PUP.Bunndle
The detection of PUP.Bunndle on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.
Table of Contents
What Is PUP.Bunndle?
PUP.Bunndle is a type of malware that is typically installed on a system without the user's knowledge or consent. It can be bundled with other software, such as free programs or applications, and may be designed to display unwanted advertisements, collect user data, or install additional malware. PUPs like PUP.Bunndle can compromise system security and put user data at risk.
How PUP.Bunndle Operates
PUP.Bunndle operates by exploiting vulnerabilities in software or using social engineering tactics to trick users into installing it. Once installed, it can run in the background, consuming system resources and potentially causing problems with system performance. It may also communicate with remote servers to download additional malware or upload user data. PUP.Bunndle can be difficult to detect and remove, as it may not exhibit obvious symptoms of infection.
Symptoms of Infection
Systems infected with PUP.Bunndle may exhibit a range of symptoms, including slow system performance, unwanted advertisements or pop-ups, and suspicious program installations. Users may also notice unusual network activity or changes to system settings. In some cases, PUP.Bunndle may not exhibit any noticeable symptoms, making it challenging to detect and remove.
- Unwanted advertisements or pop-ups
- Suspicious program installations
- Slow system performance
- Unusual network activity
- Changes to system settings
How to Remove PUP.Bunndle
- Boot your system in Safe Mode with Networking to prevent PUP.Bunndle from loading and to allow for easier removal.
- Run a full scan with a reputable anti-malware tool, such as SpyHunter, to detect and remove PUP.Bunndle and any associated malware.
- Uninstall any suspicious programs or applications that may be related to PUP.Bunndle.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and run a follow-up scan with your anti-malware tool to ensure that PUP.Bunndle has been completely removed.
Conclusion
Removing PUP.Bunndle from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove PUP.Bunndle and prevent future infections. It is essential to remain vigilant and take proactive steps to protect your system and data from potentially unwanted programs and other types of malware.
Analysis Report
General information
| Family Name: | PUP.Bunndle |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ba17d0cc69904a6b646b37ef25f9d4f5
SHA1:
36b6ce0d5ecb7c575497e2622c55ff12ff1bebaa
File Size:
884.74 KB, 884736 bytes
|
|
MD5:
aa8c09fa4c6def89b5aed683af3b93ab
SHA1:
8dd45114a188a05576604ca2270df37774459daf
SHA256:
E835B298A0C8D9AEB5266C1B624DAF9830D452B1552C41E22FB93128ED38DDC2
File Size:
478.21 KB, 478208 bytes
|
|
MD5:
81cd9ea7952432d1669efa4cd787f0da
SHA1:
37235cd4859057623d1c499e233e620f051273bc
SHA256:
7FE88B3E3F91351A03302F5486182DEFE704520F77B673EC958BE0561DD9D17B
File Size:
278.53 KB, 278528 bytes
|
|
MD5:
5fe19279f02a073bf440165b78b0236f
SHA1:
2b2bd01a198c9ce417eace10fcb1db79373f2908
SHA256:
3C0491309464FB286A629ED0865038FAF1CF5937059AB76CC10ADE414C35F043
File Size:
1.64 MB, 1638400 bytes
|
|
MD5:
2b70eae30211421faa6dae490fe2e339
SHA1:
0784c423b04a289f3d3b92443b3b1671c410bcb8
SHA256:
22B697DDF86C6B972D9C560E8547E72E5153A8D3AF70ECAB809E55DBAFE127AD
File Size:
432.50 KB, 432500 bytes
|
Show More
|
MD5:
57863935f09aa016d9782e460615cc0e
SHA1:
a3a128f8eefe2798440fec963fb8dc96d9857bc7
SHA256:
AC9DD065FEC161339EE617FBB91405ED3F804CC5CEF062BFE1C438BB500610B2
File Size:
683.76 KB, 683757 bytes
|
|
MD5:
bf88c2d3b833fbe1b61d85737aefb499
SHA1:
f2757b4ed08db87d08bad031024cd878e8694c74
SHA256:
41198A19E40CF89E50E2AD79AB63E4B62E1B872B5F838EAB1CA050FB4C7DC9A0
File Size:
25.85 KB, 25848 bytes
|
|
MD5:
c5b3e7acdf9f1065b3f5e4087b010b64
SHA1:
94c53368c73badbe671ffb2f4df14dd1646e4336
SHA256:
4EEB8F35409E7BEDFA8015DAF13D589F137247BB8DCA1BBFCB58A3FE06A55811
File Size:
623.63 KB, 623631 bytes
|
|
MD5:
7c4c06b1394f2c43a5291f2f1ad9129f
SHA1:
a9aa92e4409aff4ecf8bf26f23e95eabb0586dfe
SHA256:
3407D97102D8C8950F888BD15B310FBEF9686414A81B8E2623225CAC06DE832A
File Size:
227.71 KB, 227712 bytes
|
|
MD5:
001602e2ca5003b8c2f329fc2e593640
SHA1:
01585f5310def675f24cdedcd035c860fa070143
SHA256:
44E154ECD6F2F7BEFC88B0F8D7101D94E47C046B33E5BF3736602C1B05AF3092
File Size:
7.36 MB, 7356004 bytes
|
|
MD5:
47b3608c246d40a135e89c4bb82e07fb
SHA1:
fd81b3a67e67fc46cdacaec520329747b4b5670d
SHA256:
FFF4B1206EE7B88A622D7BD3A5C8ECC281A6A7E0372F8C01BBFCB44CBFD5AA35
File Size:
7.68 MB, 7676416 bytes
|
|
MD5:
11f4dcfba6d1d6032c6833ce0dbb9c29
SHA1:
2ca98643512e671a1dff688b342e26b5c8eb1676
SHA256:
3F054E89CF0D07907F1A2B0DC63C1BA36FFDC563F8669C9D9EC3EF1DACF0FEB3
File Size:
344.06 KB, 344064 bytes
|
|
MD5:
f35f382cdbcaff3bbb48474705ebbbb6
SHA1:
9ed41b78316554c6bf511d86de7e22184c143563
SHA256:
75FCA4C36F1AA07D8145A40BEE6302CBB939FA6ED984EBA9A1F601BAD7D057AD
File Size:
54.60 KB, 54600 bytes
|
|
MD5:
a19fdd7184c23bd7460423e0bea25579
SHA1:
1a7411d50e24729f0867feca833b50f09a41aeca
SHA256:
C6FF9F135247994D02825B4EF3A5B8D9A864229943CE834E331290922BC8E3D2
File Size:
1.60 MB, 1602958 bytes
|
|
MD5:
64c7284e012662bfb8b1c3e7a23d2b13
SHA1:
