Home Malware Programs Adware PacFunction

PacFunction

Posted: February 3, 2014

Threat Metric

Ranking: 12,358
Threat Level: 2/10
Infected PCs: 3,438
First Seen: February 3, 2014
Last Seen: October 14, 2023
OS(es) Affected: Windows


PacFunction is adware that may display annoying pop-up ads, banners and messages on a screen of a computer system. PacFunction may affect all the well-known Web browsers installed on the PC including Google Chrome, Mozilla Firefox and Internet Explorer, installed on the PC and show unwanted pop-up ads on every website the PC user visits. The pop-up advertisements and banners of PacFunction may be related to the computer user's latest online searches or content of the website. PacFunction may substitute search results in any major search provider with sponsored links that may carry a variety of pop-up advertisements. Search results modified and given by PacFunction in popular search engines may forcibly reroute computer users to questionable websites, which may be commercial and offer misleading products or services. PacFunction may proliferate and infiltrate into the PC through bundled free applications that computer users can download from questionable download websites on the Internet. The main goal of PacFunction may be to generate advertising revenue from clicks on pop-up advertisements and raised traffic of an unknown website that may cover the screen of the PC with commercial ads and messages.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%PROGRAMFILES%\PacFunction\PacFunction.FirstRun.exe File name: PacFunction.FirstRun.exe
Size: 1.75 MB (1757472 bytes)
MD5: cffaed43e6697317d9aca2d26e10729b
Detection count: 77
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\PacFunction
Group: Malware file
Last Updated: April 4, 2014
%PROGRAMFILES%\PacFunction\bin\utilPacFunction.exe File name: utilPacFunction.exe
Size: 350.49 KB (350496 bytes)
MD5: 65b8df52f27bd4d0d98f7cf4da4095fb
Detection count: 53
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\PacFunction\bin
Group: Malware file
Last Updated: April 4, 2014
%PROGRAMFILES%\PacFunction\PacFunction.FirstRun.exe File name: PacFunction.FirstRun.exe
Size: 1.75 MB (1756960 bytes)
MD5: 5a6879f27219d194da8141ca0445bd41
Detection count: 37
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\PacFunction
Group: Malware file
Last Updated: April 4, 2014
%PROGRAMFILES(x86)%\PacFunction\bin\utilPacFunction.exe File name: utilPacFunction.exe
Size: 348.44 KB (348448 bytes)
MD5: d1b041d738408bf6e14c290c60a62a08
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES(x86)%\PacFunction\bin
Group: Malware file
Last Updated: April 4, 2014
%PROGRAMFILES%\PacFunction\PacFunction.FirstRun.exe File name: PacFunction.FirstRun.exe
Size: 1.75 MB (1756960 bytes)
MD5: 22b002c0fa446ca9b3813c3a34879fea
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\PacFunction
Group: Malware file
Last Updated: April 4, 2014

Registry Modifications

The following newly produced Registry Values are:

CLSID{74B52F4F-B4A9-46F0-ACAE-C5A97AABA21C}{9aa72d95-59d7-4421-a02c-f93a1187a165}{CA8E19DE-A0A6-461D-9B40-F67B6D299CC9}{FA38D168-7DA3-4F0C-8CC0-75A6424113DC}HKEY..\..\..\..{RegistryKeys}Software\Microsoft\Internet Explorer\Approved Extensions\{3983585E-5D14-4D1D-A257-35B0D52F2DFC}Software\Microsoft\Internet Explorer\Approved Extensions\{9AA72D95-59D7-4421-A02C-F93A1187A165}SOFTWARE\Microsoft\Tracing\PacFunction_RASAPI32SOFTWARE\Microsoft\Tracing\PacFunction_RASMANCSSOFTWARE\Microsoft\Tracing\updatePacFunction_RASAPI32SOFTWARE\Microsoft\Tracing\updatePacFunction_RASMANCSSOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9aa72d95-59d7-4421-a02c-f93a1187a165}Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{9AA72D95-59D7-4421-A02C-F93A1187A165}Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9AA72D95-59D7-4421-A02C-F93A1187A165}Software\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{9aa72d95-59d7-4421-a02c-f93a1187a165}SOFTWARE\PacFunctionSOFTWARE\Wow6432Node\Microsoft\Tracing\PacFunction_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\PacFunction_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Tracing\updatePacFunction_RASAPI32SOFTWARE\Wow6432Node\Microsoft\Tracing\updatePacFunction_RASMANCSSOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9aa72d95-59d7-4421-a02c-f93a1187a165}SOFTWARE\Wow6432Node\PacFunctionSYSTEM\ControlSet001\services\eventlog\Application\Update PacFunctionSYSTEM\ControlSet001\services\Update PacFunctionSYSTEM\ControlSet002\services\eventlog\Application\Update PacFunctionSYSTEM\ControlSet002\services\Update PacFunctionSYSTEM\CurrentControlSet\services\eventlog\Application\Update PacFunctionSYSTEM\CurrentControlSet\services\Update PacFunctionHKEY_LOCAL_MACHINE\Software\[APPLICATION]\Microsoft\Windows\CurrentVersion\Uninstall..{Uninstaller}PacFunction

Additional Information

The following directories were created:
%PROGRAMFILES%\PacFunction%PROGRAMFILES(x86)%\PacFunction
The following URL's were detected:
PacFunction
Loading...