{"id":47177,"date":"2016-01-28T13:13:22","date_gmt":"2016-01-28T21:13:22","guid":{"rendered":"https:\/\/blogs.mcafee.com\/?p=47177"},"modified":"2025-06-01T23:24:35","modified_gmt":"2025-06-02T06:24:35","slug":"file-hosting-site-turns-file-adware","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/","title":{"rendered":"File-Hosting Site Turns Your File Into Adware"},"content":{"rendered":"<p>We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer launches a website and then attempts to download an executable\u2014an installer for FLV Player. Nothing out of the ordinary, but what grabbed our attention was the website that had loaded after execution. It appeared\u00a0to be a &#8220;Thanks for installing&#8221; page but the domain name looked odd.<\/p>\n<p>We navigated to the top level of this site and found several subsites.<\/p>\n<p>Clicking through these, we found all of them to be fake pages that\u00a0show users an advertisement to entice them to install another piece of software. This tactic is common with installers for potentially unwanted programs (PUPs), but it is uncommon for one website to have several fake pages.<\/p>\n<p>The common thread is that they all show ads from castplatform.com. A copy of the script used on these pages follows:<\/p>\n<h2>Some of the pages we found were fake landing pages for common applications including:<\/h2>\n<ul>\n<li>VLC Player<\/li>\n<li>CamStudio<\/li>\n<li>FreeRideGames<\/li>\n<li>FileHippoMineCraft Projects<\/li>\n<li>Brothersoft<\/li>\n<\/ul>\n<p>We decided to dive deeper and\u00a0try to find the source of this installer.<\/p>\n<p>This is usually the tricky part when dealing with PUPs due to the different techniques used by the authors. Most PUPs include no company or owner information, no homepage, come only in bundles, and require certain switches for the installer to work.<\/p>\n<p>Our first step was to see if we could find other files that\u00a0connected to these fake landing pages. We soon discovered thousands of these; they all showed similar behavior.<\/p>\n<p>Once we gathered all the samples we knew our best shot was to get a list of all the domains that\u00a0were\u00a0contacted. The logic behind this was to look at the list and see if there was a common domain that appeared\u00a0more frequently than others. It was likely this domain hosted the files.<\/p>\n<p>We found a few common websites that the installers\u00a0contacted, so we began to go through them. A\u00a0couple stood out; these were file upload sites. We assumed these file upload sites bundled the uploaded files with a new installer.<\/p>\n<p>The two sites that gained most of our attention were File-space.org and 100lm.ru. File-space.org made it clear that it was about monetizing.<\/p>\n<p>Here is a snippet from the FAQ page:<\/p>\n<p>Here is how much its users can make:<\/p>\n<p>It works out between \u00a38 and \u00a316 per one thousand downloads.<\/p>\n<p>From reading the FAQ, we seemed to be on the right track. So we signed up to the website and uploaded a file. We then downloaded the uploaded file and found that it was indeed bundled with other applications. However, the behavior was not the same as our customer&#8217;s file. So our search continued for the source of our sample.<\/p>\n<p>Our attention now went to 100lm.ru. This website had no detailed FAQ\/EULA\/Tariff page and no mention of monetization.<\/p>\n<p>What we instantly noticed was a catalog page.<\/p>\n<p>Any file that anyone uploads to the\u00a0site appears on this list. This means that anyone can download files anyone else uploads, even those rated &#8220;not so secure.&#8221; Regardless, we came here to find the source of our PUP installer.<\/p>\n<p>We chose one file to download. As you can see from the following image, this file had been downloaded more than one thousand\u00a0times.<\/p>\n<p>We replicated the file and found the behavior to be exactly the same as our initial sample.<\/p>\n<p>So we downloaded a couple more of these files and we hit the jackpot. Every one we chose\u00a0loaded the fake landing page. We checked the digital signature of the files and they all matched the one in the file we originally received.<\/p>\n<p>Just to double-check, we uploaded our own file and downloaded it. The downloaded file was bundled with other software that loaded the fake landing page when executed.<\/p>\n<p>What is different between the two upload sites is that 100lm.ru <strong>does not<\/strong> inform users that it is bundling; thus that site makes all the pay-per-install (PPI) revenue. This is extremely misleading. Even if a fake landing\u00a0page was not loaded, this behavior would still warrant PUP detection.<\/p>\n<p>Here is a flow of how this PUP spreads:<\/p>\n<p>Our findings show that you have to be very careful when choosing a file-hosting website. We recommend that you use the most popular ones and do a simple check to see if the file you upload is the same as the one that\u00a0you download.<\/p>\n<p>A simple way to do this is to use the command-line tool FC.exe, which is available on every Windows system. It compares two files and will highlight any differences.