Home / malware

PDF

Adware:Win32/Couponarific

First posted on 18 December 2014.
Source: Microsoft

Aliases :

There are no other names known for Adware:Win32/Couponarific.

Explanation :

Threat behavior

Installation
This threat can create files on your PC, including:

• %ProgramFiles%\010\<10 random letters>32.exe, for example %ProgramFiles%\010\hmnuolzzhu32.exe
• %ProgramFiles%\24237908-8269-4cfa-a37d-5ecb2e66dd78\uninstaller.exe

It can also make registry changes during its installation, including:

In subkey: HKLM\software\couponarific
Sets value: "source"
With data: "24237908-8269-4cfa-a37d-5ecb2e66dd78"

It installs itself as a service using the following registry entry:

In subkey:HKLM\SYSTEM\CurrentControlSet\services\, for example HKLM\SYSTEM\CurrentControlSet\services\hmnuolzzhu32



Payload

Displays ads that you can't control

This program can show you extra ads. These ads can appear:

• In your web browser: such as search helpers, hover links, and banner ads.
• Outside of your web browser: such as pop ups, balloon ads, and toast notifications.

These advertisements would not be shown if this program wasn't installed on your PC.





Connects to a remote host

We have seen this threat connect to a remote host, including:

• dq7lo1d0bbd2n.cloudfront.net using port 80

Malware can connect to a remote host to do any of the following:

• Check for an Internet connection
• Download and run files (including updates or other malware)
• Report a new infection to its author
• Receive configuration or other data
• Receive instructions from a malicious hacker
• Search for your PC location
• Upload information taken from your PC
• Validate a digital certificate

Creates an uninstaller



This threat can create an uninstaller by modifying the registry. For example:

In subkey: HKLM\software\microsoft\windows\currentversion\uninstall\24237908-8269-4cfa-a37d-5ecb2e66dd78

Sets value: "DisplayName"
With data: "couponarific"

This uninstaller does not fully remove this program.

This malware description was published using automated analysis of file SHA1 00b0c15b9a988135bbcf0cd9e18bc51fb7502cde. Symptoms

The following can indicate that you have this threat on your PC:

• You see these files:
  • %ProgramFiles%\010\hmnuolzzhu32.exe
  • %ProgramFiles%\24237908-8269-4cfa-a37d-5ecb2e66dd78\uninstaller.exe

• You see registry modifications such as:
  
  • In subkey: HKLM\software\couponarific
    Sets value: "source"
    With data: "24237908-8269-4cfa-a37d-5ecb2e66dd78"
    
    
  • In subkey: HKLM\software\microsoft\windows\currentversion\uninstall\24237908-8269-4cfa-a37d-5ecb2e66dd78
    Sets value: "DisplayName"
    With data: "couponarific"
    
    

Last update 18 December 2014

 

TOP