PUA

PUA:Win32/OfferCore (file analysis)

Malware Removal

The PUA:Win32/OfferCore is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What PUA:Win32/OfferCore virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Creates a hidden or system file

Related domains:

d2yt3cv5wvb9w9.cloudfront.net

How to determine PUA:Win32/OfferCore?


File Info:

crc32: 451261F4
md5: 0086c607191cdad5cbb491bb658eab2e
name: 0086C607191CDAD5CBB491BB658EAB2E.mlw
sha1: a4264fd5fc5f6f09998a007c2d9768aab881e1c7
sha256: cacabbc9b2abd14e3ec6a9ffc44b265f8bae00245371c598d92066eca4dbb9b2
sha512: 3a15cb24c1ad569fccf1da6e939785b03b5baf50b186f33a9bc1cb79c88ff018e2b8701608b86c285bcd33cc34739c647eb77d62190dc31693b84374b132cf69
ssdeep: 49152:Fqe3f6/P6QkO6U6HP6RbthklAr2YvdcxhcjPoP:USi/P6Qk/U6iRbtqlAyidc7AW
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright:
FileVersion: 1.0.0
CompanyName:
Comments: This installation was built with Inno Setup.
ProductName: Zayats
ProductVersion: 1.0.0
FileDescription: Zayats Download Manager
OriginalFileName:
Translation: 0x0000 0x04b0

PUA:Win32/OfferCore also known as:

K7AntiVirusAdware ( 0057ba571 )
DrWebTrojan.InstallCore.4042
CynetMalicious (score: 100)
ALYacTrojan.GenericFCA.Agent.6798
CylanceUnsafe
SangforPUP.Win32.OfferCore.mt
CrowdStrikewin/malicious_confidence_90% (D)
K7GWAdware ( 0057ba571 )
SymantecTrojan.Gen.MBT
ESET-NOD32Win32/OfferCore.A potentially unwanted
AvastFileRepMetagen [PUP]
BitDefenderTrojan.GenericFCA.Agent.6798
MicroWorld-eScanTrojan.GenericFCA.Agent.6798
Ad-AwareTrojan.GenericFCA.Agent.6798
SophosGeneric PUA KE (PUA)
VIPRETrojan.Win32.Generic!BT
McAfee-GW-EditionArtemis!PUP
FireEyeTrojan.GenericFCA.Agent.6798
EmsisoftApplication.Generic (A)
WebrootW32.Malware.Fcs
MicrosoftPUA:Win32/OfferCore
AegisLabRiskware.Win32.OfferCore.1!c
GDataTrojan.GenericFCA.Agent.6798
McAfeeArtemis!0086C607191C
MAXmalware (ai score=99)
VBA32Trojan.InstallCore
MalwarebytesPUP.Optional.OfferCore
PandaTrj/RnkBend.A
FortinetAdware/OfferCore
AVGFileRepMetagen [PUP]

How to remove PUA:Win32/OfferCore?

PUA:Win32/OfferCore removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment