Threat Database Potentially Unwanted Programs PUP.DllInject.FA

PUP.DllInject.FA

By CagedTech in Potentially Unwanted Programs

The detection of PUP.DllInject.FA on your system indicates the presence of a potentially unwanted program (PUP) that may be injecting malicious DLLs into your system. This type of threat can compromise your system's security and potentially lead to further malware infections. It is essential to understand the nature of this threat and take immediate action to remove it from your system.

What Is PUP.DllInject.FA?

PUP.DllInject.FA is a type of potentially unwanted program that is designed to inject malicious DLLs (Dynamic Link Libraries) into your system. This can allow the malware to gain access to sensitive areas of your system, potentially leading to data theft, system crashes, and other malicious activities. PUPs like PUP.DllInject.FA are often bundled with other software or downloaded from untrusted sources, making them a significant threat to your system's security.

How PUP.DllInject.FA Operates

PUP.DllInject.FA operates by injecting malicious DLLs into your system, which can then be used to carry out various malicious activities. These DLLs can be used to intercept system calls, steal sensitive information, or even install additional malware on your system. The malware may also use various techniques to evade detection, such as code obfuscation or anti-debugging techniques. Understanding how PUP.DllInject.FA operates is crucial in developing an effective removal strategy.

Symptoms of Infection

The symptoms of a PUP.DllInject.FA infection can vary, but common indicators include slow system performance, frequent system crashes, and unusual system behavior. You may also notice that your system is running unfamiliar programs or that your browser is being redirected to suspicious websites. In some cases, you may not notice any symptoms at all, which is why regular system scans and monitoring are essential in detecting and removing PUPs like PUP.DllInject.FA.

  • Slow system performance
  • Frequent system crashes
  • Unusual system behavior
  • Unfamiliar programs running on your system
  • Browser redirects to suspicious websites

How to Remove PUP.DllInject.FA

  1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.DllInject.FA.
  3. Uninstall any suspicious programs that may be related to the PUP.DllInject.FA infection.
  4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any malicious extensions or add-ons.
  5. Reboot your system and perform a follow-up scan to ensure that all instances of PUP.DllInject.FA have been removed.

Conclusion

Removing PUP.DllInject.FA from your system requires a combination of technical expertise and caution. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove this potentially unwanted program and protect your system from further malware infections. Remember to always be cautious when downloading software or clicking on links from untrusted sources, as these are common ways that PUPs like PUP.DllInject.FA can infect your system. Regular system scans and monitoring can also help detect and prevent PUP infections, ensuring that your system remains secure and protected.

Analysis Report

General information

Family Name: PUP.DllInject.FA
Signature status: No Signature

Known Samples

MD5: 63011bcdd7194c4cfc61719a1a146463
SHA1: 5dac2775f211af2118e2cca97381fa244310571e
File Size: 1.22 MB, 1224704 bytes
MD5: 8145b466e5ef1bec98b42afcd0be7463
SHA1: c0dbdf29c69405e7f994fbc78981ecac4786ac5c
SHA256: 4F13F222D736FF1CC3A5F1609A87DB08475F71F6D43A08A2517E357146739FAB
File Size: 1.20 MB, 1203200 bytes
MD5: 9f0b9233186b72d0ac0ead2807cd05be
SHA1: e5b04af11a7940e578ff6207793a3d59787f1604
SHA256: C01C61FA84F36DD935347E38217DF7CBB3B0EF269645D38C47B903C4E5BEB295
File Size: 1.31 MB, 1305600 bytes
MD5: 3fef70f97e4b6b8ed3ab59cfdec9770d
SHA1: f1a79c0c4c1cab3af6ee1d944ddfe0d7449d1693
SHA256: C680BDC5DFC6A860CBF4FF1795858B7A977C450CEAA2D5331EC07D46CB902531
File Size: 1.20 MB, 1201664 bytes
MD5: 5b945b0a7aac35bcea17c6c1ec42d56b
SHA1: 6338b9adffbe3b3c509b175d6ac0944703bff0a0
SHA256: 533349F2613FADB0A7FB0E61B59AC4BD052CF21038D28EA199235DA26247999D
File Size: 1.18 MB, 1184256 bytes
Show More
MD5: 49e8059132397e25247d1d8755405d4f
SHA1: 808748044c236ee5a9ec4fd8a812277827845572
SHA256: 07B22DEC2AA40C458F74F2DB3673DC8A2A38F915CB939DB935FABEAB0405ECA6
File Size: 2.05 MB, 2047626 bytes
MD5: 91536496a8c236997a46243b0fa0553c
SHA1: 15430cd21af6620a12c126ab3f7f024987d3975d
SHA256: 4B9A346633337EE1A79AB5D67C05914C86F29BA71B92933E7D75AF7987CF6167
File Size: 4.03 MB, 4026880 bytes
MD5: cd8a11f3bc5f038d722e614db54aef43
SHA1: 74b3893e717da9e97fbc8edfeaaf05e831a5538d
SHA256: 49F743ABF1E9EB0BC5E0B322CB4002D449B652F605BC55AC3A698817BFC24755
File Size: 1.12 MB, 1116672 bytes
MD5: 63347dce3aee02395f2abe194c23fb78
SHA1: 5d75d9a42ded47d772f1743ccf570249e8b7cd5e
SHA256: 3107857C5361FEF3F8AB0A3E76DEA3AB6A23D397206D282F46CD846A74B4E0ED
File Size: 1.18 MB, 1184256 bytes
MD5: ff7ad4e469ecaf3063028a3de15d7712
SHA1: 22a94d3bf09b8e6523f200ba18aa0e35d8818176
SHA256: 3D72A2F88F9C0B1A7279363043FB48E50A5D11AD68A49B246740060E59928E60
File Size: 553.98 KB, 553984 bytes
MD5: 136b375605a377bfa8d789d81a4417f6
SHA1: 56a8bf539c1b9927c78da7abd2db5d3de78f0368
SHA256: 0EE9EF473E76006D3614633D4718B6A1E247D161B53704B45CB341D419BD9447
File Size: 553.47 KB, 553472 bytes
MD5: 35c06f0ef964100513665a6b349976e0
SHA1: c10769e48f4846786dc18d9f8c293c41d0844f1f
SHA256: 6DE8F549BA2756AD4F04CBB53921149ABBAB8D0BE17515063B4BA40528E02D87
File Size: 2.58 MB, 2577920 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Company Name 四川效率源信息安全技术股份有限公司
File Description TODO: <文件说明>
File Version 1.0.0.12
Internal Name BackupWeChat.dll
Legal Copyright (C) <四川效率源信息安全技术股份有限公司>。 保留所有权利。
Original Filename BackupWeChat.dll
Product Name TODO: <产品名>
Product Version 1.0.0.12

File Traits

  • Default Version Info
  • dll
  • fptable
  • HighEntropy
  • imgui
  • No Version Info
  • VirtualQueryEx
  • WriteProcessMemory
  • x64

Block Information

Total Blocks: 8,556
Potentially Malicious Blocks: 103
Whitelisted Blocks: 8,136
Unknown Blocks: 317

Visual Map

0 0 0 0 0 0 ? 0 x ? ? 0 0 0 ? ? 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 ? 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 ? ? ? 0 0 ? 0 ? 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 ? ? 0 0 0 ? ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 1 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 1 0 0 ? ? 0 0 0 0 0 0 0 0 ? 0 1 0 0 1 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? ? 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 1 0 0 0 ? ? 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 1 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 1 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Trojan.Agent.Gen.DSH

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateThreadEx
Show More
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetUserObjectInformation
Other Suspicious
  • AdjustTokenPrivileges