» askpip_ff_.exe
Overview
Analysis
File Details
Network (18)

askpip_ff_.exe

Offercast - APN Install Manager

Ask.com

This installer is part of the Ask.com (APN) network which will install the Ask.com branded toolbar or browser extension which will take control of the web browser's search functions. The application askpip_ff_.exe by Ask.com has been detected as a potentially unwanted program by 41 anti-malware scanners. The program is a setup application that uses the Offercast APN Install Manager installer. This version of the installer will bundle the Ask.com Toolbar, a potentially unwanted web browser extension. It is also typically executed from the user's temporary directory.

File name:

askpip_ff_.exe

Publisher:

Ask.com (signed and verified)

Product:

Offercast - APN Install Manager

Version:

2.8.2.1

MD5:

b5b2829b37336bb266b179700398b421

SHA-1:

44554e882d1dd6fbf71b6550b0687e3d9fd73711

SHA-256:

407a42e6267938f738ff9a0e92a318c380fd960095ea2b5eeeb2e5a97bf04481

Scanner detections:

41 / 68

Status:

Potentially unwanted

Explanation:

This is the APN Offercast install manager which will offer the user to opt-out of installing the Ask.com Toolbar as part of the setup routine.

Analysis date:

4/19/2024 10:44:07 PM UTC (today)

Scan engine

Detection

Engine version

Lavasoft Ad-Aware

Win32.Runouce.B@mm

1032

Agnitum Outpost

I-Worm.Chir.B

7.1.1

AhnLab V3 Security

Win32/ChiHack.6652

14.04.09

Avira AntiVirus

W32/Chir.B

7.11.141.48

avast!

Win32:Oncer

2014.9-140409

AVG

Win32/Chir.B@mm

2015.0.3510

Baidu Antivirus

Virus.Win32.Runouce.$a

4.0.3.1449

Bitdefender

Win32.Runouce.B@mm

1.0.20.495

Bkav FE

W32.ChirBPE

1.3.0.4959

Clam AntiVirus

WIN.Worm.Brontok

0.98/18355

Comodo Security

EmailWorm.Win32.Runonce.~v001

18044

Dr.Web

Adware.Downware.1417

9.0.1.0358

Emsisoft Anti-Malware

Win32.Runouce.B@mm

8.14.04.09.12

ESET NOD32

Win32/Bundled.Toolbar.Ask (variant)

7.8809

Fortinet FortiGate

W32/Chir.B@mm

4/9/2014

F-Prot

W32/Thecid.B@mm

v6.4.7.1.166

F-Secure

Win32.Runouce.B@mm

11.2014-09-04_4

G Data

Win32.Runouce.B@mm

14.4.24

herdProtect (fuzzy)

variant of askinstaller.exe (Adware)

2013.12.24.23

IKARUS anti.virus

Email-Worm.Win32.Runouce

t3scan.2.2.29

K7 AntiVirus

EmailWorm

13.176.11652

Kaspersky

Email-Worm.Win32.Runouce

14.0.0.4045

Malwarebytes

PUP.Optional.Spigot.A

v2013.12.24.02

McAfee

W32/Chir.b@MM

5600.7166

Microsoft Security Essentials

Virus:Win32/Chir.B@mm

1.10401

MicroWorld eScan

Win32.Runouce.B@mm

15.0.0.297

NANO AntiVirus

Virus.Win32.Runouce.bxafx

0.28.0.58873

Norman

Malware

11.20140409

nProtect

Win32.Runouce.B@mm

14.04.03.01

Panda Antivirus

W32/Chir.B

14.04.09.12

Qihoo 360 Security

Virus.Win32.CNHacker.C

1.0.0.1015

Quick Heal

W32.Runouce.B

4.14.12.00

Reason Heuristics

PUP.Installer.Ask.K

14.8.8.2

Rising Antivirus

PE:Worm.ChineseHacker-2!23772

23.00.65.14407

Sophos

W32/Chir-A

4.98

Total Defense

Win32/Chir.B

37.0.10856

Trend Micro House Call

PE_Chir.B

7.2.99

Trend Micro

PE_Chir.B

10.465.09

Vba32 AntiVirus

Virus.Win32.Chur.A

3.12.26.0

VIPRE Antivirus

Win32.chir.b

28008

ViRobot

Win32.Chir.B

2011.4.7.4223

File size:

997.9 KB (1,021,872 bytes)

Product version:

2.8.2.1

Original file name:

AskInstaller.exe

File type:

Executable application (Win32 EXE)

Installer:

Offercast APN Install Manager

Language:

English (United States)

Common path:

C:\users\{user}\appdata\local\temp\askpip_ff_.exe

Digital Signature

Signed by:

Ask.com

Authority:

VeriSign, Inc.

