Generic PUA LE (PUA) information

The Generic PUA LE (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic PUA LE (PUA) virus can do?

Presents an Authenticode digital signature
Creates RWX memory
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Generic PUA LE (PUA)?


File Info:
crc32: DBA982E0
md5: b2e7c80904fbb73a2b2f7db93b380f57
name: aotian_tjkd.exe
sha1: bb261f422dee01177426d6cd1f145ce21949987d
sha256: 7063344e68eddf606fbb855680f3694878f986f08fc9c4e4b36d38882a3858c1
sha512: c60bbe903e938e14d85913d6bfa48b5affa7b834f2b6e42e462cff648130db130ec715830412b1e23549f4d7ce64c47bd62afa986b98c430e7a5a5d1403ed5e2
ssdeep: 12288:PQUoKyTI8hgGNtpRDcvsQlIMgW/Ftu/yhb/MXujPNBdxLuwSlupySaDW/pV:zoKyTI8hgGNtrcEO/gWjuFAPNswIQmav
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x50b2x5929x6e38x620fx4e2dx5fc3
FileVersion: 3.0.0.0
CompanyName: x50b2x5929x6e38x620fx4e2dx5fc3
ProductName: x50b2x5929x5929x5251x72c2x5200
ProductVersion: 3.0.0.0
FileDescription: x50b2x5929x5929x5251x72c2x5200 install
Translation: 0x0804 0x03a8

Generic PUA LE (PUA) also known as:

FireEye	Generic.mg.b2e7c80904fbb73a
CAT-QuickHeal	PUA.AgentRI.S8916463
McAfee	Artemis!B2E7C80904FB
Cylance	Unsafe
K7AntiVirus	Adware ( 004fef751 )
K7GW	Adware ( 004fef751 )
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Malware-gen
GData	Win32.Application.Agent.B1S00I
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
Alibaba	AdWare:Win32/Wews87.7bd1edae
NANO-Antivirus	Riskware.Win32.Autoruner2.foqqzl
ViRobot	Adware.Wews87.718528
Rising	PUA.Wews87!8.642 (CLOUD)
Sophos	Generic PUA LE (PUA)
Comodo	ApplicUnwnt@#18vyvk2wyj0zu
F-Secure	Adware.ADWARE/Wews87.rywnd
DrWeb	Win32.HLLW.Autoruner2.33013
Zillya	Adware.Wews87.Win32.333
Invincea	heuristic
McAfee-GW-Edition	Artemis!Trojan
Ikarus	PUA.Wews87
Jiangmin	AdWare.Generic.ntwk
Avira	ADWARE/Wews87.gcmuy
Antiy-AVL	GrayWare/Win32.Wews87
Endgame	malicious (high confidence)
ZoneAlarm	not-a-virus:HEUR:AdWare.Win32.Agent.gen
Microsoft	PUA:Win32/CoinMiner
MAX	malware (ai score=51)
VBA32	BScope.Adware.FileFinder
Malwarebytes	PUP.Optional.Wews87
ESET-NOD32	a variant of Win32/Wews87.B potentially unwanted
Tencent	Win32.Adware.Generic.Pgmp
Fortinet	Adware/Generic
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Generic PUA LE (PUA)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Generic PUA LE (PUA) information