What is “PUABundler:Win32/CheatEngine”?

The PUABundler:Win32/CheatEngine is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUABundler:Win32/CheatEngine virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PUABundler:Win32/CheatEngine?


File Info:
name: B177D5B320DBE8763FE2.mlw
path: /opt/CAPEv2/storage/binaries/09ba7322d0628233a155e4a53457c7eed091b1208f58e7c6054c88717441ef64
crc32: 2E5B0CDA
md5: b177d5b320dbe8763fe2e448385ebb5a
sha1: 818ddd5259736579a25d78afd3b8bdc49cabf7e1
sha256: 09ba7322d0628233a155e4a53457c7eed091b1208f58e7c6054c88717441ef64
sha512: 8fe899a8d468a8529fee050002d574f9ec3f774c539163de077a187ace1c65de05fc3213c03854d593edc72deafcf5a5e2797203bc4e2da8fc1131773643b43c
ssdeep: 49152:Zqe3f6W43YpVog43YpVog43YpVoGgV+ZSA9ty/uzyG4ETDr:wSiW4opH4opH4op4U9tNz9R/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T142C5E13FB264A53ED5AF0B3249B39350987B7B61A81A8C2E47F0494CCF664701E3F656
sha3_384: f3804023aecb2be943f981b933c7220f291376f769cb4ac1f203e30499e639abce557ca40fe5b3bcb59d0b8ffa2d8e5e
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2020-11-15 09:48:30

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: EngineGame Installer                                        
FileVersion: 7.5.0               
LegalCopyright: © EngineGame                                                                                        
OriginalFileName:                                                   
ProductName: EngineGame                                                  
ProductVersion: 7.5.0                                             
Translation: 0x0000 0x04b0

PUABundler:Win32/CheatEngine also known as:

Bkav	W32.AIDetectMalware
Lionic	Adware.Win32.OfferCore.2!c
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.PUP.vc
McAfee	Artemis!B177D5B320DB
Malwarebytes	PUP.Optional.OfferCore.DDS
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Adware ( 00595a211 )
K7GW	Adware ( 00595a211 )
CrowdStrike	win/grayware_confidence_100% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/OfferCore.C potentially unwanted
F-Secure	PotentialRisk.PUA/OfferCore.Gen
DrWeb	Trojan.InstallCore.4077
Trapmine	malicious.moderate.ml.score
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI – Suspicious PE
Google	Detected
Avira	PUA/OfferCore.Gen
Varist	W32/OfferCore.P.gen!Eldorado
Microsoft	PUABundler:Win32/CheatEngine
GData	Win32.Application.Agent.GWPFIT
Cynet	Malicious (score: 100)
VBA32	AdwareDlManager.OfferCore
Cylance	unsafe
Rising	Adware.OfferCore!1.DF2E (CLASSIC)
Ikarus	PUA.OfferCore
Fortinet	Riskware/OfferCore
DeepInstinct	MALICIOUS

How to remove PUABundler:Win32/CheatEngine?

PUABundler:Win32/CheatEngine removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X