home

LocalTemperature.exe

Local Temperature

Core Systems

Part of an adware web browser extension that delivers advertisements such as coupons, price-comparisons, display media, affiliate links, banners, popups/popunders and other links. The application LocalTemperature.exe by Core Systems has been detected as adware by 10 anti-malware scanners. This file is typically installed with the program Local Temperature by Core Systems which is a potentially unwanted software program.
Publisher:
Local Temperature, LLC  (signed by Core Systems)

Product:
Local Temperature

Version:
1.0.0.1

MD5:
060f8922822e0f606cd7c82e7070852b

SHA-1:
88e171b9ea634be10bb451a41446a407481900ea

SHA-256:
ad95b829ed6898b4bfd4aebe83693aa869a5b7b4ca13dfb2e747665ac84163a5

Scanner detections:
10 / 68

Status:
Adware

Analysis date:
11/27/2024 4:25:35 AM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Adware.Agent.PMA
631

Bitdefender
Adware.Agent.PMA
1.0.20.670

Emsisoft Anti-Malware
Adware.Agent.PMA
8.15.05.14.10

F-Secure
Adware.Agent.PMA
11.2015-14-05_5

G Data
Adware.Agent.PMA
15.5.25

Malwarebytes
PUP.Optional.LocalTemperature.C
v2015.05.14.10

MicroWorld eScan
Adware.Agent.PMA
16.0.0.402

Reason Heuristics
PUP.Weather.CoreSystems
15.5.14.18

Trend Micro House Call
Suspicious_GEN.F47V0402
7.2.134

VIPRE Antivirus
Bonzuna
39144

File size:
118.4 KB (121,256 bytes)

Product version:
1.0.0.1

Copyright:
Copyright © 2015

Trademarks:
Local Temperature, LLC

Original file name:
LocalTemperature.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\localtemperature\localtemperature.exe

Digital Signature
Signed by:
Core Systems

Authority:
GoDaddy.com, Inc.

Valid from:
6/17/2014 1:26:02 PM

Valid to:
6/17/2015 1:26:02 PM

Subject:
CN=Core Systems, O=Core Systems, L=Austin, S=Texas, C=US

Issuer:
CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, S=Arizona, C=US

Serial number:
4B1F1B2C0AF57F

File PE Metadata
Compilation timestamp:
2/25/2015 8:03:24 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
768:lp+aC04LIF8COXwS3xIW4LIF8COXwS3xI3CqT5hxb8/EDBIXgix1JEbyx4LIF8CW:Ch04LyymW4LyymSqp+EQx4LyymjNM

Entry address:
0x162FE

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Entropy:
5.6037

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
81 KB (82,944 bytes)

The file LocalTemperature.exe has been discovered within the following program.

Local Temperature  by Core Systems
Install advertising in the browser. From the EULA/Terms: "The free version of the Software is supported by advertising. Accordingly, the Site and the free version of the Software may provide third party content, advertising and services, and links thereto (e.g.
localtemperature.net
68% remove it
 
Powered by Should I Remove It?

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to a184-25-56-194.deploy.static.akamaitechnologies.com  (184.25.56.194:80)

TCP (HTTP):
Connects to a72-246-151-24.deploy.akamaitechnologies.com  (72.246.151.24:80)

TCP (HTTP):
Connects to a72-246-151-11.deploy.akamaitechnologies.com  (72.246.151.11:80)

TCP (HTTP):
Connects to a23-219-88-176.deploy.static.akamaitechnologies.com  (23.219.88.176:80)

TCP (HTTP):
Connects to d3-3-0-0-15-0.a01.nycmny03.us.ra.verio.net  (165.254.207.57:80)

TCP (HTTP):
Connects to a23-3-10-56.deploy.static.akamaitechnologies.com  (23.3.10.56:80)

TCP (HTTP):
Connects to a110-164-2-66.deploy.static.akamaitechnologies.com  (110.164.2.66:80)

TCP (HTTP):
Connects to a104-99-238-201.deploy.static.akamaitechnologies.com  (104.99.238.201:80)

TCP (HTTP):
Connects to a104-99-238-146.deploy.static.akamaitechnologies.com  (104.99.238.146:80)

Remove LocalTemperature.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.