PUP.2345.A

The detection of PUP.2345.A on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take necessary steps to remove it to prevent further problems.

What Is PUP.2345.A?

PUP.2345.A is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that may not be malicious in the classical sense but can still cause significant disruptions to your system's normal functioning. PUPs often find their way onto computers through bundled software installations, where they are included alongside legitimate programs without the user's full knowledge or consent. Once installed, PUP.2345.A can lead to a variety of issues, including unwanted advertisements, changes to browser settings, and potential data collection without your permission.

How PUP.2345.A Operates

PUP.2345.A, like other PUPs, operates by integrating itself into your system and potentially altering settings or collecting data. It may display unwanted advertisements, modify your browser's homepage or search engine, or even install additional software without your consent. The primary goal of such programs is often to generate revenue for their developers through advertising or by selling collected data. Understanding how PUP.2345.A operates is crucial for devising an effective removal strategy.

Symptoms of Infection

Symptoms of a PUP.2345.A infection can vary but commonly include an increase in unwanted pop-ups or advertisements, changes to your web browser's settings, slow system performance, and potentially, the installation of additional unwanted software. You might also notice that your browser's homepage or default search engine has been altered without your input. Recognizing these symptoms is key to identifying the need for removal.

• Increased appearance of pop-ups or unwanted advertisements
• Unexplained changes to browser settings, such as a new homepage or search engine
• Slowdown in system performance
• Appearance of additional, unwanted programs

How to Remove PUP.2345.A

1. Boot your computer in Safe Mode with Networking to limit the malware's ability to interfere with the removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of PUP.2345.A.
3. Uninstall any suspicious programs that were installed around the time you first noticed symptoms of the infection.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any changes made by PUP.2345.A.
5. Reboot your computer and perform another scan with your anti-malware tool to ensure that all remnants of the malware have been removed.

Conclusion

Removing PUP.2345.A from your system is crucial to restoring your computer's performance and security. By following the steps outlined above and maintaining vigilance in the face of potential threats, you can protect your system from similar infections in the future. Regularly updating your software, being cautious with downloads, and using reputable security tools can significantly reduce the risk of encountering malware like PUP.2345.A. Remember, proactive measures and a well-informed approach are your best defenses against the evolving landscape of cyber threats.

Analysis Report

General information

Family Name:	PUP.2345.A
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 6d67074f3af808cc985ceef067ec598c SHA1: ae2dbf8a42f80e9407339657eb8cc5bcdb9f4212 SHA256: 53087521670C28F8B4ED5971D483A0EB78CDD8E0162F038218760399C2B29606 File Size: 1.55 MB, 1545728 bytes

MD5: 6e487a00f247ee1d8750f58e8663baed SHA1: 690b776b8388ca139a3946fafcb451e4ea77d0e3 SHA256: 166680003FFE38D3AC67D3D23C0507D4A19F5EE993629FBB66E3B1704AE4F4E3 File Size: 516.61 KB, 516608 bytes

MD5: b94316bdf79b4882d34aee285f25955f SHA1: 752f9bf0e60a3014eb148adbe2109401f5c09ec3 SHA256: A79AE8FC5CEFAA9CED639A035E7D9D8DB902BD3FF98E90D6BDA30520A57F30B5 File Size: 524.80 KB, 524800 bytes

MD5: afe3181c308ddd99e4788667b48dc16c SHA1: c681d65af322be456ff82f94642884b03f80fe7b SHA256: EE5990A74AD36D93EE234600E12B3BAE5DC4E9B3C65308CA00A6CCCDC06BD24E File Size: 917.50 KB, 917504 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	2345看图王 v9.2
Company Name	2345移动科技
File Description	2345看图王 v9.2 安装程序
File Version	9.2.1.8477 6.5.3.11163 6.3.0.11040
Legal Copyright	版权所有 (C) 2018, 2345移动科技
Product Name	2345看图王
Product Version	9.2.1.8477 6.5 6.3
Special Build	000010

File Traits

• dll
• HighEntropy
• imgui
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• 2345.A

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ae2dbf8a42f80e9407339657eb8cc5bcdb9f4212_0001545728.,LiQMAxHB