77a22884f915dbdf6e2c835025453034317313fe
SHA256:
366239EA67D582798F84E8FC42E03C5603F3A01C1EA193DB5C97B7727CE7FA68
File Size:
165.89 KB, 165888 bytes
|
|
MD5:
e202e822c618e4b5dbd1d89a355aa3b7
SHA1:
51f0a5f2b84a2f39072f5dc38ec5a8750aa9ae71
SHA256:
C6B111656127AA4E27D3ABCDD48BF04270E8FF88AB7C5287A5E299F59224B3D0
File Size:
6.96 MB, 6956270 bytes
|
|
MD5:
5f9d6542ce574c96ca1253277b9ea102
SHA1:
cfad7322bce6d4a378d7a12dd086141ae0373e2b
SHA256:
809F70A7365970CE1E998646309B4F71FAB076244D0DE4215752E7C56C8EA659
File Size:
327.68 KB, 327680 bytes
|
|
MD5:
68ac731a814bf285c59ee5ca3ed9e93e
SHA1:
fb0aaeb807515a6d668e3097b3cab16315788e3e
SHA256:
3574FA3C862240CBF6A29AF26AE4B8EFBFAB59329D4AB20481F5E23B468FE35F
File Size:
3.34 MB, 3337872 bytes
|
|
MD5:
45a9ebd8a8caa1f3fee0d71f99fd3945
SHA1:
3b988b249b155ca5ed1bf9f35b59224c47040404
SHA256:
DF3CD8D3AC9B52EFDC7D2A6196E476D5BF77B5C30A2C2B581A3174C05EBE6291
File Size:
512.57 KB, 512568 bytes
|
|
MD5:
c06dfbc54c68d192ed24d6f00e5950d5
SHA1:
74f284501df4130337e1364598bbc0f80f2d2253
SHA256:
EC3820006EF4D35750EDA7F659735E3A6D8471DBB57D1B588B079A003B6C2130
File Size:
1.01 MB, 1014816 bytes
|
|
MD5:
94ac58c87f60492018c531982e803c46
SHA1:
9ea483afdd3615efb7a1f2d32037bbe09c7226fc
SHA256:
41B5EB86C8CAA5C47AB26C27C84B7B1A358C9A5A44700310D245873A19A3B147
File Size:
1.09 MB, 1085440 bytes
|
|
MD5:
5267d26b96b7c69bd548282fb94897cc
SHA1:
432c9723e35bbcf39dfc02bc479c822619ca09b4
SHA256:
8CF7D594D354A8F3B78FE4960BC9CCEF2F731DC98365864652020D9CB5DFD125
File Size:
2.23 MB, 2232259 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
Show More
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Show More
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Assembly Version | 3.0.0.4435 |
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
|
| Legal Copyright |
|
| Original Filename |
|
| Private Build | RTM |
| Product Name |
Show More
|
| Product Version |
Show More
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Lavasoft Software Canada | DigiCert Assured ID Code Signing CA-1 | Self Signed |
| 7270356 Canada Inc. | Entrust Root Certification Authority - G2 | Hash Mismatch |
| Lavasoft Software Canada Inc. | Entrust Root Certification Authority - G2 | Root Not Trusted |
| Lavasoft Software Canada | GlobalSign CodeSigning CA - G3 | Self Signed |
| Ye Yizhou | WoSign Class 2 Code Signing CA G2 | Self Signed |
File Traits
- .NET
- 2+ executable sections
- 7-zip (In Overlay)
- 7-zip Installer
- dll
- HighEntropy
- Inno
- InnoSetup Installer
- Installer Manifest
- Installer Version
Show More
- vb6
- VirtualQueryEx
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Zegost.AQ
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\program files\common files\system\symsrv.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs02a70acc | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs0e418301 | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs175.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5 | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\2026-03-29-08-17-07_installer_pid=3992.txt | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\2026-03-29-08-17-07_installer_pid=3992.txt | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\app.ico | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\app.ico | Synchronize,Write Attributes |
Show More
| c:\users\user\appdata\local\temp\7zs4d971dd5\bundleconfig.json | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\bundleconfig.json | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\de\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\de\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\de\microsoft.win32.taskscheduler.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\de\microsoft.win32.taskscheduler.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\devlib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\devlib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\devlib.services.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\devlib.services.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\dynactsbll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\dynactsbll.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\en | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\en\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\en\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\es\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\es\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\es\microsoft.win32.taskscheduler.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\es\microsoft.win32.taskscheduler.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\fr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\fr\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\fr\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\fr\microsoft.win32.taskscheduler.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\fr\microsoft.win32.taskscheduler.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\genericsetup.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\genericsetup.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\genericsetup.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\genericsetup.