Valid from:

6/20/2011 2:00:00 AM

Valid to:

6/19/2014 1:59:59 AM

Subject:

CN=Ask.com, OU=Distribution, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Ask.com, L=Oakland, S=California, C=US

Issuer:

CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:

0965F2AC7236C7E1BDCA44ED139B273A

File PE Metadata

Compilation timestamp:

8/7/2013 3:53:36 PM

OS version:

5.1

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

10.0

CTPH (ssdeep):

24576:e3rZ50o539VSunoJnd87A+fYFu10kAMO+bovGLNfJoIoG:6ZJPtngB+fYFu10kAN6oOLNfboG

Entry address:

0x763C8

Entry point:

E8, 29, EF, 00, 00, E9, 89, FE, FF, FF, 8B, FF, 55, 8B, EC, 83, EC, 20, 8B, 45, 08, 56, 57, 6A, 08, 59, BE, 84, A5, 49, 00, 8D, 7D, E0, F3, A5, 89, 45, F8, 8B, 45, 0C, 5F, 89, 45, FC, 5E, 85, C0, 74, 0C, F6, 00, 08, 74, 07, C7, 45, F4, 00, 40, 99, 01, 8D, 45, F4, 50, FF, 75, F0, FF, 75, E4, FF, 75, E0, FF, 15, E8, 92, 49, 00, C9, C2, 08, 00, 8B, FF, 55, 8B, EC, 8B, 45, 08, 33, C9, 3B, 04, CD, A8, BC, 4B, 00, 74, 13, 41, 83, F9, 2D, 72, F1, 8D, 48, ED, 83, F9, 11, 77, 0E, 6A, 0D, 58, 5D, C3, 8B, 04, CD, AC... 
[+]

Code size:

605.5 KB (620,032 bytes)

The executing file has been seen to make the following network communications in live environments.

TCP (HTTP):

Connects to 199.36.100.103.df.iacapn.com (199.36.100.103:80)

TCP (HTTP):

Connects to a23-50-176-166.deploy.static.akamaitechnologies.com (23.50.176.166:80)

TCP (HTTP):

Connects to a173-223-128-35.deploy.static.akamaitechnologies.com (173.223.128.35:80)

TCP (HTTP):

Connects to a184-29-5-164.deploy.static.akamaitechnologies.com (184.29.5.164:80)

TCP (HTTP):

Connects to a104-113-216-160.deploy.static.akamaitechnologies.com (104.113.216.160:80)

TCP (HTTP):

Connects to a23-67-142-3.deploy.static.akamaitechnologies.com (23.67.142.3:80)

TCP (HTTP):

Connects to a23-206-224-158.deploy.static.akamaitechnologies.com (23.206.224.158:80)

TCP (HTTP):

Connects to a104-93-106-192.deploy.static.akamaitechnologies.com (104.93.106.192:80)

TCP (HTTP):

Connects to a104-121-11-45.deploy.static.akamaitechnologies.com (104.121.11.45:80)

TCP (HTTP):

Connects to 131.subnet180-250-66.speedy.telkom.net.id (180.250.66.131:80)

TCP (HTTP):

Connects to a84-53-185-112.deploy.akamaitechnologies.com (84.53.185.112:80)

TCP (HTTP):

Connects to a23-54-100-209.deploy.static.akamaitechnologies.com (23.54.100.209:80)

TCP (HTTP):

Connects to a104-93-237-224.deploy.static.akamaitechnologies.com (104.93.237.224:80)

TCP (HTTP):

Connects to a23-53-212-214.deploy.static.akamaitechnologies.com (23.53.212.214:80)

TCP (HTTP):

Connects to a23-53-208-160.deploy.static.akamaitechnologies.com (23.53.208.160:80)

TCP (HTTP):

Connects to a23-48-47-27.deploy.static.akamaitechnologies.com (23.48.47.27:80)

TCP (HTTP):

Connects to a104-83-30-48.deploy.static.akamaitechnologies.com (104.83.30.48:80)

TCP (HTTP):

Connects to a104-126-39-120.deploy.static.akamaitechnologies.com (104.126.39.120:80)

Remove askpip_ff_.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.