Home / malware Adware:Win32/Couponarific
First posted on 18 December 2014.
Source: MicrosoftAliases :
There are no other names known for Adware:Win32/Couponarific.
Explanation :
Threat behavior
Installation
This threat can create files on your PC, including:
- %ProgramFiles%\010\<10 random letters>32.exe, for example %ProgramFiles%\010\hmnuolzzhu32.exe
- %ProgramFiles%\24237908-8269-4cfa-a37d-5ecb2e66dd78\uninstaller.exe
It can also make registry changes during its installation, including:
In subkey: HKLM\software\couponarific
Sets value: "source"
With data: "24237908-8269-4cfa-a37d-5ecb2e66dd78"
It installs itself as a service using the following registry entry:
In subkey:HKLM\SYSTEM\CurrentControlSet\services\, for example HKLM\SYSTEM\CurrentControlSet\services\hmnuolzzhu32
Payload
Displays ads that you can't control
This program can show you extra ads. These ads can appear:
- In your web browser: such as search helpers, hover links, and banner ads.
- Outside of your web browser: such as pop ups, balloon ads, and toast notifications.
These advertisements would not be shown if this program wasn't installed on your PC.
Connects to a remote host
We have seen this threat connect to a remote host, including:Malware can connect to a remote host to do any of the following:
- dq7lo1d0bbd2n.cloudfront.net using port 80
- Check for an Internet connection
- Download and run files (including updates or other malware)
- Report a new infection to its author
- Receive configuration or other data
- Receive instructions from a malicious hacker
- Search for your PC location
- Upload information taken from your PC
- Validate a digital certificate
Creates an uninstaller
This threat can create an uninstaller by modifying the registry. For example:
In subkey: HKLM\software\microsoft\windows\currentversion\uninstall\24237908-8269-4cfa-a37d-5ecb2e66dd78
Sets value: "DisplayName"
With data: "couponarific"
This uninstaller does not fully remove this program.
This malware description was published using automated analysis of file SHA1 00b0c15b9a988135bbcf0cd9e18bc51fb7502cde. Symptoms
The following can indicate that you have this threat on your PC:
- You see these files:
- %ProgramFiles%\010\hmnuolzzhu32.exe
- %ProgramFiles%\24237908-8269-4cfa-a37d-5ecb2e66dd78\uninstaller.exe
- You see registry modifications such as:
- In subkey: HKLM\software\couponarific
Sets value: "source"
With data: "24237908-8269-4cfa-a37d-5ecb2e66dd78"
- In subkey: HKLM\software\microsoft\windows\currentversion\uninstall\24237908-8269-4cfa-a37d-5ecb2e66dd78
Sets value: "DisplayName"
With data: "couponarific"
Last update 18 December 2014