Generic PUA AB malicious file

The Generic PUA AB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic PUA AB virus can do?

Creates RWX memory
Reads data out of its own binary image
Drops a binary and executes it
Unconventionial language used in binary resources: Hebrew
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Network activity detected but not expressed in API logs
Anomalous binary characteristics
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Generic PUA AB?


File Info:
crc32: 38189F7D
md5: ef4edec85d28864d50f6f6df0cdc8dce
name: EF4EDEC85D28864D50F6F6DF0CDC8DCE.mlw
sha1: 013f10357b75861b81f38073142a209f4183214a
sha256: 8360200ffd4887485fdb9b00383b034b0d7df9bb63b4299bcadc9c59c52d8c1b
sha512: 45e669699fd716e50350029245cbaaa62125bcc82bcf6a95cd730e21c6fe1350c7700297327fbcd28a052e5f917b37d3faa28e1c0e37d2f5a66d6f1118cfe5ce
ssdeep: 49152:s+7fBjFMEOfArQqC8BwLirfa9pOGXMgs6w8RN6s3h:FBhr9w+rC9pOGXMgs6wENT
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2002-2003, Pantaray Software Systems
InternalName: 
FileVersion: 5.0.0.0
CompanyName: Pantaray Research LTD.
LegalTrademarks: 
Comments: 
ProductName: QSetup Installation Suite
ProductVersion: 5.0.0.0
FileDescription: QSetup SFX Kernel
OriginalFilename: Stub.exe
Translation: 0x0409 0x04e4

Generic PUA AB also known as:

McAfee	Artemis!EF4EDEC85D28
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ViRobot	Adware.Rabio.1882461
Sophos	Generic PUA AB
Comodo	Malware@#23tpct7pou0ju
McAfee-GW-Edition	BehavesLike.Win32.PUP.tc
Webroot	W32.Malware.Gen

How to remove Generic PUA AB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Generic PUA AB malicious file