PUA

Falco Bundleware (PUA) removal

Malware Removal

The Falco Bundleware (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Falco Bundleware (PUA) virus can do?

  • Behavioural detection: Executable code extraction – unpacking
  • Sample contains Overlay data
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Falco Bundleware (PUA)?


File Info:

name: 591335766AB5A18DDFC0.mlw
path: /opt/CAPEv2/storage/binaries/1e413e90878255e2897765b4f70e9442f851270da9b18ec4d95f674a69dc9ae2
crc32: 2C3C5B30
md5: 591335766ab5a18ddfc03fbfa3617feb
sha1: 220ffd72790f74ff6561944b34610b63a78c6964
sha256: 1e413e90878255e2897765b4f70e9442f851270da9b18ec4d95f674a69dc9ae2
sha512: a558f6ba13e1192627de17f4d7e135a4425e5d4641dcf2afe338ea49973af8fc6a3019a659076b451e1adad67f6aac5447f0418767ead412bb8c0febc26a8fec
ssdeep: 98304:o1QTsjLx5EXfWvtHarzK7UKg4aBhi4Apb1R4QvTSPzC:MPLxKXfWvNaPGg44fsTSm
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T153061227B298A53EC49E37350673A05098FBA66DF817BD1676F0C48CCF664C01E3AB65
sha3_384: e7442fe184c444fee7c72174838a066ba7dd2e3f8f6c3bbb7f5a2742d922f2ff8ef02331e89de1cbaae703212a907064
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2019-10-12 11:15:57

Version Info:

Comments: This installation was built with Inno Setup.
CompanyName: FalcoWare, Inc.
FileDescription: Necromaton Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: Necromaton
ProductVersion:
Translation: 0x0000 0x04b0

Falco Bundleware (PUA) also known as:

BkavW32.AIDetectMalware
LionicAdware.Win32.Falco.2!c
Cylanceunsafe
SangforPUP.Win32.Agent.V7gp
CynetMalicious (score: 100)
AvastWin32:VSok-A [PUP]
SophosFalco Bundleware (PUA)
SentinelOneStatic AI – Suspicious PE
Antiy-AVLGrayWare[AdWare]/Win32.Falco.a
MicrosoftPUA:Win32/Presenoker
GDataWin32.Application.Falco.A
VaristW32/FalcoBundler.B.gen!Eldorado
MalwarebytesAdware.RelevantKnowledge
TrendMicro-HouseCallTROJ_GEN.R002H0CAI24
IkarusPUA.Falco
MaxSecureTrojan.Malware.121218.susgen
FortinetRiskware/Application
AVGWin32:VSok-A [PUP]
DeepInstinctMALICIOUS
CrowdStrikewin/grayware_confidence_100% (W)

How to remove Falco Bundleware (PUA)?

Falco Bundleware (PUA) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment