Should I remove “PUA.AgentRI.S26707687”?

The PUA.AgentRI.S26707687 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUA.AgentRI.S26707687 virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
CAPE detected the shellcode get eip malware family

How to determine PUA.AgentRI.S26707687?


File Info:
name: 29A25BF00C0EA206F725.mlw
path: /opt/CAPEv2/storage/binaries/d67acb15fe0bc399797b5a24af6cd1216864eabb5dc8d9ac791d955e9ba939da
crc32: 93D1F608
md5: 29a25bf00c0ea206f7259073ef6ff6d5
sha1: 7556a38e107f0498b0537ef9f9ae221b8ed0f023
sha256: d67acb15fe0bc399797b5a24af6cd1216864eabb5dc8d9ac791d955e9ba939da
sha512: 778a57e89801a8f1f56e2ee3bfc95557c6850c1231bb542212c69c21b2026047b274d4bc5dac7b07e7c2c53441a25fda58ac0feb1bb89f042118738848589215
ssdeep: 49152:EJX9FM4nMAgkzeXwbr5sIBhZxCjzWxt/H:FlkzeQ5xdOzcH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A0261B137410D450E9540B7BE5A2423424AA1B94E8F9C547FB08BE67BC797237A2FB2F
sha3_384: dcc05b8e0e51afb1615633084a7223be739ff3285e2d97aa34498d50ed0b13193a4671dc094341cd19e63812b00b3e9e
ep_bytes: 558bec6aff68b0de7c0068b4be700064
timestamp: 2022-06-07 12:05:25

Version Info:
FileVersion: 1.0.48.2
FileDescription: 小布PC版8.0
ProductName: 小布PC版8.0
ProductVersion: 1.0.48.2
CompanyName: 小布PC版8.0
LegalCopyright: 小布PC版8.0 版权所有
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

PUA.AgentRI.S26707687 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
tehtris	Generic.Malware
FireEye	Generic.mg.29a25bf00c0ea206
CAT-QuickHeal	PUA.AgentRI.S26707687
Skyhigh	BehavesLike.Win32.Generic.rh
McAfee	GenericRXAA-AA!29A25BF00C0E
Cylance	unsafe
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005246d51 )
K7GW	Trojan ( 005246d51 )
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Trapmine	suspicious.low.ml.score
Sophos	Generic Reputation PUA (PUA)
Ikarus	Trojan.Crypt
Google	Detected
Varist	W32/OnlineGames.HG.gen!Eldorado
Antiy-AVL	RiskWare/Win32.FlyStudio.a
Xcitium	TrojWare.Win32.Agent.OSCF@5rs7jr
GData	Win32.Trojan.PSE.161DS2T
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.C4961894
BitDefenderTheta	Gen:NN.ZexaF.36802.@t0@aW!uzdpb
VBA32	BScope.Trojan.Tiggre
Malwarebytes	Generic.Malware.AI.DDS
Rising	Trojan.Generic@AI.92 (RDML:ZXELkGIH29QwIkMQaQ8WNg)
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
Fortinet	Riskware/FlyApplication
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)
alibabacloud	Trojan.Win.UnkAgent

How to remove PUA.AgentRI.S26707687?

PUA.AgentRI.S26707687 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X