Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/PUA
Threat report

PUA.StormserRI.S28491914 (file analysis)

Published Apr 18, 2024 PUA category 3 min read
Report context

What to verify before removal

This pua entry is most useful when PUA.StormserRI.S28491914 (file analysis) appears after a software bundle, browser extension install, or unwanted system utility. Treat it as moderate risk until you confirm whether the alert is tied to browser settings, scheduled tasks, or a persistent updater.

Start by comparing the local file name with DC2DF66702698EC9B39F.mlw, then review the behavior notes for bundled installers, browser policy changes, notification abuse, and unwanted startup entries. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
DC2DF66702698EC9B39F.mlw
  • Compare the suspicious file name with DC2DF66702698EC9B39F.mlw.
  • Confirm the detection name matches PUA.StormserRI.S28491914 (file analysis) before removing related files.
  • Review the report for bundled installers, browser policy changes, notification abuse, and unwanted startup entries so the cleanup is based on observed behavior, not only the label.
  • Remove the unwanted app, reset affected browser settings, and check extensions before reconnecting accounts.

The PUA.StormserRI.S28491914 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What PUA.StormserRI.S28491914 virus can do?

  • Uses Windows utilities for basic functionality
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Deletes executed files from disk
  • Uses suspicious command line tools or Windows utilities

How to determine PUA.StormserRI.S28491914?



File Info:

name: DC2DF66702698EC9B39F.mlw
path: /opt/CAPEv2/storage/binaries/df7338128ba19247c86c33f7df19890e95ebcadba8555466caaccd31f43dc527
crc32: 88D1139D
md5: dc2df66702698ec9b39f3d71b6768510
sha1: 01e6a8c0c9feb62e6bf4213b884c101dbbccd942
sha256: df7338128ba19247c86c33f7df19890e95ebcadba8555466caaccd31f43dc527
sha512: a643b275a7e9fd52a1078a571781010dd88dca0976515eb7a45aa8e61a534551dc6a35297ae8ea999cfda8b22da51cf547ae816b241a5c07ef433fef74851e00
ssdeep: 192:ubOzawOs81elJHsc45CcRZOqtShcWaOT2QLrCqwiY04/CFxyNhoy5tH:ubLwOs8AHsc4sMtwhKQLroY4/CFsrdH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T132933A427A9B78E3EE4111303CEE46F4956EDDDC710DBA9E6A70CB14023E153972A1EB
sha3_384: 8630afdb75d4346cdf678dda5ec91f0573060dd4862037c0bb04e7caeb9ea1bb341222339302a61362159b04bbf5f443
ep_bytes: 558bec6aff6898314000683026400064
timestamp: 2010-07-31 11:55:58


Version Info:

0: [No Data]

PUA.StormserRI.S28491914 also known as:

Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Rincux.AW
FireEye Generic.mg.dc2df66702698ec9
CAT-QuickHeal PUA.StormserRI.S28491914
Skyhigh BehavesLike.Win32.Generic.nz
ALYac Trojan.Rincux.AW
Malwarebytes Malware.AI.2681005475
VIPRE Trojan.Rincux.AW
Sangfor Suspicious.Win32.Save.ins
K7GW Trojan ( 00073eb11 )
K7AntiVirus Trojan ( 00073eb11 )
BitDefenderTheta AI:Packer.8BDA6DD41E
VirIT Trojan.Win32.Storm.GA
Symantec SMG.Heur!gen
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.PIH
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky Trojan-DDoS.Win32.StormAttack.a
BitDefender Trojan.Rincux.AW
NANO-Antivirus Trojan.Win32.StormAttack.fnqayj
SUPERAntiSpyware Trojan.Agent/Gen-DDOS
Avast Win32:Dropper-OYD [Drp]
Tencent Trojan-Ddos.Win32.Stormattack.wa
Emsisoft Trojan.Rincux.AW (B)
F-Secure Trojan.TR/Dropper.Gen
DrWeb DDoS.Storm.156
Zillya Tool.StormAttackGen.Win32.1
Trapmine malicious.high.ml.score
Sophos Troj/Agent-BIXD
SentinelOne Static AI – Malicious PE
Jiangmin TrojanDDoS.StormAttack.b
Webroot W32.Trojan.Gen
Varist W32/Agent.FHV.gen!Eldorado
Avira TR/Dropper.Gen
MAX malware (ai score=84)
Antiy-AVL Trojan/Win32.Agent.pih
Kingsoft malware.kb.a.999
Xcitium TrojWare.Win32.Magania.~AAC@f80ur
Arcabit Trojan.Rincux.AW
ZoneAlarm Trojan-DDoS.Win32.StormAttack.a
GData Win32.Trojan.PSE.SHFS16
Google Detected
AhnLab-V3 Trojan/Win.StormAttack.92820
Acronis suspicious
VBA32 BScope.TrojanDDoS.StormAttack
TACHYON Trojan/W32.StormAttack.94208
Cylance unsafe
Panda Trj/Genetic.gen
Rising Dropper.Agent!1.C6A3 (CLASSIC)
Ikarus Trojan-Downloader.Win32.Pangu
Fortinet W32/ServStart.AS!tr
AVG Win32:Dropper-OYD [Drp]
DeepInstinct MALICIOUS
alibabacloud Trojan[dropper]:Win/Agent.ce7d26d3

How to remove PUA.StormserRI.S28491914?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.