Categories: PUA

PUA:Win32/BroSafe removal instruction

The PUA:Win32/BroSafe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/BroSafe virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Steals private information from local Internet browsers
Uses suspicious command line tools or Windows utilities

How to determine PUA:Win32/BroSafe?


File Info:
name: D2411954BE3F6F0F6592.mlwpath: /opt/CAPEv2/storage/binaries/33bb558ed3eaba5ceed90cd0bef5f7943095fed94e81858aad77dfb1799819b0crc32: 021C8AF7md5: d2411954be3f6f0f65928dbe7c14c86dsha1: e2bfe6a8b231ff5a92929fd2fe8c9a4c8705cefdsha256: 33bb558ed3eaba5ceed90cd0bef5f7943095fed94e81858aad77dfb1799819b0sha512: c19854746316165c9f458e97d84d52b47bfb30377bdd15f6b3b6c26610c8ca20764154ad434ca9a3280e8f5d8372736ab0fd020858385a538950bd29ba644d86ssdeep: 49152:N/uzgs/e994AKIwu9+8dkeL171sRrUdlYee5PCRI2AQD8jxWR:Buzgs/k94AKIwu9dko7CxUTtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1A0E517D0F9DF40F6D2078D7188A2923FAA34460883F5DAC7DE642E5AED1BAD1097B315sha3_384: 4a68d8ab328f76ec98e9194413b2d9ca3d7ca5f1f7953f69dcae498f19afb4b192a1d847c0f9a112899c00823a9d927cep_bytes: 83ec0c8b44240c8d5c24108944240489timestamp: 1970-01-01 00:00:00
Version Info:
CompanyName: Creative Software Solutions GmbH.FileVersion: 1, 4, 1, 0Translation: 0x0409 0x04b0

PUA:Win32/BroSafe also known as:

Lionic	Adware.Win32.BroSafe.2!c
FireEye	Generic.mg.d2411954be3f6f0f
Cylance	Unsafe
Zillya	Adware.BroSafe.Win32.4
Sangfor	Trojan.Win32.Occamy.8
Alibaba	AdWare:Win32/BroSafe.1819ab81
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Adware.Agent.NTU
TrendMicro-HouseCall	TROJ_GEN.R002H0CK921
Kaspersky	not-a-virus:AdWare.Win32.BroSafe.f
NANO-Antivirus	Trojan.Win32.Mlw.faeyxx
Tencent	Malware.Win32.Gencirc.114cde07
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
Sophos	Generic PUA OC (PUA)
SentinelOne	Static AI – Suspicious PE
Jiangmin	TrojanDownloader.Agent.fmfu
Webroot	W32.Adware.Installcore
Avira	TR/Dldr.Agent.symbf
MAX	malware (ai score=98)
Antiy-AVL	Trojan/Generic.ASMalwS.25AD366
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PUA:Win32/BroSafe
Cynet	Malicious (score: 99)
AhnLab-V3	Malware/Gen.Generic.C2464252
McAfee	GenericRXAA-AA!D2411954BE3F
VBA32	BScope.Adware.BroSafe
Malwarebytes	Malware.AI.1892668765
Panda	Trj/RnkBend.A
APEX	Malicious
Rising	Downloader.Agent!8.B23 (CLOUD)
Ikarus	AdWare.BroSafe
Fortinet	W64/Agent.PH!tr.dldr
AVG	FileRepMalware
Avast	FileRepMalware