PUADlManager:Win32/Bibado (file analysis)

The PUADlManager:Win32/Bibado is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUADlManager:Win32/Bibado virus can do?

Sample contains Overlay data
Presents an Authenticode digital signature
Reads data out of its own binary image
Authenticode signature is invalid
Yara detections observed in process dumps, payloads or dropped files

How to determine PUADlManager:Win32/Bibado?


File Info:
name: 1E29C95088BB200598E2.mlw
path: /opt/CAPEv2/storage/binaries/3504bb8d736ae85c3aceab2fab70bc47c5494f05caec57e74b4d78d8077c896d
crc32: 39CC07A6
md5: 1e29c95088bb200598e2da2922ac4cb2
sha1: 25357ad624477af776ca136e532eb8431b6e2c08
sha256: 3504bb8d736ae85c3aceab2fab70bc47c5494f05caec57e74b4d78d8077c896d
sha512: 087d57b0edc04f36e5fe474e213c9957bbfd59d1adfd9afa4081bf8cc4a4f7040db2e3555bb3f25220fef72d24edcf40247b6b9aa52755ab1241de036623abab
ssdeep: 3072:+gXdZt9P6D3XJk45VyBR4Qnn3UQwIAwP5kJZ6YH99wh1ZmF:+e34aqgpn/bRkJ196/mF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T104C3F12B53C1CC77E5E24230297AE739F779EA442390E6930BB56E2F6F62182CC15564
sha3_384: b2a3af3132ff86f997ffc13eb0120901bdb877346448fa228d737785fe8ff0cc1bdb867a1c3335392a7626b6502af27d
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2009-12-05 22:50:52

Version Info:
0: [No Data]

PUADlManager:Win32/Bibado also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.PUP.cc
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Unwanted-Program ( 00586f6e1 )
K7GW	Unwanted-Program ( 00586f6e1 )
Symantec	PUA.Gen.2
ESET-NOD32	Win32/Toggle.H potentially unwanted
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:HEUR:Downloader.Win32.InstallM.gen
NANO-Antivirus	Riskware.Nsis.Adware.dpyzfo
Emsisoft	Application.AdLoad (A)
F-Secure	Adware.ADWARE/Adware.Gen
DrWeb	Adware.Downware.17671
Zillya	Adware.DownwareCRTD.Win32.1469
Trapmine	malicious.moderate.ml.score
Sophos	Toggle Download Manager (PUA)
SentinelOne	Static AI – Suspicious PE
GData	NSIS.Application.Odabib.A
Avira	ADWARE/Adware.Gen
Antiy-AVL	GrayWare/Win32.Toggle
Kingsoft	malware.kb.a.990
ZoneAlarm	not-a-virus:HEUR:Downloader.Win32.InstallM.gen
Microsoft	PUADlManager:Win32/Bibado
McAfee	Artemis!1E29C95088BB
Malwarebytes	PUP.Optional.Toggle
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Adware/Toggle
DeepInstinct	MALICIOUS

How to remove PUADlManager:Win32/Bibado?

PUADlManager:Win32/Bibado removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X