{
  "family": "pincav",
  "sample_count": 35,
  "category": "adware",
  "description": "Pincav (cataloged across antivirus vendors under signatures including Adware:Win32/Pincav, PUA:Win32/Pincav, and Adware.Pincav) is an aggressive adware and software bundling framework active since 2014. Distributed primarily through third-party freeware download mirrors, pirated media packages, and deceptive file-conversion utilities, Pincav integrates deeply into the host Windows environment. Once installed, Pincav registers persistent autostart services and hooks major web browsers (including Google Chrome, Mozilla Firefox, and Microsoft Edge). It modifies browser shortcuts, overrides default search engines, injects unsolicited affiliate banner advertisements and sponsored links directly into search results, and redirects browsing sessions to high-risk advertising syndication networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Pincav",
    "PUA:Win32/Pincav",
    "Trojan.Win32.Pincav",
    "Win32/Pincav",
    "Adware.Pincav",
    "Adware:Win32/Pincav.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Pincav?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pincav is an aggressive adware family that injects advertisements, redirects search queries, and modifies browser shortcuts on Windows systems."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pincav hijack web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser desktop shortcut targets (.lnk) and alters search engine configuration registry keys to forcefully direct users to affiliate ad portals."
      }
    },
    {
      "@type": "Question",
      "name": "What symptoms indicate a Pincav infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Unsolicited pop-up banners, altered search results featuring sponsored links, sluggish browser performance, and unauthorized homepage changes."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pincav spread to computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled within free utility installers, pirated media software, and fake video player updates on file-sharing sites."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Pincav adware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Uninstall suspicious software from Windows Settings, restore original browser shortcut targets, reset browser preferences to default, and execute a full malware scan."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1547.001",
    "T1185",
    "T1036.005",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Installers",
    "Torrent Media Bundles",
    "Fake Video Codec Prompts"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Browser Shortcut Modification",
    "Search Query Redirection",
    "In-Page Banner & Pop-up Ad Injection",
    "Telemetry Exfiltration to Ad Servers",
    "Windows Background Service Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET requests fetching external JavaScript injection payloads from rotating adware domains",
      "HTTP POST pings transmitting client browser version, default search engine, and location metadata"
    ],
    "evasion_techniques": [
      "Modifying Windows browser shortcut files (.lnk) to append redirect arguments, avoiding direct browser binary patching",
      "Restoring altered browser homepage registry keys if modified by the user"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f",
      "6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PincavService",
      "HKLM\\Software\\Pincav"
    ],
    "file_paths": [
      "%ProgramFiles%\\Pincav\\pincav.exe",
      "%AppData%\\Pincav\\pincav_hook.dll",
      "%Temp%\\pincav_setup.exe"
    ]
  },
  "defensive_measures": [
    "Enforce browser shortcut protection policies and audit .lnk file arguments for unauthorized appended URLs",
    "Deploy endpoint security with Potentially Unwanted Application (PUA) detection enabled",
    "Block connections to known ad-injection and traffic-redirection domains at DNS resolvers"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Pincav",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Pincav"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Adware.Win32.Pincav",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Pincav.A",
      "PUA:Win32/Pincav.B"
    ]
  },
  "motivation": "Affiliate Advertising Fraud & Search Monetization",
  "sample_hashes": []
}