PUA:Win32/OfferCore (file analysis)

The PUA:Win32/OfferCore is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/OfferCore virus can do?

• Executable code extraction
• Attempts to connect to a dead IP:Port (1 unique times)
• Presents an Authenticode digital signature
• Creates RWX memory
• Reads data out of its own binary image
• Drops a binary and executes it
• Creates a hidden or system file

Related domains:

How to determine PUA:Win32/OfferCore?

File Info:
crc32: 451261F4
md5: 0086c607191cdad5cbb491bb658eab2e
name: 0086C607191CDAD5CBB491BB658EAB2E.mlw
sha1: a4264fd5fc5f6f09998a007c2d9768aab881e1c7
sha256: cacabbc9b2abd14e3ec6a9ffc44b265f8bae00245371c598d92066eca4dbb9b2
sha512: 3a15cb24c1ad569fccf1da6e939785b03b5baf50b186f33a9bc1cb79c88ff018e2b8701608b86c285bcd33cc34739c647eb77d62190dc31693b84374b132cf69
ssdeep: 49152:Fqe3f6/P6QkO6U6HP6RbthklAr2YvdcxhcjPoP:USi/P6Qk/U6iRbtqlAyidc7AW
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright:                                                                                                     
FileVersion: 1.0.0               
CompanyName:                                                             
Comments: This installation was built with Inno Setup.
ProductName: Zayats                                                      
ProductVersion: 1.0.0                                             
FileDescription: Zayats Download Manager                                     
OriginalFileName:                                                   
Translation: 0x0000 0x04b0

PUA:Win32/OfferCore also known as:

How to remove PUA:Win32/OfferCore?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.