PUP.SearchSuite.C

The detection of PUP.SearchSuite.C on your system indicates the presence of a potentially unwanted program (PUP) that may be causing unwanted changes to your browser settings or displaying unwanted advertisements. PUPs like PUP.SearchSuite.C are not typically malicious in the same way as viruses or Trojans, but they can still significantly disrupt your computing experience and potentially expose you to more serious threats. Understanding what PUP.SearchSuite.C is, how it operates, and how to remove it is crucial for restoring your system's security and performance.

What Is PUP.SearchSuite.C?

PUP.SearchSuite.C is classified as a potentially unwanted program, which means it is a software that you may not have intentionally installed, or it may be a program that you installed but does not behave as expected. PUPs can be bundled with other software, downloaded from the internet, or installed through deceptive means. They often aim to modify browser settings, display unwanted advertisements, or collect user data without consent. The presence of PUP.SearchSuite.C suggests that your system may be vulnerable to further infections or that you may have inadvertently installed it alongside another program.

How PUP.SearchSuite.C Operates

PUPs like PUP.SearchSuite.C typically operate by integrating themselves into your web browser or operating system, often through extensions, add-ons, or by modifying system settings. They can redirect your search queries to alternative search engines, display pop-up advertisements, or change your homepage without your consent. In some cases, PUPs may also collect your browsing data, such as search history or websites visited, to tailor advertisements to your interests. This behavior can significantly degrade your browsing experience and potentially lead to more severe security issues if not addressed.

Symptoms of Infection

Identifying the symptoms of a PUP.SearchSuite.C infection can be crucial for early detection and removal. Common symptoms include unwanted changes to your browser's homepage or default search engine, an increase in pop-up advertisements or unwanted browser extensions, and a general slowdown in system performance. You might also notice that your browser redirects to unfamiliar websites or that you are seeing more advertisements than usual. These symptoms can indicate the presence of a PUP and should prompt you to take action to secure your system.

How to Remove PUP.SearchSuite.C

1. Enter Safe Mode with Networking to prevent PUP.SearchSuite.C from interfering with the removal process. This mode allows you to use the internet to download removal tools while limiting the functionality of malicious programs.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter. These tools are designed to detect and remove PUPs and other types of malware, including those that may be associated with PUP.SearchSuite.C.
3. Uninstall any suspicious programs that you do not recognize or that were installed around the time you first noticed symptoms of the infection. Be cautious and only uninstall programs that you are sure are not essential to your system's operation.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings. This action will remove any changes made by PUP.SearchSuite.C, including unwanted extensions or modified settings.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that PUP.SearchSuite.C has been completely removed. This step is crucial for verifying that your system is clean and that no remnants of the PUP remain.

Conclusion

Removing PUP.SearchSuite.C from your system requires careful attention to detail and the use of appropriate removal tools. By understanding the nature of PUPs and following the steps outlined for removal, you can restore your system to a secure and performant state. It's also important to adopt preventive measures, such as being cautious with downloads, reading user agreements carefully, and regularly scanning your system for malware, to avoid future infections. Remember, the key to maintaining system security is vigilance and proactive maintenance.

Analysis Report

General information

Family Name:	PUP.SearchSuite.C
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: f96b0b0e0451b527cd2890708fd522d1 SHA1: 527ddd229a03a3c147cdf114532ca30e8c6825f0 File Size: 117.89 KB, 117895 bytes

MD5: 5af261b14373fa1662eca4137feaeede SHA1: c1ce2a8c142824624e69441c74d63e89470e8858 SHA256: DFD045B47037BFB708678372013C4281F817C38AE1F02146C8FBD6184C2D48A6 File Size: 564.26 KB, 564264 bytes

MD5: 581105e7e8823295ddd6c293fa7f65cf SHA1: 0f9974e635bea8915e1ba34a9db9d5e716ed55ab SHA256: 781D3E96C656A8790975AB46D4D01A43E19088DCED291A8C0863E431C9A5D511 File Size: 1.30 MB, 1296016 bytes

