PUA

Generic PUA KJ (PUA) (file analysis)

Malware Removal

The Generic PUA KJ (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generic PUA KJ (PUA) virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Network activity contains more than one unique useragent.
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
yz.app.sogou.com
a.tomx.xyz
ping.t.sogou.com
xz.sogou.com
yze.t.sogou.com

How to determine Generic PUA KJ (PUA)?


File Info:

crc32: 77513852
md5: 854b1ac019fb7230b9aaad469808df8b
name: sogoudpkkd.e
sha1: a9eab984d4d10afcd11befdffba972bc62013bed
sha256: 3b86db3d8c5afdc915317d3a3ec355399936381488deb46143e5c588ddfe8d5d
sha512: d84dadaf8ab504dae3c0a4a31587b50e109f2e5f3b380d16af044920fc3fb4789b18412f103779c1b035c6776c46a115bdd7b08e447df1826dbd1b9f9469d807
ssdeep: 49152:buuE7AkqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW:tE7AfrlyutLxC3sEwwM
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 2014 Sogou.com Inc. All rights reserved.
InternalName: MiniDownLoad.exe
FileVersion: 3.1.12.94
CompanyName: Sogou.com Inc.
ProductName: x8f6fx4ef6x52a9x624b
ProductVersion: 3.1.12.94
FileDescription: x8f6fx4ef6x52a9x624b
OriginalFilename: MiniDownLoad.exe
Translation: 0x0804 0x04b0

Generic PUA KJ (PUA) also known as:

DrWebBackDoor.Gbot.2850
FireEyeGeneric.mg.854b1ac019fb7230
CAT-QuickHealTrojan.MauvaiseRI.S5244821
McAfeePUP-FTL
CylanceUnsafe
VIPRETrojan.Win32.Generic.pak!cobra
K7AntiVirusUnwanted-Program ( 004cca081 )
K7GWUnwanted-Program ( 004cca081 )
CrowdStrikewin/malicious_confidence_80% (D)
Invinceaheuristic
F-ProtW32/Sogou.H.gen!Eldorado
APEXMalicious
AvastWin32:Malware-gen
ClamAVWin.Worm.Chir-2282
GDataWin32.Trojan.Agent.XRRU1X
Kasperskynot-a-virus:Downloader.Win32.Sogou.g
AlibabaDownloader:Win32/Sogou.1b36fa80
NANO-AntivirusTrojan.Win32.Gbot.fgypno
TencentMalware.Win32.Gencirc.10b135f4
Endgamemalicious (high confidence)
EmsisoftApplication.Chindo (A)
ComodoApplication.Win32.Sogou.C@6e9656
F-SecureAdware.ADWARE/Sogou.ijytg
ZillyaDownloader.SogouCRTD.Win32.237
TrendMicroTROJ_GEN.R002C0PBE20
McAfee-GW-EditionBehavesLike.Win32.CoinMiner.vc
MaxSecureTrojan.Malware.8608356.susgen
SophosGeneric PUA KJ (PUA)
Ikarusnot-a-virus:Downloader.Sogou
CyrenW32/Sogou.H.gen!Eldorado
AviraADWARE/Sogou.ijytg
MicrosoftPUA:Win32/Sogou
ZoneAlarmnot-a-virus:Downloader.Win32.Sogou.g
VBA32Downloader.Sogou
MalwarebytesAdware.Sogou
ESET-NOD32a variant of Win32/Sogou.H potentially unwanted
TrendMicro-HouseCallTROJ_GEN.R002C0PBE20
YandexPUA.Downloader!
SentinelOneDFI – Malicious PE
eGambitUnsafe.AI_Score_99%
FortinetPossibleThreat.MU
AVGWin32:Malware-gen

How to remove Generic PUA KJ (PUA)?

Generic PUA KJ (PUA) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment