YAPA: UFile hides a Chrome Search Hijacker
UFile: Signed PDF Utility Delivering an In-Memory Chrome Search Hijacker
A .NET installer distributed through an advertising redirect downloads a functional PDF utility, retrieves an encrypted .NET stage, and modifies Chrome search-provider configuration to use an operator-supplied search destination.
Executive summary
Classification: Browser/search hijacker delivered through a signed PDF utility installation chain. The original executable is signed by FAIRLIE LIMITED. Its first-stage installer obtains an application ZIP from alyclick.com; the installed application requests an encrypted second-stage payload from api.catchasail.com, decrypts it with date-derived AES-CBC material, and executes the recovered .NET assembly in memory.
The recovered assembly, AutomationPref, requests a search-provider URL from catchasail.com/u_partner_cfg, kills Chrome, rewrites Preferences / Secure Preferences and preference-integrity metadata, then relaunches Chrome. In a controlled reinstallation after the browser redirect had been cleared, the investigator observed a renewed quickbrowse.co → Yahoo search redirection.
Family attribution: No demonstrated code-family or operator linkage to CookUp. The same advertisement-origin site and similar affected-host circumstances support possible distribution-channel overlap only. This report treats UFile as a distinct case.
1 · Discovery and distribution
An investigated host had browsed homemade-gifts-made-easy.com and encountered advertising redirects associated with PDF/document software, including GooPDF and UFile. An observed UFile landing-page host was goyoufile.com. The UFile landing page displayed a preselected consent option concerning browser-performance setting optimization. The association is a delivery observation, not evidence that GooPDF and UFile share a malware family.
goyoufile.com URL, the “Open The Downloaded File” prompt, and the prechecked browser-settings consent. This documents the observed distribution experience, not a proven affiliation with other software promoted on the same source website.Original signed installer
| Product / filename | UFile / UFileSetup.exe (analyzed locally as ufile.exe) |
| SHA-256 | 6bb5a82d9acd6d846d5ebd928ec8eec8c0ac67cf7a76d3c6b0e225169fd382e3 |
| File version | 19.0.7.8; resource CompanyName empty; product UFile; copyright © 2024 |
| Signer subject | CN=FAIRLIE LIMITED, O=FAIRLIE LIMITED; E=myro@fairlie.xyz; 31 Oikonomou Konstantinou, Strovolos, Nicosia, Cyprus; registered organization serial HE424676 |
| Issuer | GlobalSign GCC R45 EV CodeSigning CA 2020 (GlobalSign nv-sa, BE) |
| Certificate thumbprint | B486151303A89351C7AD52775C7A6D2B2E505E41 |
| Certificate validity | June 8, 2026 – June 9, 2027 (displayed in analyst's local time) |
| Timestamp signer | DigiCert SHA256 RSA4096 Timestamp Responder 2025 |
| Authenticode status | Valid — “Signature verified.” Does not establish benign behavior. |
| Format | Managed .NET executable; imports mscoree.dll!_CorExeMain; observed 12,144-byte certificate table exactly accounts for reported PE overlay |
2 · Staged installation and execution
Initial signed .NET WPF installer
Machine fingerprint / OS build; HTTP 200, 4,315,072-byte ZIP
Installed PDF utility with QPDF tools; installation callback to /u_flow_done
Token-based stage retrieval; large Base64-encoded encrypted response
Run in-memory AutomationPref .NET assembly
Operator-supplied search provider; Chrome restart and result reporting
The bootstrapper derives a stable you_id fingerprint using a SHA-256 hash of the C: volume serial number concatenated with the Windows directory creation timestamp. The first-stage payload is an application ZIP, not the encrypted stage.
The installed UFile.exe is also managed .NET (CLR directory RVA 0x2000, size 72). Its DeployService.PerformDeployAsync() obtains a session token, retrieves encoded/encrypted content, decrypts it, reconstructs assembly bytes, and invokes an entry point through Assembly.Load().