MD5: 1e79938cc341b1097e16de47caf84d58 SHA1: da30def711df8041aa480c858ad22d40e811b7c4 SHA256: 5B8A1283932E800CFE98FB8D96A0BFE042B1F757E8C0715E8FB771716EB12301 File Size: 289.22 KB, 289216 bytes

MD5: ff0d3d1f7b12234c01b4bff3b527283c SHA1: 9dc148df45b1b41d0af3d7826a43ea99bd91b6e2 SHA256: FDD2E16D07B628D13215EBDF0B85A397E748F8D7AD3AEC5A82A2044753EE4C3F File Size: 113.98 KB, 113984 bytes

Show More

MD5: 9a5f5c8449df8f34719bb931eb21e5cc SHA1: 006f919b306b44a61edf0b9309ff72953358efee SHA256: D5466042FF4FC5695B6E353724EFBDD5CED0E42F65B2EF4C491AD26525660E97 File Size: 192.18 KB, 192176 bytes

MD5: f7e7cb389f66d029e575960b8556ce32 SHA1: 0f8bba35f72411a43f0fe936f87b2c08aba8c740 SHA256: 26AC834700CF6EF4D760522FA68CB56D0CA979D1E457EDC3CEBEFA8280DE8557 File Size: 1.35 MB, 1350888 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	iMesh Inc Koyote-Lab Inc Torch Media, Inc Viber Media Inc
File Description	Free FLV Converter Uninstall Music Toolbar Uninstall Torch Browser Torch Browser Uninstall Viber Install Viber Uninstall
File Version	33.0.0.7209 33.0.0.6907 5.0.0.12627 3.0.0.134678 1.0.0.129246
Legal Copyright	Copyright (c) 2005 - 2014 Copyright (c) 2012 Copyright (C) 2014 Torch Media Inc.
Product Name	Free FLV Converter iMesh Torch Viber
Product Version	33.0.0.7209 33.0.0.6907 5.0.0.12627 3.0.0.134678 1.0.0.129246

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Torch Media Inc.	Thawte Code Signing CA - G2	Self Signed
Viber Media S.a.r.l	Thawte Code Signing CA - G2	Hash Mismatch
Viber Media S.a.r.l	Thawte Code Signing CA - G2	Self Signed
iMesh Inc.	Thawte Code Signing CA - G2	Self Signed

File Traits

• Badsig nsis
• big overlay
• HighEntropy
• Installer Manifest
• Installer Version
• nosig nsis
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• AdGazelle.A
• Downloader.Agent.TJ
• Mobogenie
• SearchSuite.C
• Zusy.CA

