Beijing Rising Adware (PUA) malicious file

The Beijing Rising Adware (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Beijing Rising Adware (PUA) virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Beijing Rising Adware (PUA)?


File Info:
name: BA41A50C7C5BD7DA7EEF.mlw
path: /opt/CAPEv2/storage/binaries/ac7f4f7e83fa34cf3e79eb25493aeabec2045accfd4cd1ab617aae0b5b21f062
crc32: A1E97989
md5: ba41a50c7c5bd7da7eefc26dc378ad12
sha1: ab2d3003cc91537d62bbc785921fe724e70e6f83
sha256: ac7f4f7e83fa34cf3e79eb25493aeabec2045accfd4cd1ab617aae0b5b21f062
sha512: 76fbe2b9d42874368c049c1173d69b476e1298377da01c4d4dc3f4e18fca858edf2507f5ee481b27f05cb0c1d996f9fe8b764d222efd609eeb44ee9fdd4e1291
ssdeep: 24576:RgCFgVNfvw1sjGAapMU6BJk1XCzFfFeblWxdvdj6:RngVNXLE6s1X4FfSYzvdm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DB25232131D0CCF2D25725328D557BAAA3BEC532193549A77B982B7E2F36A80D037396
sha3_384: a17e41e04b3bd241118dd02f7be33e70ae329b4b3e7a9b80c201a9a366b83d3cc9a45104cacca6f819c054ad95b30592
ep_bytes: 6a6068f0cf4100e82cfcffffbf940000
timestamp: 2014-06-19 06:48:23

Version Info:
0: [No Data]

Beijing Rising Adware (PUA) also known as:

Lionic	Trojan.Win32.Rising.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.71654043
FireEye	Trojan.GenericKD.71654043
Skyhigh	BehavesLike.Win32.Generic.dc
ALYac	Trojan.GenericKD.71654043
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
K7GW	Adware ( 004da5f91 )
CrowdStrike	win/grayware_confidence_100% (D)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Rising.A potentially unwanted
BitDefender	Trojan.GenericKD.71654043
NANO-Antivirus	Trojan.Win32.Midie.dzxctz
Emsisoft	Trojan.GenericKD.71654043 (B)
VIPRE	Trojan.GenericKD.71654043
Trapmine	suspicious.low.ml.score
Sophos	Beijing Rising Adware (PUA)
GData	Trojan.GenericKD.71654043
Antiy-AVL	RiskWare[Downloader]/Win32.Agent
Arcabit	Trojan.Generic.D4455A9B
Cynet	Malicious (score: 100)
McAfee	GenericRXMO-ID!BA41A50C7C5B
MAX	malware (ai score=81)
Malwarebytes	Generic.Malware.AI.DDS
Yandex	Trojan.GenAsa!NvkTuPyKx/U
Ikarus	PUA.Rising
Fortinet	Riskware/Rising
DeepInstinct	MALICIOUS

How to remove Beijing Rising Adware (PUA)?

Beijing Rising Adware (PUA) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X