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\genericsetup.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\genericsetup.exe.config | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\h2osciter.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\h2osciter.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\htmlagilitypack.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\htmlagilitypack.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\installer.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\installer.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\it\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\it\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\it\microsoft.win32.taskscheduler.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\it\microsoft.win32.taskscheduler.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\mydownloader.core.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\mydownloader.core.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\mydownloader.extension.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\mydownloader.extension.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\newtonsoft.json.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\newtonsoft.json.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\ninject.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\ninject.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\offerservicebll.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\offerservicebll.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\offerservicesdk.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\offerservicesdk.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\pt | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\pt\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\pt\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\quicklaunch.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\quicklaunch.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\downloadpage.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\downloadpage.html | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\finishpage.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\finishpage.html | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\bg-welcome.png | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\bg-welcome.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\bg.png | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\bg.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\check.png | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\check.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\close-hover.svg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\close-hover.svg | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\close-normal.svg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\close-normal.svg | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\favicon.png | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\favicon.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\loader.gif | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\loader.gif | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\minimize-hover.svg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\minimize-hover.svg | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\minimize-normal.svg | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\minimize-normal.svg | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\warning48x48.png | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\images\warning48x48.png | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\installingpage.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\installingpage.html | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\offerpage.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\offerpage.html | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\style.css | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\style.css | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\config.tis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\config.tis | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\eventhandler.tis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\eventhandler.tis | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\log.tis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\log.tis | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\translateoffertemplate.tis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\translateoffertemplate.tis | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\viewstateloader.tis | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\tis\viewstateloader.tis | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\welcomepage.html | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\resources\welcomepage.html | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\ru | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\ru\devlib.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\ru\devlib.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\sciter32.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\sciter32.