Should I remove “PUADlManager:Win32/OfferCore”?

The PUADlManager:Win32/OfferCore is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUADlManager:Win32/OfferCore virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PUADlManager:Win32/OfferCore?


File Info:
name: 0DBF56686A2CF586FE8E.mlw
path: /opt/CAPEv2/storage/binaries/383acd3cbe39959c590fb9441f4be44fad161c1057844f913fc5e23f14296342
crc32: C192761E
md5: 0dbf56686a2cf586fe8e02580b5fe40b
sha1: 40ef20487dc5ac6485234cf76a7e4ffb3b815371
sha256: 383acd3cbe39959c590fb9441f4be44fad161c1057844f913fc5e23f14296342
sha512: 699184973901069945e9377107fbbab36f9df0c51e18300148315d05dfac21a6b04252b4c822ae800b262511de2cdad1e7d70ba9abf86a2735318520ae01d1fd
ssdeep: 49152:Zqe3f6W43YpVog43YpVog43YpVoGgV+ZSA9ty/uzyG4ETDaaAexGENRbU4:wSiW4opH4opH4op4U9tNz9RGa/xlbb
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A4D5F13FB264A53ED5AF4B3206B3D350987B7A61A81A8C2E47F0490CCF664711E3F656
sha3_384: 20f301fbdcbd7f7e38bc9c526826ece8f9f3c7be1c7ef907b4df3ea242e1fe3953211d803ac658d0e2b7591aa3396b1d
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2020-11-15 09:48:30

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName:                                                             
FileDescription: EngineGame Installer                                        
FileVersion: 7.5.0               
LegalCopyright: © EngineGame                                                                                        
OriginalFileName:                                                   
ProductName: EngineGame                                                  
ProductVersion: 7.5.0                                             
Translation: 0x0000 0x04b0

PUADlManager:Win32/OfferCore also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.OfferCore.4!c
DrWeb	Trojan.InstallCore.4077
Skyhigh	BehavesLike.Win32.PUP.vc
McAfee	Artemis!0DBF56686A2C
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.ins
Cybereason	malicious.87dc5a
Symantec	Trojan.Gen.MBT
Elastic	malicious (high confidence)
ESET-NOD32	Win32/OfferCore.C potentially unwanted
F-Secure	PotentialRisk.PUA/OfferCore.Gen
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI – Suspicious PE
Google	Detected
Avira	PUA/OfferCore.Gen
Varist	W32/OfferCore.P.gen!Eldorado
Microsoft	PUADlManager:Win32/OfferCore
Cynet	Malicious (score: 99)
VBA32	AdwareDlManager.OfferCore
Cylance	unsafe
Rising	Adware.OfferCore!1.DF2E (CLASSIC)
Ikarus	PUA.OfferCore
Fortinet	Riskware/OfferCore
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_100% (D)

How to remove PUADlManager:Win32/OfferCore?

PUADlManager:Win32/OfferCore removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X