PUA

About “Generic PUA PF (PUA)” infection

Malware Removal

The Generic PUA PF (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generic PUA PF (PUA) virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Network activity contains more than one unique useragent.
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

yz.app.sogou.com
ping.t.sogou.com

How to determine Generic PUA PF (PUA)?


File Info:

crc32: 47259060
md5: 6231cfd41667a2a180e63cefcb2db0b7
name: sogoubehpj.e
sha1: f54504127c48104e8716b84dfa0b0b037a3828cf
sha256: e530bba06c86dfe7df04f66ead7edae2ff7646f79196a2a2db9694b573d7c346
sha512: 2146a6b17e41a900890bc0c74c5c1fd7bf0eae12820e628d52ebaadaf7aa63c16fc4167465cc7938c43a73c0235be4a9509900016b8485a816f1b3c6eeff02ad
ssdeep: 49152:MuuE7AnqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFW:WE7AqrlyutLxC3sEwwM
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 2014 Sogou.com Inc. All rights reserved.
InternalName: MiniDownLoad.exe
FileVersion: 3.1.12.94
CompanyName: Sogou.com Inc.
ProductName: x8f6fx4ef6x52a9x624b
ProductVersion: 3.1.12.94
FileDescription: x8f6fx4ef6x52a9x624b
OriginalFilename: MiniDownLoad.exe
Translation: 0x0804 0x04b0

Generic PUA PF (PUA) also known as:

BkavW32.HfsAdware.170E
DrWebBackDoor.Gbot.2850
FireEyeGeneric.mg.6231cfd41667a2a1
CAT-QuickHealTrojan.MauvaiseRI.S5244821
McAfeePUP-FTL
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusUnwanted-Program ( 004cca081 )
K7GWUnwanted-Program ( 004cca081 )
TrendMicroTROJ_GEN.R002C0PCH20
CyrenW32/Sogou.H.gen!Eldorado
APEXMalicious
ClamAVWin.Worm.Chir-2282
GDataWin32.Trojan.Agent.XVTVOB
Kasperskynot-a-virus:Downloader.Win32.Sogou.g
AlibabaDownloader:Win32/Sogou.6e7f7e21
NANO-AntivirusTrojan.Win32.Gbot.fgypno
SophosGeneric PUA PF (PUA)
ComodoApplication.Win32.Sogou.C@6e9656
F-SecureAdware.ADWARE/Sogou.wqqyp
ZillyaDownloader.SogouCRTD.Win32.237
Invinceaheuristic
McAfee-GW-EditionBehavesLike.Win32.AdwOptimizerPro.vc
EmsisoftApplication.Chindo (A)
Ikarusnot-a-virus:Downloader.Sogou
F-ProtW32/Sogou.H.gen!Eldorado
eGambitUnsafe.AI_Score_99%
AviraADWARE/Sogou.wqqyp
Antiy-AVLRiskWare[Downloader]/Win32.Sogou
Endgamemalicious (high confidence)
ZoneAlarmnot-a-virus:Downloader.Win32.Sogou.g
MicrosoftPUA:Win32/Sogou
AhnLab-V3PUP/Win32.Downloader.R180775
VBA32Downloader.Sogou
MAXmalware (ai score=99)
MalwarebytesAdware.Sogou
ESET-NOD32a variant of Win32/Sogou.H potentially unwanted
TrendMicro-HouseCallTROJ_GEN.R002C0PCH20
YandexPUA.Downloader!
SentinelOneDFI – Malicious PE
MaxSecureTrojan.Malware.8608356.susgen
FortinetRiskware/Sogou
WebrootAdware.Sogou
AVGWin32:Malware-gen
AvastWin32:Malware-gen
CrowdStrikewin/malicious_confidence_80% (D)

How to remove Generic PUA PF (PUA)?

Generic PUA PF (PUA) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment