How to remove “PUA.RiskwarePMF.S17557778”?

The PUA.RiskwarePMF.S17557778 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUA.RiskwarePMF.S17557778 virus can do?

Unconventionial language used in binary resources: Korean
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PUA.RiskwarePMF.S17557778?


File Info:
name: E50706C935C66E18A0CF.mlw
path: /opt/CAPEv2/storage/binaries/e7dcb9e08b339ce1bcfc1496ccd85e6886e6b438f4462057463c2775acf2ac49
crc32: B478B601
md5: e50706c935c66e18a0cf12055bd0f22c
sha1: 0913ff91cd587efc433a448d04f891f96de9c0bf
sha256: e7dcb9e08b339ce1bcfc1496ccd85e6886e6b438f4462057463c2775acf2ac49
sha512: 9b360c634a226410856ddad51c2f1eae41d0b663a6188e7371256fe594ac4d7d3209ed17de626eb4d73ff1fc7e6ee96478fcb78499bfefdc1292b5e3c9ff0c1c
ssdeep: 49152:IJdinK/H1kv/nfbs2seB2ZHS0uLB5YyhKi6SqCayI:0dV1k3zs2sedhKi6SqCayI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18AA5B012F38281B1D98B36B9D87D3F2F66B5A7040718DEC3E2C81D0F5E655E2653728A
sha3_384: 7a70fa5b8f62077e895f389d80be054e7c008e27ffcb135f9a99507662c4725153c8875eb381c8ba385b938fcf525e54
ep_bytes: bb96020000e969000000909090909090
timestamp: 1970-01-01 00:00:00

Version Info:
0: [No Data]

PUA.RiskwarePMF.S17557778 also known as:

Bkav	W32.AIDetect.malware1
FireEye	Generic.mg.e50706c935c66e18
CAT-QuickHeal	PUA.RiskwarePMF.S17557778
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	Backdoor:Script/OnlineGames.16f64c54
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
VirIT	Trojan.Win32.Crypt.AEPL
Cyren	W32/OnlineGames.FO.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
SUPERAntiSpyware	Trojan.Agent/Gen-Riskware
TACHYON	Trojan/W32.Script.2081792
Comodo	Malware@#1hm7wvebaau85
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor/Hupigon.bdrv
ViRobot	Backdoor.Win32.Hupigon.2184192
Microsoft	Trojan:Win32/Wacatac.B!ml
McAfee	Artemis!E50706C935C6
VBA32	Backdoor.Hupigon
Malwarebytes	Trojan.Downloader
Rising	PUA.Vigua!8.10186 (RDMK:cmRtazpARsOtFhJ6SaKUCFSvx9LF)
Yandex	Trojan.GenAsa!yMlE3lLRsmA
Ikarus	Trojan.Script
BitDefenderTheta	Gen:NN.ZexaF.34182.@DW@aqQLoiiP

How to remove PUA.RiskwarePMF.S17557778?

PUA.RiskwarePMF.S17557778 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X