PUA.AgentFC.S28419769 (file analysis)

The PUA.AgentFC.S28419769 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUA.AgentFC.S28419769 virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Binary compilation timestomping detected

How to determine PUA.AgentFC.S28419769?


File Info:
name: 5C931F725B672A1A4DB7.mlw
path: /opt/CAPEv2/storage/binaries/7cce8fe5b904f6ebe1eea5f9a536203978df220d5e90fc0b5b4e41326fdc4b84
crc32: 5B4F2E10
md5: 5c931f725b672a1a4db7c5e8a8f26003
sha1: 407786295a60fe2922a62e3f4eb85f60cc38e09e
sha256: 7cce8fe5b904f6ebe1eea5f9a536203978df220d5e90fc0b5b4e41326fdc4b84
sha512: f39f88c05c2395a4dba631f927e45da9f261606fd7db5ee34121defcf6e339eae0ed80a397d216487945a4ce0d70f8ccdab5852fa4f6bf63be475cb5e6e5dd9e
ssdeep: 384:kMgf6ePzW3lWIezapI0HHaJFhdZtFZsHLA6e2ZtFZsHLYqLBhj:kMCPqIxFh7tGgetGHBhj
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T11BB20B59DBE01C02ED7B8E3134E0961AAF30BE44BE90C5FB651DD0158F62B9229BC27D
sha3_384: 3939e9e160dde988d263b13601f734a9123142d44674356b71d5068df9867f84fc7b201950445bfdd0b3da121e39e206
ep_bytes: ff2500200010ffffffffffffffffffff
timestamp: 2102-09-06 17:33:59

Version Info:
Translation: 0x0000 0x04b0
CompanyName: NHM.CredentialValidators
FileDescription: NHM.CredentialValidators
FileVersion: 1.0.0.0
InternalName: NHM.CredentialValidators.dll
LegalCopyright:  
OriginalFilename: NHM.CredentialValidators.dll
ProductName: NHM.CredentialValidators
ProductVersion: 1.0.0
Assembly Version: 1.0.0.0

PUA.AgentFC.S28419769 also known as:

Bkav	W32.Common.894B5B2F
CAT-QuickHeal	PUA.AgentFC.S28419769
Skyhigh	Artemis!Trojan
McAfee	Artemis!5C931F725B67
Cylance	unsafe
Zillya	Tool.Miner.Win32.573
Alibaba	RiskWare:MSIL/Miner.3cf82fef
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	TROJ_GEN.R002H07FQ22
Kaspersky	not-a-virus:HEUR:RiskTool.Win32.Miner.gen
NANO-Antivirus	Riskware.Win32.BtcMine.jmvjgr
Avast	Win32:MalwareX-gen [Trj]
DrWeb	Tool.BtcMine.2499
Sophos	Generic Reputation PUA (PUA)
Jiangmin	RiskTool.MSIL.cqve
Webroot	W32.Coinminer.Nicehash
ZoneAlarm	not-a-virus:HEUR:RiskTool.Win32.Miner.gen
GData	MSIL.Application.NiceHashMiner.A
VBA32	TScope.Trojan.MSIL
Malwarebytes	RiskWare.BitCoinMiner
Panda	Trj/CI.A
Fortinet	Riskware/Application
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove PUA.AgentFC.S28419769?

PUA.AgentFC.S28419769 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X