Key = SHA256(UTF8(installDate)) IV = MD5(UTF8(currentTime)) Cipher = AES-CBC / PKCS7 Date strings use "yyyyMMddss" (seconds but no hours/minutes) Assembly assembly = Assembly.Load(assemblyBytes); assembly.EntryPoint.Invoke(null, arguments);
Recovered stage: AutomationPref, 3,320,832 bytes, x64 managed .NET. Its SHA-256 is afcc8b57df4cdc503646fc59368be57e180961592381f9248f8d2d77183a42bc. The earlier observed bundle_digest matched the recovered stage's MD5 3290292ab1a2f512a1938fdfbb710720.
3 · Chrome search-hijacking mechanism
The recovered second-stage decompiles as AutomationPref. Infrastructure.Handler.Start() explicitly sequences the modification:
SendFtoLog(); setOSOU(suid); // fetch /u_partner_cfg KillChrome(); swapPref(); // modify Chrome profile data RestartChromeProcess(profile); VerifyFileContainsMarker(...); SendLog(); // /u_close_ping2
Search provider sourced from infrastructure
setOSOU() sends a request to https://catchasail.com/u_partner_cfg and builds a provider using the returned URL. In the original Fiddler session, the returned destination was trai.eepsearch.com. The resulting Chrome search template appends &q={searchTerms}; the display name is New.
Profile modification: SecurePrefsSimulation assigns replacement default_search_provider_data.template_url_data and mirrored_template_url_data entries. MacValidator calculates replacement HMAC-SHA256 integrity data, and the code removes template_url_data_encrypted_hash. Helper.ReplaceFileSecurely() stages modified JSON and replaces Chrome preference files.
Chrome restart: the payload terminates Chrome processes and relaunches a Chrome executable with:
--profile-directory="Default" --hide-crash-restore-bubble --disable-features=EncryptedPrefHashing
This command line was independently observed through the Frida process-creation hook. The feature name suggests an attempt to influence preference-integrity enforcement, but exact effects depend on the Chrome build and were not separately tested.
Extension interference and telemetry
ExtensionChecker inspects installed extension manifests for chrome_settings_overrides, queries catchasail.com/u_ext, and conditionally changes an extension's disable_reasons when instructed. u_close_ping2 reports operation status and browser/search information. The payload includes Chrome Local State / DPAPI / AES-GCM-related code; the analysis did not establish credential theft or exfiltration of personal browser data.
Observed browser impact and attribution boundaries
| Evidence | Observation | Interpretation |
|---|---|---|
| Controlled baseline | Removal/recreation of existing Chrome preferences eliminated observed redirects; checked files contained none of the selected known strings | Observed Cleaned baseline for tested indicators |
| Reinfection | After UFile reinstallation, UFile opened Chrome and QuickBrowse redirection returned | Observed Strong installation-chain attribution |
| Frida | Large Chrome-related JSON writes with trai.eepsearch.com search templates; subsequent Chrome launch with feature switch | Observed Supports direct preference rewrite |
| Chrome preferences | trai.eepsearch.com entry appeared in Preferences and Secure Preferences | Observed Consistent with /u_partner_cfg |
| QuickBrowse URL | quickbrowse.co/search/?chnm3=w64cjbu7&q=... before Yahoo | Qualified Exact routing/relationship to EepSearch not yet reconstructed |
4 · Indicators of compromise / investigation pivots
Network indicators below are recorded in defanged form for safe handling. Domains associated with advertising or search services may be shared infrastructure; do not assume every related visit is malicious. “Source” specifies the supporting evidence.
