{
  "family": "adaebook",
  "sample_count": 98,
  "category": "adware",
  "description": "AdaEbook (detected across security vendors as Adware:Win32/AdaEbook, PUA:Win32/AdaEbook, and Trojan:Win32/AdaEbook) is a deceptive software bundling framework and adware program active since 2017. Disguised as a free digital book reader, document converter, or PDF viewer, AdaEbook is distributed via third-party software download portals, torrent trackers, and deceptive push notification landing pages. Once executed on an endpoint, AdaEbook silently unpacks background background services and injects tracking scripts into installed web browsers including Google Chrome, Mozilla Firefox, and Microsoft Edge. The adware modifies default browser shortcuts to route search queries through affiliate monetization hubs and injects aggressive banner advertisements, full-screen interstitial pop-ups, and sponsored hyperlinks into visited websites. In addition to degrading system performance and consuming CPU/disk resources, AdaEbook beacons telemetry regarding host hardware, IP geolocation, user browsing history, and search terms to remote advertising servers to tailor invasive promotional campaigns.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/AdaEbook",
    "PUA:Win32/AdaEbook",
    "Trojan:Win32/AdaEbook",
    "Win32/AdaEbook"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/AdaEbook?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "AdaEbook is an adware framework and potentially unwanted application (PUA) disguised as an e-book reader or document viewer that injects intrusive ads into browsers."
      }
    },
    {
      "@type": "Question",
      "name": "How does AdaEbook infect Windows systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled with free software downloads, torrent downloads, cracked installers, and deceptive online document viewer prompts."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does AdaEbook make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser shortcut target paths, alters default search engines, injects intrusive advertisements, and redirects web navigation to affiliate marketing pages."
      }
    },
    {
      "@type": "Question",
      "name": "Does AdaEbook collect private user data?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it monitors browsing activity, search queries, IP addresses, and system hardware specifications to serve targeted advertising."
      }
    },
    {
      "@type": "Question",
      "name": "How should an enterprise or home user remove AdaEbook?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue e-book readers from Control Panel, reset browser shortcuts and settings, remove unfamiliar extensions, and run a complete antimalware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1547.001",
    "T1176",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Adaebook frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Software Bundling",
    "Deceptive Ebook / PDF Download Portals",
    "Torrent Networks"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Redirection",
    "Ad Injection",
    "Shortcut Modification",
    "Telemetry Harvesting",
    "Background Service Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Browser Extension",
      "JavaScript"
    ],
    "network_signatures": [
      "HTTP GET requests with system telemetry to ad-tracking domains",
      "Affiliate redirect chains on browser launch"
    ],
    "evasion_techniques": [
      "Legitimate digital reader masquerading",
      "Bundled installer silent parameters"
    ],
    "persistence_mechanisms": [
      "Registry Run keys in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Modified desktop and taskbar browser shortcuts"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Browser configurations, search privacy, system performance"
  },
  "lineage": {
    "derived_from": [
      "Generic PUA Bundlers"
    ],
    "variants": [
      "AdaEbook.A",
      "AdaEbook.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "8729c1e7a0e5b326d9c668b5a03423fbcda98463989c9e88022b7a95781a7d65"
    ],
    "delivery": [
      "adaebook_setup.exe",
      "free_reader_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AdaEbook",
      "C:\\Users\\Public\\AdaEbook\\reader_svc.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/AdaEbook",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/AdaEbook"
    },
    {
      "name": "Malwarebytes Labs Threat Encyclopedia - PUA.AdaEbook",
      "url": "https://www.malwarebytes.com/threats/adaebook"
    }
  ]
}