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe	Generic Read,Write Attributes
\device\namedpipe	Generic Write,Read Attributes
c:\programdata\datamngr	Synchronize,Write Attributes
c:\users\torch\log.log	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb4800.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsb4800.tmp\registry.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb4800.tmp\registry.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsb4800.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsb4800.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsdf0df.tmp\modern-header.bmp	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nsdf0df.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsdf0df.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsdf0df.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\banner0.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\banner1.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\banner2.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\banner3.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\banner4.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\banner5.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\helper.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\registry.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\uninstall.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsk8012.tmp\userinfo.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl46b7.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsn6582.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsn6582.tmp\registry.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsn6582.tmp\registry.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsn6582.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsn6582.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nspc221.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nspc221.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nspc221.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nspc221.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nspc221.tmp\userinfo.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\applicationid.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\findprocdll.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\killprocdll.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\nsexec.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\registry.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsu2b62.tmp\uac.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsw47e0.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsy6572.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\~nsu.tmp\au_.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
extensions\chrome.manifest	Generic Write,Read Attributes
extensions\components\datamngrhlpff29.dll	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Kasnudru\AppData\Local\Temp\~nsu.tmp\Au_.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Kasnudru\AppData\Local\Temp\~nsu.tmp\Au_.exe\??\C:\Users\Kasnudru\AppData\Local\Temp\~nsu.tmp	RegNtPreCreateKey
HKLM\software\wow6432node\datamngr\general\patches::1	1	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Cvhiympy\AppData\Local\Temp\nsn6582.tmp\registry.dll	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Cvhiympy\AppData\Local\Temp\nsn6582.tmp\registry.dll\??\C:\Users\Cvhiympy\AppData\Local\Temp\nsn6582.tmp\	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Qnmiruan\AppData\Local\Temp\~nsu.tmp\Au_.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Qnmiruan\AppData\Local\Temp\~nsu.tmp\Au_.exe\??\C:\Users\Qnmiruan\AppData\Local\Temp\~nsu.tmp	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\??\C:\Users\Ltlezpxb\AppData\Local\Temp\~nsu.tmp\Au_.exe	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\??\C:\Users\Ltlezpxb\AppData\Local\Temp\~nsu.tmp\Au_.exe\??\C:\Use	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�k U�8 �B �� ۀ B��5Bx�< #@�#�� $��%f�%� *9 1HO1�D9ߔ@V�@��LօN$ N�R20U_* `�2a$ e0T e�hg��n�A q( rnJr�B y�y�9y�^{�={���wx�P��� ��! ��� �����7 ����3 �]����������������� �6��T��O����T�	RegNtPreCreateKey

Show More

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�k W�8 �B �� ۀ B��5Bx�< #@�#�� $��%f�%� *9 1HO1�D9ߔ@V�@��LօN$ N�R20U_* `�2a$ e0T e�hg��n�A q( rnJr�B y�y�9y�^{�={���wx�P��� ��! ��� �����7 ����3 �]����������������� �6��T��O����T�	RegNtPreCreateKey
HKLM\software\wow6432node\datamngr\general::oldpver		RegNtPreCreateKey
HKLM\software\wow6432node\datamngr\general::clid	{BC5A4AEF-85A0-4E6B-99E7-C443D5164EFD}	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\runonce::removeimeshdatamngr	cmd.exe /c RD /S /Q ""	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�k Y�8 �B +� �� ۀ B��5Bx�< #@�#�� $��%f�%� *9 1HO1�D9ߔ@V�@��LօN$ N�R20U_* `�2a$ e0T e�hg��n�A q( rnJr�B y�y�9y�^{�={���wx�P��� ��! ��� �����|��7 ����3 �]����������������� �6��T��O�	RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Windows\SystemTemp\77e37ce0-8214-4414-aced-551c5ae204d7.tmp\??\C:\Windows\SystemTemp\e28eadcf-6ab0-4d8c-8821-7ce9a6aba1	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe	⁛ᬈ刹ǜ	RegNtPreCreateKey
HKLM\software\classes\applications\0f8bba35f72411a43f0fe936f87b2c08aba8c740_0001350888::ishostapp		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Shell Execute	CreateProcess
Keyboard Access	GetKeyState
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant Show More ntdll.dll!NtCreateSection ntdll.dll!NtCreateSemaphore ntdll.dll!NtDuplicateObject ntdll.dll!NtDuplicateToken ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForAlertByThreadId ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWorkerFactoryWorkerReady ntdll.dll!NtWriteFile UNKNOWN
Process Terminate	TerminateProcess
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Network Winsock2	WSAStartup
Other Suspicious	AdjustTokenPrivileges

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Kasnudru\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\

"C:\Users\Qnmiruan\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\

"C:\Users\Ltlezpxb\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\

"C:\Users\Hcfthxpx\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=c:\users\user\downloads\

C:\Users\Hcfthxpx\AppData\Local\Torch\Application\33.0.0.7209\Installer\setup.exe --uninstall

Show More

netsh advfirewall firewall delete rule name="hola_plugin.exe" program="C:\Users\Hcfthxpx\AppData\Local\Torch\Plugins\Hola\hola_plugin.exe"