PUP.Keygen.MC

The detection of PUP.Keygen.MC on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent future infections.

What Is PUP.Keygen.MC?

PUP.Keygen.MC is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may exhibit unwanted behavior, such as displaying advertisements, collecting user data, or modifying system settings. They can be bundled with other software or downloaded from the internet, often through deceptive or misleading means.

How PUP.Keygen.MC Operates

PUP.Keygen.MC, like other PUPs, may operate by installing itself on your system and then executing its payload. This can include displaying unwanted advertisements, collecting user data, or modifying system settings to facilitate further malicious activity. PUPs can also create backdoors for other malware or provide a conduit for remote access to your system. The primary goal of PUP.Keygen.MC is to generate revenue for its creators, often at the expense of your system's performance and security.

Symptoms of Infection

If your system is infected with PUP.Keygen.MC, you may experience a range of symptoms, including unwanted advertisements, pop-ups, or browser redirects. Your system may also exhibit slowed performance, crashes, or freezes. Additionally, you may notice unfamiliar programs or icons on your desktop or in your system tray. In some cases, PUPs can also lead to more severe consequences, such as data theft or system compromise.

• Unwanted advertisements or pop-ups
• Browser redirects or modified search results
• Slowed system performance or crashes
• Unfamiliar programs or icons on your desktop or system tray
• Data theft or system compromise

How to Remove PUP.Keygen.MC

1. Boot your system in Safe Mode with Networking to prevent PUP.Keygen.MC from loading and to allow for a clean removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.Keygen.MC.
3. Uninstall any suspicious programs or applications that may be related to PUP.Keygen.MC.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modifications made by PUP.Keygen.MC.
5. Reboot your system and perform a follow-up scan to ensure that PUP.Keygen.MC has been completely removed.

Conclusion

Removing PUP.Keygen.MC from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a safe and secure state. It is essential to remain vigilant and take proactive measures to prevent future infections, such as keeping your operating system and software up-to-date, using reputable anti-malware tools, and being cautious when downloading software or clicking on links from unknown sources.

Analysis Report

General information

Family Name:	PUP.Keygen.MC
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: b5abd878a1d98be2cf84f0902b490795 SHA1: b3cbcebe72473396fd7dd0590a1087cb649601cd SHA256: DFC8F2C1512813E199F99CB1FF9C3C6C7761725D17DD3AC042FBB7B391AF8FEF File Size: 28.16 KB, 28160 bytes

MD5: dbfab4f5c31dde1fe040dd0eb4d84470 SHA1: d67b84188c4d73a7f5f241a8f9e947e6840c9f3c SHA256: 28D2B2039F2D263FFCA2E0EE230D87EB1F2B3E9F23B55A5F63E6DE00597D62AE File Size: 17.92 KB, 17920 bytes

MD5: 40c2910169d409d2e188b6e81755d7f7 SHA1: 795df5f3751ec217da3367d0737ee1839584a10f SHA256: 7D15DBD6DA7F6A97B262885F3082032F2258184AEE57BCDDD212EE4EB0853EFD File Size: 17.92 KB, 17920 bytes

MD5: 1b9880db089df6743d2b4bde3098a16e SHA1: b64ce88951216ef192f08d2afcde2c1f55570627 SHA256: AF6242AF654068828FAD226566F31304D9716F02FAB83495E8B621E794D1B833 File Size: 325.48 KB, 325480 bytes

MD5: 3a3ec63941ccfea12a47b75e421d70c0 SHA1: 97ad0056dcb819288ab7cee0338e7b90f4b9d48f SHA256: 2190AD78073B762F6EDA703EA3FDA121FD378ECE93392D724A0ADBDCA9F92943 File Size: 35.33 KB, 35328 bytes

Show More

MD5: ffab7ba2bd3248268319afe27d0569a0 SHA1: b6431306f2603756e1b61d8dc699934cec526d51 SHA256: 15F985D0B0EFB445F00B7467D2B360ED5F39AB7DAC7B8818E3655B515E0F7A50 File Size: 43.52 KB, 43520 bytes

MD5: 119ffff324ec957f9ce8a2003c759f35 SHA1: 0f9cefcfe673e82922b88b0660e7cd10ced95e80 SHA256: E28FCECBC35B11029D34F212F564D8F915D343C15F1A1D64BF82C026607102FD File Size: 40.97 KB, 40970 bytes

MD5: bdfbcbda4221e943739a1c1829845c52 SHA1: cd7273b4f79eb462ee6bece4a7fceb159aa61dcd SHA256: ACDA7CFC1515A8D68225500E4E33BA685DE487B8F8A62C720F13BE91047921F5 File Size: 46.59 KB, 46592 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Microsoft
Company Web Page	www.carabez.com
Compiler	MSASM32 8.2 SP2a from MASM32 Project
File Description	Calcula Homoclave del RFC y CURP
File Version	1.00 1,2007,02,13
Internal Name	Rfc+Curp Win
Legal Copyright	©2006-2007 Francisco Javier Carabez Barajas
Legal Trademarks	©2006-2007 Francisco Javier Carabez Barajas
Mail Address	franciscojavier@carabez.com
Original Filename	Rfc_Curp.exe Win.exe
Product Name	Rfc+Curp Win
Product Version	1.00 1,2007,02,13

File Traits

• 2+ executable sections
• HighEntropy
• No Version Info
• packed
• SusSec
• WriteProcessMemory
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	31
Potentially Malicious Blocks:	6
Whitelisted Blocks:	7
Unknown Blocks:	18

Visual Map

? ? ? 0 ? ? ? ? ? 0 ? ? x x ? ? 0 0 0 ? ? ? ? ? ? x x x 0 x 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Keygen.M
• Keygen.MC
• Patcher.B
• Small.Q

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Other Suspicious	SetWindowsHookEx