PUP.Sciagnij
The detection of PUP.Sciagnij on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.Sciagnij?
PUP.Sciagnij is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally, and they can be difficult to remove without the right tools and expertise.
How PUP.Sciagnij Operates
PUP.Sciagnij, like other PUPs, can operate in various ways, depending on its purpose and design. It may be designed to display unwanted advertisements, collect personal data, or install additional malware on your system. In some cases, PUPs can also modify system settings, slow down your computer, or cause other issues that can be frustrating and time-consuming to resolve. It's crucial to remove PUP.Sciagnij as soon as possible to prevent further damage and protect your personal data.
Symptoms of Infection
The symptoms of a PUP.Sciagnij infection can vary, but common signs include unwanted advertisements, slow system performance, and unfamiliar programs or icons on your desktop. You may also notice that your browser settings have been changed, or that you are being redirected to unfamiliar websites. In some cases, you may not notice any symptoms at all, which is why it's essential to run regular virus scans and monitor your system for any suspicious activity.
- Unwanted advertisements or pop-ups
- Slow system performance or crashes
- Unfamiliar programs or icons on your desktop
- Changed browser settings or redirects to unfamiliar websites
How to Remove PUP.Sciagnij
- Boot your computer in Safe Mode with Networking to prevent PUP.Sciagnij from loading and to allow you to run a full scan with a reputable anti-malware tool, such as SpyHunter.
- Run a full scan with the anti-malware tool to detect and remove PUP.Sciagnij and any other malware that may be present on your system.
- Uninstall any suspicious programs or applications that you do not recognize or that you did not intentionally install.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by PUP.Sciagnij.
- Reboot your computer and run another scan with the anti-malware tool to ensure that PUP.Sciagnij has been completely removed.
Conclusion
Removing PUP.Sciagnij from your system is crucial to protecting your personal data and preventing further damage. By following the steps outlined above, you can remove this potentially unwanted program and restore your system to its normal state. It's also essential to take steps to prevent future infections, such as keeping your operating system and software up to date, using strong antivirus software, and being cautious when downloading and installing programs from the internet. By being proactive and taking the necessary precautions, you can help protect your system and your personal data from malware and other online threats.
Analysis Report
General information
| Family Name: | PUP.Sciagnij |
|---|---|
| Packers: | UPX! |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
d61302203b74f9826080e08118b580c8
SHA1:
a9449c512ee3f2b237ccb0eb72606c08c3fd3d4b
SHA256:
17DAC43C6B3A29A8C70258F749CDF9380E54DE0AFC5B33830782EF11484C7245
File Size:
2.13 MB, 2132992 bytes
|
|
MD5:
e6ad55fb3cf29fe4ea297b5c96098b8e
SHA1:
ed96671b3686167b8785669225ea5939caefe859
SHA256:
29007F1FAC251FC4DEAE82BF7DBF331E036BBCFD7F2AD27D975433BD2AE098E5
File Size:
2.13 MB, 2132992 bytes
|
|
MD5:
6f605a542f25f6c0b4ea6cadec4c4478
SHA1:
0747534f720c85cabbc5255263e41658afbd0194
SHA256:
7C222DB26E96FC8E56EAC9D257CD557B8F8B95325A627EAE78C5E40883FC441B
File Size:
2.21 MB, 2209792 bytes
|
|
MD5:
c6edd63d66cdaa2a7fc2fa4cd3677484
SHA1:
09dc06af84035dc57bfd6f3e89adde5c068294f9
SHA256:
798686A8A60D10664E4314327A22FC8425AACC997615506DBB279941B156F5D8
File Size:
2.13 MB, 2132992 bytes
|
|
MD5:
d254053cd23e0112a3cfebd86d9ce320
SHA1:
c7f3c8ab1fcfc78c555b66b6d8bc64a064bc9b97
SHA256:
0531192D1723498F3D13451F0B931B0DF5F66370CA6C01F43775D35ADB4CCA76
File Size:
2.16 MB, 2163712 bytes
|
Show More
|
MD5:
0f1975b8438c86a951d0c9c9bc05641e
SHA1:
991dc5ea914803b8cb76dd3134926895c4d002a0
SHA256:
EC561FD26BB7BBF47A064AF3E51C2997CD27182EE45A0EAF6D47BFDA8FB02B66
File Size:
2.21 MB, 2209792 bytes
|
|
MD5:
14cd809f3b3e3ada368042e609a7285e
SHA1:
071f0ca419f9ee7c04f00e4bab0d7a866c5511cf
SHA256:
5C56AC9200EB48AD877A88F361A71D965CE720D70EA0107E3C98DB40C7E85C66
File Size:
2.13 MB, 2132992 bytes
|
|
MD5:
1e50846f4ea1cc346ed51d54b9f94690
SHA1:
09a715f0ffe49d089ed8f80288c26dc953b3792a
SHA256:
6F6AB0261376AE7D7CBD151A1627BED4CA201144560E7ABB0B82230D44F649F2
File Size:
2.16 MB, 2163712 bytes
|
|
MD5:
e4376bd2873d8f8c82401c0b1bf9c597
SHA1:
dcdb7a05c6befda97161b4011d1090fc2402e63a
SHA256:
193C7389BD1739795247A1AE4AB609FFE7089E1825F9F29743737D12FD54BDA3
File Size:
2.13 MB, 2132992 bytes
|
|
MD5:
7f45b8964796445b34d7acd9f8126597
SHA1:
937b273063bee9a41c5d8216394a3f772c22d0ea
SHA256:
03E2A7277AFCD1B222EDC7CA624EFF69DA7FD630C565DF2538C927A10C069CF0
File Size:
2.21 MB, 2209792 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | AGORA S.A. |
| File Description | Manager pobierania Sciagnij.pl |
| File Version | 2.0 |
| Legal Copyright | AGORA S.A. |
| Product Name | Sciagnij.pl |
File Traits
- No Version Info
- packed
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 7,484 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 7,480 |
| Unknown Blocks: | 4 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| Network Wininet |
|
| Anti Debug |
|
| User Data Access |
|
| Network Winsock2 |
|
| Network Winsock |
|
