{
  "family": "convertad",
  "sample_count": 96,
  "category": "adware",
  "description": "ConvertAd (classified by security vendors as Adware:Win32/ConvertAd, PUA:Win32/ConvertAd, and Win32/ConvertAd) is an aggressive adware program and browser monetization framework active since 2016. Often marketed under the guise of free audio, video, or document file format conversion software (such as 'Free MP3 Converter' or 'PDF Conversion Suite'), ConvertAd is distributed through deceptive landing pages, pay-per-install (PPI) software bundlers, and torrent networks. Upon execution, ConvertAd establishes background helper services and registers malicious extensions and browser helper objects across Chrome, Firefox, and Internet Explorer/Edge. The adware forcibly alters browser default search providers and homepages to affiliate redirect portals, hijacking user navigation to monetize query traffic. Additionally, ConvertAd injects intrusive pop-up advertisements, banner promotions, and fraudulent update notices into visited web pages while surreptitiously harvesting web search history, visited URLs, and host system identifiers to transmit to remote advertising syndicates.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/ConvertAd",
    "PUA:Win32/ConvertAd",
    "Win32/ConvertAd",
    "Adware.ConvertAd"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/ConvertAd?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ConvertAd is an adware family masquerading as a media or document format converter that hijacks browser settings and serves intrusive advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How does ConvertAd reach victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It spreads bundled inside free media converter installers, cracked software packages, and deceptive file-sharing sites."
      }
    },
    {
      "@type": "Question",
      "name": "What symptoms indicate a ConvertAd infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Persistent browser redirects, altered default search engines, unexpected pop-up ads, and sluggish web browsing performance."
      }
    },
    {
      "@type": "Question",
      "name": "Does ConvertAd track user browsing behavior?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it tracks visited web pages, search queries, IP addresses, and operating system data to serve targeted promotional advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remove ConvertAd from Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall unfamiliar converter apps from Programs and Features, reset browser settings to default, remove rogue extensions, and run a full antimalware cleanup."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1566.002",
    "T1189",
    "T1547.001",
    "T1176",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog scheduled tasks.",
    "Audit Windows Group Policies to remove any forced extension installation policies created by the adware.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore legitimate search engines."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Convertad frequently uses scheduled tasks to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Adware Revenue",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Software Bundlers",
    "Deceptive Media Converter Websites",
    "Freeware Download Repositories"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Search Engine Hijacking",
    "Ad Injection",
    "Browser Redirection",
    "Telemetry Collection",
    "Background Service Maintenance"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 EXE",
      "Browser Extension",
      "DLL"
    ],
    "network_signatures": [
      "HTTP search redirects to syndicated ad-revenue gateways",
      "Periodic telemetry check-ins posting browser activity"
    ],
    "evasion_techniques": [
      "Deceptive converter interface with working minimal functions",
      "Silent background installation arguments"
    ],
    "persistence_mechanisms": [
      "Registry Run keys in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
      "Scheduled Task launching updater at system startup"
    ]
  },
  "impact": {
    "confidentiality": "Low",
    "integrity": "Medium",
    "availability": "Low",
    "scope": "Web browsing integrity, search privacy, system responsiveness"
  },
  "lineage": {
    "derived_from": [
      "Commercial Software Bundlers"
    ],
    "variants": [
      "ConvertAd.A",
      "ConvertAd.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7b6c5d4e3f2a1b0c9d8e7f6a5b",
      "1f2e3d4c5b6a7f8e9d0c1b2a3f4e5d6c7b8a9f0e1d2c3b4a5f6e7d8c9b0a1f2e"
    ],
    "delivery": [
      "media_converter_setup.exe",
      "convertad_installer.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ConvertAdUpdate",
      "C:\\Program Files (x86)\\ConvertAd\\convertad_service.exe"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Adware:Win32/ConvertAd",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/ConvertAd"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.ConvertAd",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/adware.win32.convertad"
    }
  ]
}