What is “PUABundler:Win32/CheatEngine”?

The PUABundler:Win32/CheatEngine is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUABundler:Win32/CheatEngine virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PUABundler:Win32/CheatEngine?


File Info:
name: 11D904435B1E9B069B58.mlw
path: /opt/CAPEv2/storage/binaries/362844abc8ae08fa76647aa2b8d281a56e3a4290e859293cc222b9cb1b05515b
crc32: 2214B2E0
md5: 11d904435b1e9b069b580f85efa2658e
sha1: 692ab795d1868c0d0c459e7a934d7b53d09c86e4
sha256: 362844abc8ae08fa76647aa2b8d281a56e3a4290e859293cc222b9cb1b05515b
sha512: 9307ee66f0259b3394cb53f405967141526e09878706aacf76e74725dfb1e604e5f7decb08bbd0daa7743379505073d1a17d54f49ebb2ba6ae46baa799de430c
ssdeep: 49152:Zqe3f6W43YpVog43YpVog43YpVoGgV+ZSA9ty/uzyG4ETDaaAexGENRbUgPq:wSiW4opH4opH4op4U9tNz9RGa/xlbLPq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C2E5F13FB264A53ED5AE4B3206B3D350587B7A61B81A8C2E47F0494CCF664711E3FA16
sha3_384: b4d34a1558779c588e1a21ecfc73d9ecdde63b58c58de26255826b3a4d238b2031690d2e518891cbe69ef065dec0dfe9
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2020-11-15 09:48:30

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: EngineGame Installer                                        
FileVersion: 7.5.0               
LegalCopyright: © EngineGame                                                                                        
OriginalFileName:                                                   
ProductName: EngineGame                                                  
ProductVersion: 7.5.0                                             
Translation: 0x0000 0x04b0

PUABundler:Win32/CheatEngine also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
DrWeb	Trojan.InstallCore.4077
Skyhigh	BehavesLike.Win32.PUP.vc
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
CrowdStrike	win/grayware_confidence_100% (D)
Symantec	Trojan.Gen.MBT
ESET-NOD32	Win32/OfferCore.C potentially unwanted
Cynet	Malicious (score: 99)
Rising	Adware.OfferCore!1.DF2E (CLASSIC)
Sophos	Generic Reputation PUA (PUA)
F-Secure	PotentialRisk.PUA/OfferCore.Gen
Trapmine	malicious.moderate.ml.score
Ikarus	PUA.OfferCore
Google	Detected
Avira	PUA/OfferCore.Gen
Microsoft	PUABundler:Win32/CheatEngine
Varist	W32/OfferCore.P.gen!Eldorado
McAfee	Artemis!11D904435B1E
DeepInstinct	MALICIOUS
VBA32	AdwareDlManager.OfferCore
Cylance	unsafe
SentinelOne	Static AI – Suspicious PE
Fortinet	Riskware/OfferCore
Cybereason	malicious.5d1868

How to remove PUABundler:Win32/CheatEngine?

PUABundler:Win32/CheatEngine removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X