Categories: PUA

PUA.IgenericIH.S27064394 removal tips

The PUA.IgenericIH.S27064394 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA.IgenericIH.S27064394 virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Unconventionial binary language: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Executable file is packed/obfuscated with ASPack
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine PUA.IgenericIH.S27064394?


File Info:
name: CE6293958A4BD7E79CD1.mlwpath: /opt/CAPEv2/storage/binaries/eb7bc232dfb3bd40d776e58a5192aaafa2efacfba3906706b54a44927dece4d3crc32: 8DF89E42md5: ce6293958a4bd7e79cd1a39ecdfd923csha1: 7b3e556be8b09c97bb63728185e750a62084bf94sha256: eb7bc232dfb3bd40d776e58a5192aaafa2efacfba3906706b54a44927dece4d3sha512: da767dc1f9a49fba16f981ea02fe1ca6047b8a506669c7c6e0bedf455fe5bcfcbc9ed812cb8357084dc25039a0c592cee72f2587866aacfe9224eddd699d8103ssdeep: 24576:Qak/7Nk4RZ68nGNPKZu0zoFmDcpii9iGn+66rLfJIgtEqPILWz8oDqE:Qak/U8nvZu+k0WdEacJRIo+Etype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1EF55231927CCBB99E70673785172BF2596A27370BC82D6B7B324EC543D0B02ADD14A93sha3_384: d8958b89401aa9dd4a60186157550a7a0da3ba66c26756edd61d327309728a21e4c12e0b633e3d96282ca20f5cb9ed26ep_bytes: 60e803000000e9eb045d4555c3e80100timestamp: 2022-03-23 11:36:58
Version Info:
CompanyName: 178网游工作室FileDescription: 商业程序InternalName: LoginTools.exeLegalCopyright: 版权所有 (C) 2010OriginalFilename: LoginTools.exeProductName: 商业程序ProductVersion: 1, 0, 0, 0FileVersion: 1,0,0,0Translation: 0x0804 0x03a8

PUA.IgenericIH.S27064394 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Bulz.134753
FireEye	Generic.mg.ce6293958a4bd7e7
CAT-QuickHeal	PUA.IgenericIH.S27064394
ALYac	Gen:Variant.Bulz.134753
Cylance	Unsafe
K7AntiVirus	Riskware ( 005439d61 )
K7GW	Riskware ( 005439d61 )
Cybereason	malicious.58a4bd
BitDefenderTheta	Gen:NN.ZelphiF.34742.qT0baO4tUhci
Cyren	W32/Bulz.V.gen!Eldorado
ESET-NOD32	a variant of Win32/RiskWare.GameTool.S
BitDefender	Gen:Variant.Bulz.134753
Avast	Win32:Malware-gen
Tencent	RiskWare.Win32.GameTool.ha
Ad-Aware	Gen:Variant.Bulz.134753
Sophos	Generic ML PUA (PUA)
DrWeb	Trojan.DownLoader44.47791
Zillya	Tool.GameTool.Win32.870
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
SentinelOne	Static AI – Suspicious PE
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Bulz.134753 (B)
APEX	Malicious
GData	Win32.Trojan.PSE.1HJ0IZ0
Jiangmin	Trojan.Bulz.h
Avira	HEUR/AGEN.1214757
MAX	malware (ai score=83)
Arcabit	Trojan.Bulz.D20E61
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.RL_Generic.R329115
McAfee	GenericRXAA-AA!CE6293958A4B
VBA32	TScope.Trojan.Delf
Malwarebytes	RiskWare.GameTool
Rising	Malware.Lmir!8.E96A (CLOUD)
Yandex	Trojan.GenAsa!8M74xrHXt8Q
Ikarus	Trojan.ManBat
MaxSecure	Trojan.Malware.109381195.susgen
Fortinet	Riskware/GameTool
AVG	Win32:Malware-gen
Panda	Trj/Genetic.gen
CrowdStrike	win/grayware_confidence_100% (W)