About "PUA.Bundler.S3936668" infection

The PUA.Bundler.S3936668 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA.Bundler.S3936668 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Reads data out of its own binary image
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Queries information on disks, possibly for anti-virtualization
Network activity contains more than one unique useragent.
Attempts to modify proxy settings
Creates a copy of itself

Related domains:

api.ip138.com

dwonload.sz-qudou.net

How to determine PUA.Bundler.S3936668?


File Info:
crc32: 4F485EC1
md5: d58de61f157710b65191cb00bb5a87a5
name: D58DE61F157710B65191CB00BB5A87A5.mlw
sha1: 5d888caf8ea62d86f633d665a82d0a257fd7b486
sha256: 1a156b95d7db4ef17ba3861593841a2a508ee1787a35717be62f824d948ffc09
sha512: 29d3ac8a11186e696e7680eb41ef3f70211e55dcc595f09f13dae7c0f3dbd952586402b21316a2889b3cc9e1fbfdcb5f4600527057daa81794c1a12cc58414f0
ssdeep: 24576:Kt687RZSJkQ6sPBPtY1POzOp59jhE5j6iFHCs:e68jSJlJPAOyDByVL
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

PUA.Bundler.S3936668 also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Adware ( 0053e9eb1 )
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader27.6939
Cynet	Malicious (score: 100)
CAT-QuickHeal	PUA.Bundler.S3936668
ALYac	Gen:Variant.Application.Bundler.196
Cylance	Unsafe
Zillya	Trojan.Generic.Win32.636172
Sangfor	Trojan.Win32.Save.a
K7GW	Adware ( 0053e9eb1 )
Cybereason	malicious.f15771
Cyren	W32/S-82206cb5!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Softcnapp.AN potentially unwanted
Avast	Win32:TrojanX-gen [Trj]
ClamAV	Win.Malware.Softcnapp-6940714-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Application.Bundler.196
NANO-Antivirus	Trojan.Win32.Softcnapp.fitwzq
MicroWorld-eScan	Gen:Variant.Application.Bundler.196
Tencent	Malware.Win32.Gencirc.10b0d13c
Ad-Aware	Gen:Variant.Application.Bundler.196
Sophos	Mal/Generic-S + Softcnapp (PUA)
Comodo	Application.Win32.AdWare.Softcnapp.C@7wfak4
BitDefenderTheta	Gen:NN.ZexaF.34236.2yW@a8nJPNcj
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
FireEye	Generic.mg.d58de61f157710b6
Emsisoft	Gen:Variant.Application.Bundler.196 (B)
SentinelOne	Static AI – Malicious PE
Antiy-AVL	Trojan/Win32.Tiggre
Microsoft	Trojan:Win32/Occamy.C
GData	Gen:Variant.Application.Bundler.196
AhnLab-V3	PUP/Win32.Bundler.R238629
Acronis	suspicious
McAfee	GenericRXGO-EO!D58DE61F1577
MAX	malware (ai score=73)
VBA32	BScope.Trojan.Downloader
Malwarebytes	PUP.Optional.ChinAd
Panda	Trj/Genetic.gen
Rising	Trojan.Generic@ML.100 (RDML:McDNz3ygCuqeWm/aqmNytw)
Yandex	Trojan.GenAsa!T2hgklBBNow
Ikarus	Trojan.Win32.Krypt
Fortinet	W32/Symmi.CD14!tr
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml

How to remove PUA.Bundler.S3936668?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “PUA.Bundler.S3936668” infection