» acerace_setup.exe
Overview
Analysis
File Details
Network (3)

acerace_setup.exe

Ace Race

This is the installer/setup program for a Yontoo adware component, a web browser plugin that injects unwanted ads in the browser. The application acerace_setup.exe by Ace Race has been detected as adware by 26 anti-malware scanners. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It will plug into the web browser and display context-based advertisements by overwriting existing ads or by inserting new ones on various web pages. It is also typically executed from the user's temporary directory. While running, it connects to the Internet address api.yontoo.com on port 80 using the HTTP protocol.

File name:

acerace_setup.exe

Publisher:

Ace Race (signed and verified)

MD5:

e682e99a1d8ec4a16f9bee04e604ba03

SHA-1:

1095c5f2717c17502eaf3c56c68b718f27ab992f

SHA-256:

0c137aa218ff9cd538542f7963d3065dbdc88edea383cf90a1f796c0484f7972

Scanner detections:

26 / 68

Status:

Adware

Explanation:

Injects advertising in the web browser in various formats.

Analysis date:

4/24/2024 10:34:12 AM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Adware.BrowseFox.BB

6648196

AhnLab V3 Security

Win-PUP/BrowseFox.Gen

2015.03.02

Avira AntiVirus

ADWARE/BrowseFox.Gen

7.11.213.12

AVG

Could be an adware BrowseFox

2014.0.4253

Baidu Antivirus

Adware.Win32.BrowseFox

4.0.3.1532

Bitdefender

Adware.BrowseFox.BB

1.0.20.305

Dr.Web

Trojan.Yontoo.474

9.0.1.05190

Emsisoft Anti-Malware

Adware.BrowseFox.BB

9.0.0.4799

ESET NOD32

Win32/BrowseFox.C potentially unwanted

9.11252

Fortinet FortiGate

Adware/BrowseFox

3/2/2015

F-Prot

W32/S-26365c9e

v6.4.7.1.166

F-Secure

Adware.BrowseFox.BB

5.13.68

G Data

Adware.BrowseFox.BB

15.3.25

K7 AntiVirus

Unwanted-Program

13.1915121

Malwarebytes

PUP.Optional.AceRace.A

v2015.03.02.01

McAfee

Program.BrowseFox-FTQ

16.8.708.2

MicroWorld eScan

Adware.BrowseFox.BB

16.0.0.183

NANO AntiVirus

Trojan.Nsis.BrowseFox.dnxihk

0.30.0.296

nProtect

Adware.BrowseFox.BB

15.02.27.01

Qihoo 360 Security

Win32/Virus.Adware.80e

1.0.0.1015

Reason Heuristics

PUP.Installer.Yontoo

15.3.2.1

Rising Antivirus

NS:PUF.SilenceInstaller!1.9DDF

23.00.65.15228

Sophos

Generic PUA ND

4.98

Trend Micro House Call

Suspici.83CCD372

7.2.61

Trend Micro

TROJ_GE.A593B09A

10.465.02

VIPRE Antivirus

Threat.5061968

37788

File size:

719.6 KB (736,824 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Common path:

C:\users\{user}\appdata\local\temp\{random}.tmp\acerace_setup.exe

Digital Signature

Signed by:

Ace Race

Authority:

VeriSign, Inc.

Valid from:

10/6/2014 7:00:00 PM

Valid to:

10/7/2015 6:59:59 PM

Subject:

CN=Ace Race, O=Ace Race, L=Santa Monica, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

47DF877938071D6194F321723076892E

File PE Metadata

Compilation timestamp:

12/5/2009 4:52:01 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

12288:vmfS5GexIAFO1s15Ap/G/8SwfkOmo93Q1cjhBTyqPBCdh+Du1tAs4LHzS:vsyrIA06j8rkcjh8+mh+Det14LTS

Entry address:

0x30CB

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 38, 6F, 44, 00, E8, F1, 2B, 00, 00, A3, 84, 6E, 44, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 30, 9C, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 80, 2E, 44, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, F0, 46, 00, 50, 57, E8, 92, 28, 00, 00... 
[+]

Entropy:

7.9855

Packer / compiler:

Nullsoft install system v2.x

Code size:

22.5 KB (23,040 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to wac.edgecastcdn.net (72.21.81.13:80)

TCP (HTTP):

Connects to service.yontoo.com (8.25.35.148:80)

TCP (HTTP):

Connects to api.yontoo.com (8.25.35.15:80)

Remove acerace_setup.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.