PUP.OpenInstall.A

The detection of PUP.OpenInstall.A on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take appropriate steps to remove it to prevent potential harm.

What Is PUP.OpenInstall.A?

PUP.OpenInstall.A refers to a type of potentially unwanted program that may have been installed on your system without your full knowledge or consent. PUPs are software applications that may not be malicious in the classical sense but can still cause problems, such as displaying unwanted advertisements, collecting user data, or altering system settings. The term "PUP" is a broad category that encompasses various types of unwanted software, including adware, browser hijackers, and other types of nuisance programs.

How PUP.OpenInstall.A Operates

PUPs like PUP.OpenInstall.A often operate by exploiting vulnerabilities in software or by using deceptive tactics to trick users into installing them. They may be bundled with other software applications, or they may be downloaded from the internet through misleading advertisements or fake updates. Once installed, PUPs can execute a range of activities, including displaying pop-up ads, redirecting browser searches, or collecting user data such as browsing history or personal information.

Symptoms of Infection

If your system is infected with PUP.OpenInstall.A, you may notice several symptoms, including unwanted advertisements or pop-ups, slower system performance, or changes to your browser settings. You may also experience redirects to unwanted websites, or you may find that your search engine has been altered. In some cases, PUPs can also cause system crashes or freezes, or they may interfere with the operation of other software applications.

• Unwanted advertisements or pop-ups
• Slower system performance
• Changes to browser settings
• Redirects to unwanted websites
• System crashes or freezes

How to Remove PUP.OpenInstall.A

1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a clean removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of the PUP.
3. Uninstall any suspicious programs that may be related to the PUP, taking care to follow the uninstallation instructions carefully.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by the PUP.
5. Reboot your system and perform a follow-up scan to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.OpenInstall.A from your system requires a combination of technical knowledge and caution. By following the steps outlined above and using reputable anti-malware tools, you can help to ensure that your system is free from the potential risks associated with this PUP. It's also essential to practice safe computing habits, such as avoiding suspicious downloads and being cautious when clicking on links or advertisements, to prevent future infections. By taking a proactive approach to system security, you can help to protect your computer and your personal data from the threats posed by PUPs like PUP.OpenInstall.A.

Analysis Report

General information

Family Name:	PUP.OpenInstall.A
Signature status:	Modified signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: e2ac521e484ea19e08a9a4c9f5ba953c SHA1: b4c3e5a4066e5bac5121665c6e0b868cd9351a79 File Size: 424.34 KB, 424336 bytes

MD5: 08009d2d9bd7f1311c9133ce2b79335c SHA1: 90c1904c0aab8aed2ffd89dcb1d9f7aa081f3772 File Size: 370.13 KB, 370128 bytes

MD5: c4ba7184d6b9187f91d4e42d795edd80 SHA1: 9876b0dd101e764f4dde2ff9cd972cd0083613f2 SHA256: 27E86807B4289DC54B49730F13B0E0980778EE9C946A946D5AF23A7708FBF4ED File Size: 314.90 KB, 314896 bytes

MD5: a52435eec6686361bce38a5168eaff84 SHA1: 1be4a954cb24e7575b4bae89f1d51d728c3bee6d SHA256: A5F263191CC595021BA97B51CBE48A7CC8F1A3EFE2B48244928A91C2D9E4098E File Size: 467.47 KB, 467472 bytes

MD5: e4727ff2a6416d562e6086fc64e12418 SHA1: c1a201b421e6104da61f2a0dc4254923d9671f69 SHA256: 32DC8C50FCB70079038B90F29F507F5F76CBFF90A3527F740B55AD2A469FDDB8 File Size: 424.37 KB, 424368 bytes

Show More

MD5: 567029543a1fc8778992ecb98182d235 SHA1: 87c9aebfa0362f10615de87ac56458b7cd80190f SHA256: A735F56060429EE26E6EE9301DB9BED919EACA9DEAAFFD56145CE8693F8DF971 File Size: 438.38 KB, 438384 bytes

MD5: 101b0ef1161255286ec8e210ea1df578 SHA1: b120b4387738f512dc5dce6b1a0ab6d94416a98f SHA256: D0ABA1E2A8BBB10C18E0740862CBEA70B7AF4F833D0F43E11F7400DB47D227D4 File Size: 368.88 KB, 368880 bytes

MD5: 703fe8774503541ff5588e89a139c1ca SHA1: dbbc1a2031bd621bbdea6c21ce8c914441120e71 SHA256: EC9D6A19A4C9314F7E6557A3B33874C3FCC0BA4E6975C3AE137AAE303B250A08 File Size: 424.34 KB, 424344 bytes

MD5: 95fca8383c7c01b3faf3e243fad1483b SHA1: 9c558b2b607515a2f9fc53213c4e338145fc9b19 SHA256: E60FEF2905A7756DF116C845D362225D9D633B8AF1066E82C928A0AD060FFA9C File Size: 368.08 KB, 368080 bytes

MD5: af1f66750702f6ef8a67d1e2017928f6 SHA1: b1060dea810c6b2e947376fa2083989f8dd9d0ba SHA256: E396104846DD5F020900BB4AF43C9F9C39284AC763DBA74F8B05D5B5EB3E954D File Size: 435.34 KB, 435336 bytes

MD5: 2c6569c3e9be8bbfc18676309baf6b15 SHA1: 39cfb84b6ed24466d00f55f306d626787b622bfe SHA256: DBE0F3EF02F7C1292F02DA6BBF58E75D2ABD3422319D2D413C2AF67FCACE8122 File Size: 424.35 KB, 424352 bytes

