{"id":40064,"date":"2014-12-16T12:42:32","date_gmt":"2014-12-16T20:42:32","guid":{"rendered":"http:\/\/blogs.mcafee.com\/?p=40064"},"modified":"2025-06-02T01:26:21","modified_gmt":"2025-06-02T08:26:21","slug":"installcube-how-russian-programmers-turn-adware-into-cash","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/","title":{"rendered":"InstallCube: How Russian Programmers Turn Adware Into Cash"},"content":{"rendered":"<p>We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of them try to make easy money by deceiving users. McAfee categorizes such apps as potentially unwanted program (PUPs). Here&#8217;s a look at a recently discovered Russian-based campaign that is very well organized.<\/p>\n<h2>The Flow of Campaign<\/h2>\n<p>We can summarize the flow of campaign with this flowchart:<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\"><img loading=\"lazy\" decoding=\"async\" class=\"wp-image-40169 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\" alt=\"\" width=\"548\" height=\"602\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png 597w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last-273x300.png 273w\" sizes=\"auto, (max-width: 548px) 100vw, 548px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>We came across one of the many sites that are part of this campaign. This site promises to give users pirated keys for various antimalware software so that they can use AV products for free.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/22.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40051 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/22.jpg\" alt=\"2\" width=\"604\" height=\"78\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/22.jpg 604w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/22-300x38.jpg 300w\" sizes=\"auto, (max-width: 604px) 100vw, 604px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Wrapped website.<\/strong><\/p>\n<p style=\"text-align: center;\"><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/31.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-40052\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/31.jpg\" alt=\"3\" width=\"453\" height=\"202\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/31.jpg 453w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/31-300x133.jpg 300w\" sizes=\"auto, (max-width: 453px) 100vw, 453px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Wrapped RAR file download button.<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>The keys are offered in a RAR file that is available on the site. However, we found this to be an adware executable with the name sample.rar.exe, which has a RAR icon to misguide users into thinking the file is an archive instead of an executable. One click by the user, and the adware is executed.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/4.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40053 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/4.jpg\" alt=\"4\" width=\"425\" height=\"202\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/4.jpg 425w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/4-300x142.jpg 300w\" sizes=\"auto, (max-width: 425px) 100vw, 425px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Icon resource of executable posing as a RAR file.<\/strong><\/p>\n<p>After executing, the sample first reports a confirmation to the back-end server of InstallCube (cubinapi.com) with a unique load ID. The load ID comes from an algorithm that generates a number from the composition of range 0-9 and a-f. Each character of the key is generated using a different algorithm.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/5.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40054 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/5.jpg\" alt=\"5\" width=\"225\" height=\"332\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/5.jpg 225w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/5-203x300.jpg 203w\" sizes=\"auto, (max-width: 225px) 100vw, 225px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Fragment of algorithm to generate the key.<\/strong><\/p>\n<p style=\"text-align: left;\"><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/6.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40055 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/6.jpg\" alt=\"6\" width=\"520\" height=\"184\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/6.jpg 520w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/6-300x106.jpg 300w\" sizes=\"auto, (max-width: 520px) 100vw, 520px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Generated post key.<\/strong><\/p>\n<p>This unique count helps determine how far the ads spread and eventually is converted to cash.<\/p>\n<p>After loading the execution stat, the executable opens a page in Internet Explorer that has a big green download button and small download link. If the button is clicked, it will lead to two possible downloads: Either a big file (10MB-20MB) or a small executable (less than 1.5MB), which is the ad-producing software. Refreshing the same link will lead to various files being downloaded.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/7.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40056 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/7.jpg\" alt=\"7\" width=\"604\" height=\"267\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/7.jpg 604w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/7-300x132.jpg 300w\" sizes=\"auto, (max-width: 604px) 100vw, 604px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Bundle download button.<\/strong><\/p>\n<p>The big file is Trash.exe and pretty much justifies its name. This is a simple application made in Visual C++ and its only function is to display a dialogue reading \u201cTrash Project, Version 1.0.\u201d The likely use for such a big file is to create traffic to certain sites.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/8.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40057 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/8.jpg\" alt=\"8\" width=\"575\" height=\"219\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/8.jpg 575w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/8-300x114.jpg 300w\" sizes=\"auto, (max-width: 575px) 100vw, 575px\" \/><\/a><\/p>\n<p style=\"text-align: center;\"><strong>Trash.exe file.<\/strong><\/p>\n<p>In the following chart we can see the conversion of ads into cash:<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40058 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/9.jpg\" alt=\"9\" width=\"369\" height=\"284\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/9.jpg 369w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/9-300x230.jpg 300w\" sizes=\"auto, (max-width: 369px) 100vw, 369px\" \/><\/p>\n<p style=\"text-align: center;\"><strong>The money flow.<\/strong><\/p>\n<p>We tried to register our account on InstallCube, which promised us that our software would be wrapped in a packer and installed to a number of users. However, to start the campaign they demanded at least 2000 rubles.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/10.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40059 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/10.jpg\" alt=\"10\" width=\"602\" height=\"226\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/10.jpg 602w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/10-300x112.jpg 300w\" sizes=\"auto, (max-width: 602px) 100vw, 602px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><strong>Installcube demanding payment from advertisers.