home

APNMCP.exe

APN Updater

APN LLC

This is a component of the Ask.com toolbar, a browser extension that will modify the default web browser's search provider, home page and various other settings. The application APNMCP.exe by APN has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It runs as a separate (within the context of its own process) windows Service named “Ask Update Service”. While running, it connects to the Internet address www.search.ask.com on port 80 using the HTTP protocol.
Publisher:
APN LLC.  (signed by APN LLC)

Product:
APN Updater

Version:
21.23.0.8342

MD5:
b02dd0017b322894c6d64ac29fb2634c

SHA-1:
726c4638a61439cdeea880c959fad1a0791c7406

SHA-256:
a926969682008290c24c43cd6ae4b0c7577a604bd975f0337c865f24635dc62c

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
5/5/2024 9:11:18 AM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.Ask (M)
17.3.12.14

File size:
197.6 KB (202,304 bytes)

Product version:
21.23.0.8342

Copyright:
© 2016 APN, LLC. All Rights Reserved.

Original file name:
APNMCP.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\Program Files\askpartnernetwork\toolbar\apnmcp.exe

Digital Signature
Signed by:
APN LLC

Authority:
Symantec Corporation

Valid from:
11/9/2016 1:00:00 AM

Valid to:
5/28/2018 1:59:59 AM

Subject:
CN=APN LLC, O=APN LLC, L=Oakland, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
68C47F5E2060C71C80910906B06BBB93

File PE Metadata
Compilation timestamp:
11/15/2016 8:43:28 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

Entry address:
0x1260D

Entry point:
E8, E5, 74, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 8B, 4D, 0C, 53, 33, DB, 3B, CB, 76, 1B, 6A, E0, 33, D2, 58, F7, F1, 3B, 45, 10, 73, 0F, E8, 2D, 03, 00, 00, C7, 00, 0C, 00, 00, 00, 33, C0, EB, 41, 0F, AF, 4D, 10, 56, 57, 8B, F1, 39, 5D, 08, 74, 0B, FF, 75, 08, E8, F8, 52, 00, 00, 59, 8B, D8, 56, FF, 75, 08, E8, 30, 75, 00, 00, 8B, F8, 59, 59, 85, FF, 74, 14, 3B, DE, 73, 10, 2B, F3, 56, 6A, 00, 03, DF, 53, E8, 45, E5, FF, FF, 83, C4, 0C, 8B, C7, 5F, 5E, 5B, 5D, C3, 6A, 0C, 68, 68, A1, 42, 00, E8...
 
[+]

Entropy:
6.3497

Code size:
131 KB (134,144 bytes)

Service
Display name:
Ask Update Service

Service name:
APNMCP

Description:
The Ask Update Service keeps your toolbar software powered by Ask up to date.

Type:
Win32OwnProcess


The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):
Connects to www.search-results.com  (66.235.120.111:80)

TCP (HTTP):
Connects to www.search.ask.com  (23.76.222.3:80)

TCP (HTTP):
Connects to websearch.search-results.com  (199.36.100.106:80)

 
http://websearch.search-results.com/redirect?client=ff&src=kw&tb=GET-SRS&o=629225855&locale=us_ZZ&apn_uid=1887693267&apn_ptnrs=2R&apn_sauid=1258462178&apn_dtid=get001YYPT&q=

TCP (HTTP):
Connects to ss.websearch.ask.com  (174.129.25.170:80)

Remove APNMCP.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.