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\shared.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\shared.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\zh-cn | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\zh-cn\microsoft.win32.taskscheduler.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs4d971dd5\zh-cn\microsoft.win32.taskscheduler.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs607f.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs7e41.tmp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\de-de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\de-de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\de-de\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\de-de\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\en-us | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\en-us | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\en-us\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\en-us\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\es-es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\es-es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\es-es\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\es-es\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\fr-ca | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\fr-ca | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\fr-ca\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\fr-ca\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\icsharpcode.sharpziplib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\icsharpcode.sharpziplib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\it-it | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\it-it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\it-it\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\it-it\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ja-jp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ja-jp | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ja-jp\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ja-jp\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\newtonsoft.json.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\newtonsoft.json.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\pt-br | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\pt-br | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\pt-br\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\pt-br\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ru-ru | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ru-ru | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ru-ru\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\ru-ru\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\tr-tr | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\tr-tr | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\tr-tr\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\tr-tr\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\webcompanion-installer.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\webcompanion-installer.exe | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\webcompanion-installer.exe.config | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\webcompanion-installer.exe.config | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\zh-chs | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\zh-chs | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\zh-chs\webcompanion-installer.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zs821a1db9\zh-chs\webcompanion-installer.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\de-de | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\de-de | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\de-de\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\de-de\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\en-us | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\en-us | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\en-us\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\en-us\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\es-es | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\es-es | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\es-es\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\es-es\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\fr-ca | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\fr-ca | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\fr-ca\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\fr-ca\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\icsharpcode.sharpziplib.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\icsharpcode.sharpziplib.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\it-it | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\it-it | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\it-it\webcompanioninstaller.resources.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\it-it\webcompanioninstaller.resources.dll | Synchronize,Write Attributes |
| c:\users\user\appdata\local\temp\7zsc0dac517\ja-jp | Generic Write,Read Attributes |
53 additional files are not displayed above.
