home

afrqrco.exe

Crime Watch

Mathematical Applications

This is part of an adware program designed to inject advertising in the web browser (banners, text-links) as well as modify the normal behavior of the browser. Part of the Injekt brand of unwanted programs. The application afrqrco.exe, “CrimeWatch Service” by Mathematical Applications has been detected as adware by 16 anti-malware scanners. It runs as a separate (within the context of its own process) windows Service named “AFRQrCo”. According to AVG, this software downloads additional adware offers during setup.
Publisher:
Mathematical Applications  (signed and verified)

Product:
Crime Watch

Description:
CrimeWatch Service

Version:
1.0.0.0

MD5:
185a8cae02d9a8da1c626959426ac18d

SHA-1:
994e42809fcc956729f16a21337a1fbd393501a9

SHA-256:
b57926dcb34db32736eae2f155540d484c5bb85c164ff45e2097df3e72e54f00

Scanner detections:
16 / 68

Status:
Adware

Explanation:
Injects display ads (banner ads), in-text ads, interstitial ads, or other types of ads in the web browser as well as alters the browsers settings (home page, search, DNS, and security protocols).

Analysis date:
4/26/2024 3:36:40 PM UTC  (today)

Scan engine
Detection
Engine version

Lavasoft Ad-Aware
Gen:Variant.Adware.Jatif.92
734

Avira AntiVirus
ADWARE/Adware.Gen7
7.11.205.246

avast!
MSIL:Adware-G [PUP]
2014.9-150201

AVG
Downloader
2016.0.3212

Baidu Antivirus
Adware.MSIL.PullUpdate
4.0.3.1521

Bitdefender
Gen:Variant.Adware.Jatif.92
1.0.20.160

Comodo Security
ApplicUnwnt
20898

Dr.Web
Adware.Yontoo.55
9.0.1.032

Emsisoft Anti-Malware
Gen:Variant.Adware.Jatif.92
8.15.02.01.05

ESET NOD32
MSIL/Adware.PullUpdate.G.gen (variant)
9.11097

F-Secure
Gen:Variant.Adware.Jatif.92
11.2015-01-02_1

G Data
Gen:Variant.Adware.Jatif.92
15.2.25

Malwarebytes
PUP.Optional.CrimeWatch.A
v2015.02.01.05

MicroWorld eScan
Gen:Variant.Adware.Jatif.92
16.0.0.96

Qihoo 360 Security
HEUR/QVM03.0.Malware.Gen
1.0.0.1015

Reason Heuristics
PUP.Service.Injekt
15.2.1.5

File size:
2.6 MB (2,734,352 bytes)

Product version:
1.0.0.0

Copyright:
Copyright © Mathematical Applications 2015

Original file name:
CrimeWatchService.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\ProgramData\ogblcop\afrqrco.exe

Digital Signature
Signed by:
Mathematical Applications

Authority:
VeriSign, Inc.

Valid from:
10/27/2014 1:00:00 AM

Valid to:
10/28/2015 12:59:59 AM

Subject:
CN=Mathematical Applications, O=Mathematical Applications, L=St. James, S=St. James, C=BB

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
79F6406432970C77D2FA7772E5EB6BDC

File PE Metadata
Compilation timestamp:
1/29/2015 6:14:27 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
11.0

.NET CLR dependent:
Yes

CTPH (ssdeep):
49152:BURcdyW+S/XvQIPPCzVh0C8NKn4/Qe1G7SyHc/263q5YnHm6:BUWp/Xvj2F4cu8D63qeH

Entry address:
0x29B55E

Entry point:
FF, 25, 00, 20, 40, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00, 00...
 
[+]

Developed / compiled with:
Microsoft Visual C# / Basic .NET

Code size:
2.6 MB (2,725,376 bytes)

Service
Display name:
AFRQrCo

Type:
Win32OwnProcess

Depends on:
Winmgmt CryptSvc


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to ec2-54-171-226-204.eu-west-1.compute.amazonaws.com  (54.171.226.204:80)

TCP (HTTP):
Connects to ec2-54-246-181-97.eu-west-1.compute.amazonaws.com  (54.246.181.97:80)

TCP (HTTP):
Connects to ec2-54-171-43-206.eu-west-1.compute.amazonaws.com  (54.171.43.206:80)

TCP (HTTP):
Connects to ec2-52-16-174-255.eu-west-1.compute.amazonaws.com  (52.16.174.255:80)

Remove afrqrco.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.