Categories: PUA

Generic PUA NH (PUA) malicious file

The Generic PUA NH (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Generic PUA NH (PUA) virus can do?

Executable code extraction
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Sniffs keystrokes
Exhibits possible ransomware file modification behavior
Creates a hidden or system file
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

mrantifun.net

www.bing.com

How to determine Generic PUA NH (PUA)?


File Info:
crc32: 9E307DD2md5: 17b6af0b543ab5fa270617f3662ce7f4name: Assassins-Creed-4-Black-Flag-Trainer-14-V1.07-MrAntiFun.EXEsha1: d732f3b1eb46bf6d4147c91be92b1d6af5363e91sha256: a21b4a3c79961de189c8b27638d0de7784ab6d9b0c4a86ae5929435adce75697sha512: 3193b92fb2d24d3452dba0d73f83545090e3f8b9f5931df36798958f1830ec12061b2782996901ab4d2cb761417538cf39c2c7f3c5e49a6f00ccd07480c452fassdeep: 98304:VPovjEShdRDvRmAbdz1gVVkLVZ15/gldc/7UoxL8/A+4Vv+0zkn:hoLBv8edz1OVqXgc/7DP+6Ntype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

Generic PUA NH (PUA) also known as:

CAT-QuickHeal	Dropper.Jeefo.YY5
McAfee	Artemis!17B6AF0B543A
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Unwanted-Program ( 004ba1a41 )
K7GW	Unwanted-Program ( 004ba1a41 )
CrowdStrike	win/malicious_confidence_70% (D)
F-Prot	W32/CheatEngine.C.gen!Eldorado
Symantec	Trojan.Gen.SMH
ESET-NOD32	a variant of Win32/HackTool.CheatEngine.AF potentially unsafe
Paloalto	generic.ml
Alibaba	HackTool:Win32/CheatEngine.526b9f53
Rising	Trojan.Generic@ML.100 (RDML:tJUVhnY+qOzwGE3OSaGqsw)
Comodo	Malware@#3agjb11aa87q0
Zillya	Tool.CheatEngine.Win32.782
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.PUPXAR.rc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.17b6af0b543ab5fa
Sophos	Generic PUA NH (PUA)
SentinelOne	DFI – Malicious PE
Cyren	W32/CheatEngine.C.gen!Eldorado
Jiangmin	TrojanSpy.KeyLogger.lsz
Webroot	W32.Malware.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan[Packed]/Win32.PolyCrypt
Endgame	malicious (high confidence)
Microsoft	Trojan:Win32/Wacatac.A!ml
Acronis	suspicious
Yandex	HackTool.CheatEngine!h2lP7QG9eRI
eGambit	Unsafe.AI_Score_99%
GData	Win32.Riskware.Hacktool.D
AVG	FileRepMetagen [PUP]
Avast	FileRepMetagen [PUP]