<\/strong><\/p>\n<p>If the webmasters host only the deceptive adware and not useful files, traffic to their sites will decline because of unsatisfied customers. In this following chart we see this issue addressed by a webmaster, demonstrating the drop in traffic after the adware was hosted on his site.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/11.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40060 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/11.jpg\" alt=\"11\" width=\"602\" height=\"322\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/11.jpg 602w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/11-300x160.jpg 300w\" sizes=\"auto, (max-width: 602px) 100vw, 602px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: center;\"><strong>Graph showing amount of views (blue) and visitors (green).<\/strong><\/p>\n<p>As a result, sites host the adware for a only short time, and periodically remove it so that the reputation of the site remains good. The adware executables on this site are also briefly hosted and are frequently replaced by useful files.<\/p>\n<p>InstallCube is not the only organization profiting from this campaign. The webmasters who host misleading software are also making quick money by using InstallCube. In the following Russian blog we found a discussion among webmasters about how to use this software to make money.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/12.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-40061 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/12.jpg\" alt=\"12\" width=\"602\" height=\"173\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/12.jpg 602w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/12-300x86.jpg 300w\" sizes=\"auto, (max-width: 602px) 100vw, 602px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>Showing ads is not always bad behavior, but in this case two breaches make this campaign unethical. First is the deception of making an executable appear as an archive, and second there is no mention of the ads (such as an End User License Agreement). Users are given no options and become victims of the ad campaign as soon as they click the fake executable.<\/p>\n<p>Such ads and force-fed bundled software are not malware, but they can annoy users and also take up a chunk of their bandwidth.<\/p>\n<p>McAfee has blacklisted the InstallCube site and the back-end tracking service.<\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/13.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-40062 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/13.jpg\" alt=\"13\" width=\"482\" height=\"188\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/13.jpg 595w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/13-300x116.jpg 300w\" sizes=\"auto, (max-width: 482px) 100vw, 482px\" \/><\/a><\/p>\n<p><a href=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/14.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\" wp-image-40063 aligncenter\" src=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/14.jpg\" alt=\"14\" width=\"480\" height=\"191\" srcset=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/14.jpg 621w, https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/14-300x119.jpg 300w\" sizes=\"auto, (max-width: 480px) 100vw, 480px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p style=\"text-align: left;\">We also offer generic coverage of ad-producing executables as PUP-FSP, PUP-FRP, PUP-FQL, and PUP-FPA.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but&#8230;<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,338],"coauthors":[3973],"class_list":["post-40064","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-endpoint-protection"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>InstallCube: How Russian Programmers Turn Adware Into Cash | McAfee Blog<\/title>\n<meta name=\"description\" content=\"We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"InstallCube: How Russian Programmers Turn Adware Into Cash | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2014-12-16T20:42:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-02T08:26:21+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\" \/>\n\t<meta property=\"og:image:width\" content=\"597\" \/>\n\t<meta property=\"og:image:height\" content=\"656\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"InstallCube: How Russian Programmers Turn Adware Into Cash\",\"datePublished\":\"2014-12-16T20:42:32+00:00\",\"dateModified\":\"2025-06-02T08:26:21+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/\"},\"wordCount\":705,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\",\"keywords\":[\"computer security\",\"endpoint protection\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/\",\"name\":\"InstallCube: How Russian Programmers Turn Adware Into Cash | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\",\"datePublished\":\"2014-12-16T20:42:32+00:00\",\"dateModified\":\"2025-06-02T08:26:21+00:00\",\"description\":\"We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"InstallCube: How Russian Programmers Turn Adware Into Cash\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"InstallCube: How Russian Programmers Turn Adware Into Cash | McAfee Blog","description":"We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"InstallCube: How Russian Programmers Turn Adware Into Cash | McAfee Blog","og_description":"We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2014-12-16T20:42:32+00:00","article_modified_time":"2025-06-02T08:26:21+00:00","og_image":[{"width":597,"height":656,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"InstallCube: How Russian Programmers Turn Adware Into Cash","datePublished":"2014-12-16T20:42:32+00:00","dateModified":"2025-06-02T08:26:21+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/"},"wordCount":705,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png","keywords":["computer security","endpoint protection"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/","name":"InstallCube: How Russian Programmers Turn Adware Into Cash | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage"},"thumbnailUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png","datePublished":"2014-12-16T20:42:32+00:00","dateModified":"2025-06-02T08:26:21+00:00","description":"We often observe applications bundled with ad-displaying programs to generate revenue for those products. These are not necessarily unethical, but some of","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#primaryimage","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/last.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/installcube-how-russian-programmers-turn-adware-into-cash\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"InstallCube: How Russian Programmers Turn Adware Into Cash"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/40064","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=40064"}],"version-history":[{"count":3,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/40064\/revisions"}],"predecessor-version":[{"id":214819,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/40064\/revisions\/214819"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=40064"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=40064"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=40064"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=40064"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}