| Indicator | Type / role | Evidence |
|---|---|---|
6bb5a82d9acd6d846d5ebd928ec8eec8c0ac67cf7a76d3c6b0e225169fd382e3 | SHA-256 · initial installer | Investigator-provided hash |
6a915d4c09939d9c2e872e84a0ebeaf3fd753af5029e2474b28065f61b2c1aaf | SHA-256 · installed UFile.exe | First-stage captured ZIP, recomputed |
afcc8b57df4cdc503646fc59368be57e180961592381f9248f8d2d77183a42bc | SHA-256 · recovered in-memory stage | Recovered assembly, recomputed |
3290292ab1a2f512a1938fdfbb710720 | MD5 · stage digest | Recovery and earlier reported digest correlation |
B486151303A89351C7AD52775C7A6D2B2E505E41 | Certificate thumbprint · FAIRLIE LIMITED | PowerShell Authenticode output |
alyclick[.]com/get_u | Initial ZIP acquisition | Fiddler SAZ / dnSpy installer |
alyclick[.]com/u_flow_done | Installer completion callback | Fiddler SAZ / dnSpy installer |
api[.]catchasail[.]com/u_session_grant | Stage session/token | Fiddler SAZ / dnSpy application |
api[.]catchasail[.]com/u_bundle_acquire | Encrypted in-memory stage retrieval | Fiddler SAZ / dnSpy application |
api[.]catchasail[.]com/u_status_digest | Digest reporting; HTTP 404 observed | Fiddler SAZ |
catchasail[.]com/u_install_start | Stage execution telemetry | Fiddler SAZ / AutomationPref code |
catchasail[.]com/u_partner_cfg | Server-controlled search configuration | Fiddler SAZ / AutomationPref code |
catchasail[.]com/u_ext | Extension decision endpoint | AutomationPref code; not established in captured SAZ |
catchasail[.]com/u_close_ping2 | Chrome modification telemetry | Fiddler SAZ / AutomationPref code |
trai[.]eepsearch[.]com | Search provider delivered during original test | Fiddler / Chrome preferences / Frida |
quickbrowse[.]co/search/ | Observed search intermediary before Yahoo | Investigator browser observation / controlled rerun |
chnm3=w64cjbu7 | Observed QuickBrowse query parameter | Investigator browser URL |
goyoufile[.]com | UFile landing page | Investigator ad-click observation |
homemade-gifts-made-easy[.]com | Advertising origin context; not C2 | Investigator browser observation |
%LOCALAPPDATA%\Programs\UFile\ | Installed application path | Filesystem / Frida |
youfiles_id.txt, youfiles_backup, U_File | Stage constants / pivots; creation not independently demonstrated | AutomationPref decompiled code |
1786867306138976 | Hardcoded AppID | AutomationPref decompiled code |
5 · Assessment and limitations
Supported conclusions
- High confidence: UFile's installation chain produces unauthorized Chrome search redirection in the tested environment; the effect was reproduced after a preferences reset.
- Confirmed by static code and runtime: staged encrypted payload retrieval, in-memory .NET loading, server-controlled search configuration, Chrome process termination and restart, and preference-file manipulation.
- Observed in code: conditional treatment of Chrome extensions and manipulation of preference-integrity metadata.
- Not established: credential theft, data theft beyond observed telemetry, additional persistent services/tasks, exact QuickBrowse–EepSearch routing, or a shared malware family with CookUp/GooPDF.
Distribution vs. malware-family attribution
UFile and GooPDF were encountered following similar advertisement-driven activity on the investigated host. This is compatible with unrelated unwanted-software campaigns being distributed through a common advertising environment. No sufficient code, infrastructure ownership, certificate, or operational linkage was established to label UFile as CookUp or part of the same family. Similar date-derived AES-CBC construction seen in earlier investigations is a research lead, not attribution.
Evidence sources
| Source | Use |
|---|---|
Original UFileSetup dnSpy export (code(1).zip) | First-stage installation, machine ID, alyclick endpoints |
Installed UFile dnSpy export (code2.zip) | Encrypted stage request and memory-loading routine |
Recovered stage dnSpy export (code3.zip) | AutomationPref handler, search replacement, integrity handling and extension checks |
Fiddler capture (cap.saz) | Recorded requests, responses, response codes and recovery |
| Frida runtime logs | File content writes and Chrome process-launch evidence |
| PowerShell / Chrome experiments | Signer certificate, PE metadata, profile findings and controlled reenactment |
Prepared from investigator-provided artifacts and locally reviewed evidence. Hashes of the captured UFile.exe and recovered stage were recomputed from supplied bytes. Dates/times in network capture are UTC; VM PowerShell timestamps shown in previous analysis were local. Static paths/endpoints do not imply they were all reached during the captured run.
Comments
Post a Comment