<\/p>\n<p>Usage: FC.exe &#8220;file1&#8221; &#8220;file2&#8221;<\/p>\n<h2>Malicious domains:<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.mcafee.com\/threat-intelligence\/domain\/default.aspx?domain=Digimatic.biz\" target=\"_blank\" rel=\"noopener noreferrer\">Digimatic.biz<\/a><\/li>\n<li><a href=\"https:\/\/www.mcafee.com\/threat-intelligence\/domain\/default.aspx?domain=100lm.ru\" target=\"_blank\" rel=\"noopener noreferrer\">100lm.ru <\/a><\/li>\n<\/ul>\n<p>Detection for the malicious installer has been added as <a href=\"https:\/\/home.mcafee.com\/VirusInfo\/VirusProfile.aspx?key=9609535#none\" target=\"_blank\" rel=\"noopener noreferrer\">Adware-FakeLand<\/a> and is covered in DAT Version 8055.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon&#8230;<\/p>\n","protected":false},"author":774,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[1814,338,180],"coauthors":[849,854],"class_list":["post-47177","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-computer-security","tag-endpoint-protection","tag-malware"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v25.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>File-Hosting Site Turns Your File Into Adware | McAfee Blog<\/title>\n<meta name=\"description\" content=\"We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"File-Hosting Site Turns Your File Into Adware | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2016-01-28T21:13:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-02T06:24:35+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/wp-content\/uploads\/2501_odmg_img1.jpg\" \/>\n<meta name=\"author\" content=\"Oliver Devane, Mohinder Gill\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oliver Devane, Mohinder Gill\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/\"},\"author\":{\"name\":\"Oliver Devane\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\"},\"headline\":\"File-Hosting Site Turns Your File Into Adware\",\"datePublished\":\"2016-01-28T21:13:22+00:00\",\"dateModified\":\"2025-06-02T06:24:35+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/\"},\"wordCount\":815,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"keywords\":[\"computer security\",\"endpoint protection\",\"malware\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/\",\"name\":\"File-Hosting Site Turns Your File Into Adware | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2016-01-28T21:13:22+00:00\",\"dateModified\":\"2025-06-02T06:24:35+00:00\",\"description\":\"We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"File-Hosting Site Turns Your File Into Adware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a\",\"name\":\"Oliver Devane\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg\",\"caption\":\"Oliver Devane\"},\"description\":\"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"File-Hosting Site Turns Your File Into Adware | McAfee Blog","description":"We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"File-Hosting Site Turns Your File Into Adware | McAfee Blog","og_description":"We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2016-01-28T21:13:22+00:00","article_modified_time":"2025-06-02T06:24:35+00:00","og_image":[{"url":"https:\/\/www.mcafee.com\/wp-content\/uploads\/2501_odmg_img1.jpg","type":"","width":"","height":""}],"author":"Oliver Devane, Mohinder Gill","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"Oliver Devane, Mohinder Gill","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/"},"author":{"name":"Oliver Devane","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a"},"headline":"File-Hosting Site Turns Your File Into Adware","datePublished":"2016-01-28T21:13:22+00:00","dateModified":"2025-06-02T06:24:35+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/"},"wordCount":815,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"keywords":["computer security","endpoint protection","malware"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/","name":"File-Hosting Site Turns Your File Into Adware | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2016-01-28T21:13:22+00:00","dateModified":"2025-06-02T06:24:35+00:00","description":"We recently received a sample from a customer and upon initial analysis it looked like a bundled software installer. Upon execution, the installer","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/file-hosting-site-turns-file-adware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"File-Hosting Site Turns Your File Into Adware"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/f3e79f95122a1e56c0b07811a4f2188a","name":"Oliver Devane","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/145287b0eca301fc80d99baf060dd274","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/Oliver-Devane-96x96.jpg","caption":"Oliver Devane"},"description":"Oliver Devane is currently a Senior Security Researcher at McAfee. He is based in the UK office and has over 10 years of experience analyzing Malware and Potentially Unwanted Programs.","sameAs":["https:\/\/www.linkedin.com\/in\/oliver-devane-1a528749\/"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/oliver-devane\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/47177","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/774"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=47177"}],"version-history":[{"count":4,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/47177\/revisions"}],"predecessor-version":[{"id":214773,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/47177\/revisions\/214773"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=47177"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=47177"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=47177"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=47177"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}