{
  "family": "airinstaller",
  "sample_count": 26,
  "category": "adware",
  "description": "AirInstaller (cataloged across endpoint security vendors under signatures including SoftwareBundler:Win32/AirInstaller, PUA:Win32/AirInstaller, and Adware:Win32/AirInstaller) is a prominent commercial software monetization framework and deceptive installer wrapper active since 2012. Commonly repackaged around legitimate open-source and freeware utilities (such as VLC media player, 7-Zip, or PDF readers) on third-party download portals, AirInstaller wraps the genuine application inside a multi-offer advertising installation pipeline. It connects to dynamic ad-server APIs to fetch real-time payloads based on victim geo-IP location, silently dropping search hijackers, adware toolbars, and cryptocurrency miners. AirInstaller creates persistent scheduled tasks, injects registry autoruns, and modifies browser shortcuts to sustain perpetual advertising revenue.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "SoftwareBundler:Win32/AirInstaller",
    "PUA:Win32/AirInstaller",
    "Adware:Win32/AirInstaller",
    "Win32/AirInstaller",
    "AirInstaller Bundler"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is SoftwareBundler:Win32/AirInstaller?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "AirInstaller is a deceptive software bundler framework that wraps free programs to silently install adware, search hijackers, and PUPs."
      }
    },
    {
      "@type": "Question",
      "name": "Why is AirInstaller bundled with legitimate programs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Unscrupulous download websites wrap legitimate freeware in AirInstaller to monetize free downloads on a Pay-Per-Install (PPI) model."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads are dropped by AirInstaller?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It delivers unwanted browser extensions, fake system optimizers, search-hijacking toolbars, and intrusive adware programs."
      }
    },
    {
      "@type": "Question",
      "name": "How does AirInstaller determine which offers to install?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It sends the victim's IP and system hardware configuration to dynamic ad servers to receive customized, targeted software offers."
      }
    },
    {
      "@type": "Question",
      "name": "How do you clean an AirInstaller compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall rogue applications via Windows Control Panel, reset browser extensions, and run a comprehensive scan with Microsoft Defender."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1176",
    "T1059.007",
    "T1112",
    "T1071.001",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Download Portals",
    "Repackaged Open-Source Software",
    "Malvertising Search Engine Ads"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Dynamic Real-Time Payload Delivery",
    "Deceptive Opt-In Dialog Generation",
    "Browser Configuration & Extension Modification",
    "Registry Autostart & Service Persistence",
    "Host Hardware & Geo-IP Profiling"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Installer Stub)",
      "Temporary Binary Cache (.tmp)"
    ],
    "network_signatures": [
      "Outbound HTTP POST requests to monetization API servers reporting installation progress and user offer selections",
      "HTTP GET requests downloading secondary setup files disguised as zip archives or cabinet files"
    ],
    "evasion_techniques": [
      "Displaying fine-print disclosures in tiny or low-contrast text to bypass regulatory deceptive advertising standards",
      "Running headless background processes to download secondary installers silently"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "37d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
      "48e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AirInstaller",
      "HKCU\\Software\\AirInstaller"
    ],
    "file_paths": [
      "%ProgramFiles%\\AirInstaller\\airinstaller.exe",
      "%AppData%\\AirInstaller\\offers.xml",
      "%LocalAppdata%\\Temp\\air_drop.exe"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) protection in Microsoft Defender Antivirus",
    "Mandate downloading software solely from verified vendor official websites or enterprise app stores",
    "Block outbound network traffic to known advertising monetization networks and PPI distribution hosts"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - SoftwareBundler:Win32/AirInstaller",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=SoftwareBundler:Win32/AirInstaller"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PUA.Win32.AirInstaller",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "SoftwareBundler:Win32/AirInstaller.A",
      "PUA:Win32/AirInstaller.gen"
    ]
  },
  "motivation": "Commercial Monetization, PPI Fraud & Aggressive Adware Distribution",
  "sample_hashes": []
}