MD5: ad47a0b264bb26a7716ca0cea906046f SHA1: 5ffdbd781625298a07ee0cd4667bfd524ded6865 SHA256: BC82E25EF5DA18E0B6D7900C87D3031820505AF89246312A4C75904A7DAE01B5 File Size: 368.07 KB, 368072 bytes

MD5: def261e4c71ff2032b3694f474cc2fb0 SHA1: b14e66ca0cf7cb34bdf486a965d39e89f460744f SHA256: FB9F7A55BEEE33C9431D12366E25BD2BAFEA1821C5248379F355075A0A61FAE9 File Size: 368.08 KB, 368080 bytes

MD5: 7f5859298948d617a598600eedc7fb34 SHA1: b6c8b5b94b68d7a2692ea2d48bcb60b5e534d002 SHA256: 775DF90529D5B676499F983CF85EC4F8C82D9E65B2A401A50FBCE52C4CD82CA6 File Size: 368.88 KB, 368880 bytes

MD5: 4bbe6b9e7fc5582b51b673d9598d1b11 SHA1: 56e01ffc9cd146dd42eb9a03baecaa46555c5eb1 SHA256: A1E4DC32BC0667A86C199E93566B767428121E3FA5EF8DE19EDB5F479A5B13F6 File Size: 424.36 KB, 424360 bytes

MD5: 72b7dcb09ab4a9bf608c774d891b2a5d SHA1: 5f0d86a3501985b7251828b836e96191b6c51ee5 SHA256: 0E6BCA9170C74619E09B1FC3603A9D62FE49C561807A74E19FDB3E85996D3F2A File Size: 368.12 KB, 368120 bytes

MD5: 6ee0ce7ca0f5e25570a9a132493a9aa8 SHA1: 878a7f6368a1fa4498b9bc1e909859a7a9107907 SHA256: BC41D38273A642B8659A6E9D673C607135A74307BEEF5C8635A7EBC9CDDC7FEC File Size: 471.48 KB, 471480 bytes

MD5: 39b77feaa718a91c1fdcbd10e660d61a SHA1: 783c6d84e34ee36bfae1552a43015e2f6e70c547 SHA256: B37DC88D5DB2D0AEDDC353AA2B1BC78BA82645982A9FCDAC1B319B944FB1D3A4 File Size: 467.50 KB, 467496 bytes

MD5: 0b0c9b5b2befc52dda540c0bb2505cbd SHA1: fdb2e6d1fb51f64ba9511f483dd2da7a1486ea55 SHA256: 37CCB59A2E70A3BA605C889CD645D78C730B53BBE89DCB7BB6ED79A4D588DDC4 File Size: 424.42 KB, 424424 bytes

MD5: 99ec6e0daef18fa120d2a4d6c8042d79 SHA1: 5a30f20a800aa0db438fd4e47417e05309959834 SHA256: 37B12F34B793818CA43089A578964E3A1215AE8A44BB2B7270BB8735A4409D7D File Size: 362.95 KB, 362952 bytes

MD5: 3f28b27be79eb0dcb8b8b552c2362433 SHA1: 1d0bd0ea6a5eaf08fb28aecfed9b8fc53f888da3 SHA256: 8A6B5DEAB7AC0AC8FFC5DC3848BCEB5965D5035EFC0B20EEC9DF495D7A85EF2F File Size: 424.40 KB, 424400 bytes

MD5: 493fee3bb8b1261f2ebcf2a78aa33491 SHA1: b53926def711067db816e1c559944c8056b57988 SHA256: DA05D56F5D6BA4CA3090690FFE97E3CA6FF9ADA4B215634CE6CC1D3539AB7C4F File Size: 424.34 KB, 424344 bytes

MD5: cfaf042755af7a018b15fbb41bf7391f SHA1: 9eaa8509d1853a57a501671187820e53dae39d39 SHA256: FAE35D8BD072CE5E8C35362E41C3DCA1407C2BBD61D43B32D02172AED4158405 File Size: 424.35 KB, 424352 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Show More

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Participatory Culture Foundation Ringier Axel Springer Polska Shareware.de TuneUp WinZip Computing Yahoo! Inc.
File Description	Freeware.de Download Manager Setup Komputerswiat.pl Download Manager Setup Miro Video Converter Setup TuneUp Utilities 2012 WinZip 17 Setup WinZip 17.5 Setup WinZip Driver Updater Setup WinZip Registry Optimizer Setup Yahoo! Download Manager
File Version	1,19,0,3503 1,18,0,3287 1,18,0,2949 1,18,0,2896 1,18,0,2810 1,18,0,2719
Legal Copyright	Copyright © 2012 Copyright © 2013
Legal Trademarks	TuneUp Utilities(tm)
Product Name	Freeware.de Download Manager Komputerswiat.pl Download Manager Miro Video Converter TuneUp Utilities 2012 WinZip 17 WinZip 17.5 WinZip Driver Updater WinZip Registry Optimizer Yahoo! Download Manager
Product Version	1,19,0,3503 1,18,0,3287 1,18,0,2949 1,18,0,2896 1,18,0,2810 1,18,0,2719

File Traits

• HighEntropy
• Installer Manifest
• Installer Version
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	23
Potentially Malicious Blocks:	13
Whitelisted Blocks:	10
Unknown Blocks:	0

Visual Map

x x x x 0 0 x x x x x x 0 0 0 0 0 x 0 0 x 0 x

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• OpenInstall.A

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\oic11e9.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic16e0.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic1e47.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic2a24.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic2b7c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic30f5.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic311a.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic41a3.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic44b5.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic487e.tmp	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\oic4dc9.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oic559e.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oica2a3.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oica7c4.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oica7d3.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicaa0a.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicbaaa.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicbaba.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicbb94.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oice7d8.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicf087.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicf254.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\oicf600.tmp	Generic Write,Read Attributes