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\systemcertificates\root\certificates\be36a4562fb2ee05dbb3d32323adf445084ed656::blob | \ Ѐ 볝蚽㾜ࠛ컯퇄춈ᔻ ᰘ兘槹镹⍋ . Thawte Timestamping CA ਰࠆثԁ܅ࠃ 㚾嚤눯돛⏓괣䗴丈囖 晿煺硩騠ᑑ莝⃚ ꗨ뺘芄ﺎ炮ᔑ㔁뉶 ʥ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �j 8��81z��B �6 �v y� z �Z xy �� �a ۀT�B� ����� 1���� �5����ee +Bx �<�� 5 � �7 �!wz "M)"Wc#�#��$kF$�� %"�%:� %�&� &�-&�x'�(�(X�)�`*J*9*�^+�[+��,=� ,�� | RegNtPreCreateKey |
| HKLM\system\software\microsoft\tip\aggregateresults::data | 鐄ȴ 鲱 勪 峟ʏ耀氅歿 岋 켜ʚ꺇뺶 켜ʚ꺇뺶 켜ʚ꺇뺶 켜ʚ릵犱 Ş 洎ʫ赲荓 嚋 픋˹耀뫹躧 픋˹➇ⵌ㭔 ˿耀뱝鴡 䊤 ↑̀ā耀惟탌 | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | �k � 8�tX�jg�8 �6 �v �Z xy �� T������ ���5����Bx �� !wz #�#��$kF%:� %`� &� (�(X�)E)�`*J*9+�[,��-!R/9� /��1`1�1HO 1�D5�09ߔ<.:>3� @V� F?G�IH[uH�pH�� I��J�� K��N$N� R20U5� | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\4eb6d578499b1ccf5f581ead56be3d9b6744a5e5::blob | ់㹧ৢ䗾鍗ᳺ ứ霞輫穆轙⊩㢅즔S c 愰ℰଆ虠ňŅᜇ〆〒ؐ⬊ĆĄ㞂ļ́ダ؟怉䢆蘁泽ĂሰူਆثЁ舁㰷āȃ쀀ᬰԆ腧Č〃〒ؐ⬊ĆĄ㞂ļ́翀 Ā ⨀ ب⬈Ćԅ̇⬈Ćԅ̇⬈Ćԅ̇⬈Ćԅ̇ँ Ā ⨀ ب⬈Ćԅ̇⬈Ćԅ | RegNtPreCreateKey |
| HKLM\software\microsoft\systemcertificates\authroot\certificates\4eb6d578499b1ccf5f581ead56be3d9b6744a5e5::blob | \ ص�6�hbu�B�Ҫ�7 N��xI� �_X �V�=�gD��h ~ �/-�� ����\L�A��T�a V e r i S i g n �e�����0 �C9��313b �ϫ~C��k&*����e������d��� * 0( | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| Syscall Use |
Show More
21 additional items are not displayed above. |
| Process Shell Execute |
|
| Anti Debug |
|
| User Data Access |
|
| Encryption Used |
|
| Process Manipulation Evasion |
|
| Keyboard Access |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\8dd45114a188a05576604ca2270df37774459daf_0000478208.,LiQMAxHB
|
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 1896
|
.\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240402 --nonadmin --direct --tych --campaign=21184387389 --version=13.900.0.1080
|
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 840
|
"C:\Users\Pzakjqgb\AppData\Local\Temp\is-TSJVJ.tmp\1a7411d50e24729f0867feca833b50f09a41aeca_0001602958.tmp" /SL5="$80364,1175137,139776,c:\users\user\downloads\1a7411d50e24729f0867feca833b50f09a41aeca_0001602958"
|
Show More
.\installer.exe
|
.\WebCompanionInstaller.exe --partner=CH230702 --nonadmin --thankyou --version=7.0.2417.4248 --prod
|
"C:\Users\Vjkutauh\AppData\Local\Temp\is-DSUFO.tmp\74f284501df4130337e1364598bbc0f80f2d2253_0001014816.tmp" /SL5="$5045A,578982,139776,c:\users\user\downloads\74f284501df4130337e1364598bbc0f80f2d2253_0001014816"
|
"C:\Users\Khcuzepz\AppData\Local\Temp\is-02B1D.tmp\432c9723e35bbcf39dfc02bc479c822619ca09b4_0002232259.tmp" /SL5="$90408,1984515,66560,c:\users\user\downloads\432c9723e35bbcf39dfc02bc479c822619ca09b4_0002232259"
|
