PUA

PUA.GenericCS.S27715335 removal

Malware Removal

The PUA.GenericCS.S27715335 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PUA.GenericCS.S27715335 virus can do?

  • Yara rule detections observed from a process memory dump/dropped files/CAPE
  • Possible date expiration check, exits too soon after checking local time
  • Dynamic (imported) function loading detected
  • Performs HTTP requests potentially not found in PCAP.
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Executable file is packed/obfuscated with MPRESS
  • Authenticode signature is invalid
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Created a process from a suspicious location
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

How to determine PUA.GenericCS.S27715335?


File Info:

name: 2D7796F1EC56DC5A634F.mlw
path: /opt/CAPEv2/storage/binaries/9ded48db520f00b020a32dce488aadd923f4d56245f6b0df2fe09a906dd8b2a9
crc32: E02B8D49
md5: 2d7796f1ec56dc5a634f450a1abe8e1c
sha1: fad94225f4e04a298b64e73fc25a2354f8c6a389
sha256: 9ded48db520f00b020a32dce488aadd923f4d56245f6b0df2fe09a906dd8b2a9
sha512: c7a5bf097f6c04d9a3fb822275ed475100459e0e01dc005b24e30ba0b8ec5732d08cb5b4cd186612be7f1acbf1cb4b4f7a0e9c966d1e4224327c66dc931462bd
ssdeep: 192:SmJM//gPYYp+RxEdYp2Mq5Hy5ZPMdF7ppILcIpgmtjxFIknIrUhiJYX:tKX/YpauYp2Mq5S5GBpSVmUd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12AA31E707BD95A32F37BCF7596F682C56938B0227D06D90D40A9834A0833BA5CDB1F1A
sha3_384: 21c021abc7561af1aba199fc7345d229ddc6a634ad8da1405f71b04663d2d058930eee8ea8846e7242e227267a42e9ec
ep_bytes: 558bec81ec3808000053565733f656ff
timestamp: 2013-10-30 10:58:20

Version Info:

0: [No Data]

PUA.GenericCS.S27715335 also known as:

BkavW32.AIDetect.malware1
tehtrisGeneric.Malware
MicroWorld-eScanTrojan.GenericKD.50269945
CAT-QuickHealPUA.GenericCS.S27715335
ALYacTrojan.GenericKD.50269945
CylanceUnsafe
SangforTrojan.Win32.Save.a
K7AntiVirusTrojan ( 0052964f1 )
K7GWTrojan ( 0052964f1 )
Cybereasonmalicious.1ec56d
BaiduWin32.Trojan-Downloader.Small.ck
CyrenW32/Upatre.NP.gen!Eldorado
Elasticmalicious (high confidence)
ESET-NOD32Win32/TrojanDownloader.Small.AAB
APEXMalicious
ClamAVWin.Downloader.Upatre-9940430-0
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderTrojan.GenericKD.50269945
NANO-AntivirusTrojan.Win32.DownLoad3.dgmrrz
AvastWin32:Waski-A [Trj]
TencentTrojan-Downloader.Win32.Small.16000133
Ad-AwareTrojan.GenericKD.50269945
EmsisoftTrojan.GenericKD.50269945 (B)
DrWebTrojan.DownLoad3.28161
ZillyaDownloader.Small.Win32.145004
McAfee-GW-EditionBehavesLike.Win32.Infected.cz
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.2d7796f1ec56dc5a
SophosML/PE-A
IkarusTrojan-Downloader.Win32.Adload
GDataWin32.Trojan.PSE.MYYDUD
JiangminTrojan/Generic.azrvz
AviraTR/Crypt.XPACK.Gen
MAXmalware (ai score=85)
ArcabitTrojan.Generic.D2FF0EF9
MicrosoftTrojanDownloader:Win32/Upatre.A
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win.Generic.R490264
Acronissuspicious
McAfeeDownloader-FBVZ!2D7796F1EC56
TACHYONTrojan-Spy/W32.ZBot.106584
VBA32Trojan.Download
MalwarebytesMalware.AI.73758331
RisingDownloader.Agent!1.C06E (CLASSIC)
YandexTrojan.GenAsa!xjw/xZS1BKE
SentinelOneStatic AI – Malicious PE
MaxSecureTrojan.Upatre.Gen
FortinetW32/Waski.A!tr
BitDefenderThetaGen:NN.ZexaCO.34742.gmY@aecPBghi
AVGWin32:Waski-A [Trj]
PandaTrj/Genetic.gen
CrowdStrikewin/malicious_confidence_100% (D)

How to remove PUA.GenericCS.S27715335?

PUA.GenericCS.S27715335 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment