About “PUA:Win32/Kuaiba” infection

The PUA:Win32/Kuaiba is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUA:Win32/Kuaiba virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine PUA:Win32/Kuaiba?


File Info:
crc32: C8FEDD9C
md5: 5cb7fb352a02754eae53e39f79de7a1c
name: kuai8_c200027_s1g40147.exe
sha1: 7c634e45fa4bebfe2f16c00155fb91fcc54dd0de
sha256: e16ee5051d81845a4da76fefe1a0c404e83545228a1bf1eacc3f5f19d0a486e0
sha512: 8b0726f1932468cd21762b5dae2801322fc352ff94ab36aed0031037744a636750f08b0939bfeb7e7ff22fdff818a417450a57c53a43a98f35e856b0f62b0809
ssdeep: 196608:ouBWaKQKjZhg7MWgolNlAV3fG78bsRCrM7wxIf6KDitTcz8TvYSRK8mCu+gdSDo8:ouBWFQgZ2dgE+hc8bs4M7wqfutQz8TvH
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: x7248x6743x6240x6709 (C)2013 x5947x70abx6b22x4eab
FileVersion: 8.7.1.8074
CompanyName: x5947x70abx6b22x4eab
SpecialBuild: 300005
Comments: x5febx5427x6e38x620f v8.7
ProductName: x5febx5427x6e38x620fx5e73x53f0
ProductVersion: 8.7.1.8074
FileDescription: x5febx5427x6e38x620f v8.7 x5b89x88c5x7a0bx5e8f
Translation: 0x0804 0x03a8

PUA:Win32/Kuaiba also known as:

Bkav	HW32.Packed.
CAT-QuickHeal	Trojan.Kuaiba
McAfee	Adware-Kuaiba
Cylance	Unsafe
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Invincea	heuristic
Avast	Win32:Adware-gen [Adw]
Endgame	malicious (high confidence)
DrWeb	Trojan.Siggen9.8044
McAfee-GW-Edition	BehavesLike.Win32.AdwareLinkury.wc
SentinelOne	DFI – Suspicious PE
Cyren	W32/Trojan.ZQNS-5667
Microsoft	PUA:Win32/Kuaiba
VBA32	BScope.TrojanDownloader.Banload
Malwarebytes	Adware.Kuaiba
Rising	Adware.AdPop!1.B8AE (CLASSIC)
Fortinet	Riskware/Generic_PUA_II
AVG	Win32:Adware-gen [Adw]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.11973.susgen

How to remove PUA:Win32/Kuaiba?

PUA:Win32/Kuaiba removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X