PUP.ProudBrowser.A

The detection of PUP.ProudBrowser.A on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your browser and overall system performance. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent potential harm.

What Is PUP.ProudBrowser.A?

PUP.ProudBrowser.A is a type of malware that is categorized as a potentially unwanted program. This means that while it may not be as harmful as other types of malware, such as viruses or trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally by users, usually through software bundles or deceptive download buttons.

How PUP.ProudBrowser.A Operates

PUP.ProudBrowser.A operates by integrating itself into your browser, where it can collect data on your browsing habits, search queries, and other online activities. This information can be used to display targeted advertisements, which may be intrusive and disrupt your browsing experience. Additionally, PUP.ProudBrowser.A may also modify your browser settings, such as changing your default search engine or homepage, without your consent.

It's also possible that PUP.ProudBrowser.A may be used to distribute other types of malware or unwanted software, further compromising your system's security. The presence of this PUP can also slow down your system and cause stability issues, making it essential to remove it as soon as possible.

Symptoms of Infection

If your system is infected with PUP.ProudBrowser.A, you may notice several symptoms, including unwanted advertisements, browser redirects, and changes to your browser settings. You may also experience system slowdowns, crashes, or instability. In some cases, you may notice suspicious programs or toolbars installed on your system, which can be difficult to remove.

• Unwanted advertisements or pop-ups
• Browser redirects or changes to your default search engine
• System slowdowns or crashes
• Suspicious programs or toolbars installed on your system

How to Remove PUP.ProudBrowser.A

1. Boot your system in Safe Mode with Networking to prevent PUP.ProudBrowser.A from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious components related to PUP.ProudBrowser.A.
3. Uninstall any suspicious programs or toolbars that may be associated with PUP.ProudBrowser.A. Be cautious when uninstalling programs, as some may be legitimate or required by your system.
4. Reset your browser settings to their default values. This can usually be done through the browser's settings menu, and it's essential to reset settings for all installed browsers, including Chrome, Firefox, and Edge.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that all components of PUP.ProudBrowser.A have been removed.

Conclusion

Removing PUP.ProudBrowser.A from your system is crucial to prevent potential harm and restore your browser and system performance. By following the steps outlined above, you can effectively remove this PUP and prevent future infections. It's also essential to be cautious when downloading software and to always read user agreements and privacy policies before installing any programs. Regularly scanning your system with reputable anti-malware tools and keeping your operating system and software up to date can also help prevent malware infections and ensure your system's security and stability.

Analysis Report

General information

Family Name:	PUP.ProudBrowser.A
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 94d36d75f9e585822240b2852e22bf0b SHA1: c4dc57688aa69f5fd5637d5ae7695561fc3fe69e SHA256: F0C07363B44F90EDED8EAFFA6678EF98132485975136CEF294A32DDA560E210C File Size: 2.96 MB, 2958728 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have relocations information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	Ramadutha Software Services
File Description	ProudBrowser Setup
File Version	1.0.1.0
Legal Copyright	Ramadutha Software Services © 2021
Product Name	ProudBrowser
Product Version	1.0.1.0

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Ramadutha Software Services	USERTrust RSA Certification Authority	Root Not Trusted
Ramadutha Software Services	USERTrust RSA Certification Authority	Root Not Trusted

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-msenu.tmp\c4dc57688aa69f5fd5637d5ae7695561fc3fe69e_0002958728.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-u0him.tmp\_isetup\_isdecmp.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-u0him.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-u0him.tmp\proudbrowserplugin.dll	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey

Show More

HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\wow6432node\proudbrowser::ss		RegNtPreCreateKey
HKLM\software\wow6432node\proudbrowser::mp	qa7tOYIHgSzIhcOs+AbVOxe4uehvALBg9wTALxls9D4fS31WTlVZXcJeIuhZqmJyhRtlgNgrj9gkmiwasbOUP+2zDbiyCfQsD9jYCN49Ims=	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess
User Data Access	GetUserObjectInformation
Keyboard Access	GetKeyState
Network Wininet	HttpOpenRequest HttpSendRequest InternetConnect InternetOpen

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Nefavqwz\AppData\Local\Temp\is-MSENU.tmp\c4dc57688aa69f5fd5637d5ae7695561fc3fe69e_0002958728.tmp" /SL5="$30238,1966422,843264,c:\users\user\downloads\c4dc57688aa69f5fd5637d5ae7695561fc3fe69e_0002958728"