Categories: PUA

How to remove “Generic PUA GL (PUA)”?

The Generic PUA GL (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic PUA GL (PUA) virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Tries to unhook or modify Windows functions monitored by Cuckoo
Attempts to modify proxy settings

Related domains:

z.whorecord.xyz

www.chachongba.com

tj.chachongba.cc

a.tomx.xyz

How to determine Generic PUA GL (PUA)?


File Info:
crc32: C4566225md5: 8a344d266aaad7f769510df491c02cb0name: jczs.exesha1: 6b588fc31bac1e2dca87b22e7d0852752ce98ba6sha256: 63ade0d51d8071d34cec42737c2aba247bc62181562c77150864f7716c0879b0sha512: 30781d3f6502970897f2f2f6b935c3b809cbcf5215b7da362a2bb27a689b5d6aa3403a7cdbf2113f3433ddc83446604d89644c0b2152959ded7b7573803e7c69ssdeep: 24576:abgMIk0CWAcFeqB/drj9ICEFR8vs6C65l:abg9k0rAFqHr6PFsF5ltype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: TB x7248x6743x6240x6709FileVersion: 2.3.1.0CompanyName: TBComments: x8bbax6587x964dx91cdx52a9x624bProductName: x8bbax6587x964dx91cdx52a9x624bProductVersion: 2.3.1.0FileDescription: x8bbax6587x964dx91cdx52a9x624bTranslation: 0x0804 0x04b0

Generic PUA GL (PUA) also known as:

MicroWorld-eScan	Trojan.GenericKD.30650568
FireEye	Generic.mg.8a344d266aaad7f7
CAT-QuickHeal	Risktool.Flystudio.18827
McAfee	RDN/Generic Downloader.x
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 005246d51 )
BitDefender	Trojan.GenericKD.30650568
K7GW	Trojan ( 005246d51 )
Cybereason	malicious.66aaad
Symantec	Trojan.Gen.6
APEX	Malicious
Avast	Win32:Malware-gen
GData	Win32.Application.FlyStudio.F
Alibaba	TrojanDownloader:Win32/FakeIE.b8e7edb5
NANO-Antivirus	Trojan.Win32.FakeIE.favfpv
AegisLab	Trojan.Win32.Generic.4!c
Endgame	malicious (moderate confidence)
Sophos	Generic PUA GL (PUA)
Comodo	Packed.Win32.MUPX.Gen@24tbus
F-Secure	Trojan.TR/Dldr.Fakeie.tivyv
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.30650568 (B)
Cyren	W32/Trojan.YEZP-8654
Webroot	W32.Trojan.GenKD
Avira	TR/Dldr.Fakeie.tivyv
MAX	malware (ai score=95)
Antiy-AVL	GrayWare/Win32.FlyStudio.a
Microsoft	TrojanDownloader:Win32/FakeIE.B
Arcabit	Trojan.Generic.D1D3B0C8
AhnLab-V3	Malware/Win32.Generic.C2478294
Acronis	suspicious
VBA32	BScope.Trojan.Downloader
ALYac	Trojan.GenericKD.30650568
Ad-Aware	Trojan.GenericKD.30650568
Cylance	Unsafe
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R066C0CFO19
SentinelOne	DFI – Malicious PE
Fortinet	W32/Agent.65CA!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)