, 00, 00, 75, 4E, 53, 57, 8D, 3C, 85, 30, 6F, 42, 00, 83, 3F, 00, BB, 00, 10, 00, 00, 75, 20, 53, E8, A5, 16, 00, 00, 59, 89, 07, 85, C0, 75, 13, 8D, 46, 14, 6A, 02, 89, 46, 08, 89, 06, 58, 89, 46... 
[+]

Entropy:

6.5507

Code size:

118 KB (120,832 bytes)

The file Forecaster.exe has been discovered within the following program.

Local Temperature by Core Systems

Install advertising in the browser. From the EULA/Terms: "The free version of the Software is supported by advertising. Accordingly, the Site and the free version of the Software may provide third party content, advertising and services, and links thereto (e.g.

localtemperature.net

68% remove it

Remove Forecaster.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.