Categories: PUA

What is “PUA:Win32/PornTool”?

The PUA:Win32/PornTool is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/PornTool virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (2 unique times)
A process attempted to delay the analysis task.
Reads data out of its own binary image
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Sniffs keystrokes
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

yulv.net

010tattoos.com

andizhiyou.com

a.tomx.xyz

How to determine PUA:Win32/PornTool?


File Info:
crc32: B0996D08md5: 22d6d62751f9de77fb0c5c14cba32e6ename: WarKey.exesha1: bfd5b17a297902be76d6ad82bc225e9f0a8d8709sha256: a77e73ee01369cd3d732ca6271abb6a8821a6ba0c323dc24f10ae91ee0f1f9b8sha512: e88e5146cdfc395a496edfb1f680f8e80526110c2e820f6685a0e91d120efa18a05976fedca3c855bfae72006ccae7e0db97c4b66c9039db3db10fde94e1600dssdeep: 3072:iqiZfY7ZOy5PaVCmX4Z/RUA0mx/mRY0WVauXyVgQ8T:Dj5PayRUA0mx/kY0WVauXyVZStype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
Translation: 0x0804 0x04b0InternalName: WarKeyFileVersion: 6.06Comments: WarKey++ EnglishProductName: WarKey++ProductVersion: 6.06FileDescription: WarKey++ EnglishOriginalFilename: WarKey.exe

PUA:Win32/PornTool also known as:

CAT-QuickHeal	Trojan.VBCrypt.MF.3450
McAfee	Generic.emx
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Unwanted-Program ( 004d38111 )
K7GW	Unwanted-Program ( 004d38111 )
CrowdStrike	win/malicious_confidence_60% (W)
Invincea	heuristic
Symantec	Trojan.Gen.2
ESET-NOD32	a variant of Win32/GameTool.CE potentially unsafe
ClamAV	Win.Virus.Virut-6790009-0
GData	Win32.Trojan.Agent.Q5XPDE
NANO-Antivirus	Trojan.Win32.GameTool.dzmjhr
ViRobot	Tool.WarKey.147456
AegisLab	Trojan.Win32.Malicious.4!c
Rising	Trojan.Win32.Generic.13708AAD (C64:YzY0OkEi014Wt21X)
Comodo	Malware@#103v6up5x82ea
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.22d6d62751f9de77
Sophos	Troj/VB-ISP
Ikarus	Trojan.Rogue
Antiy-AVL	Trojan/Win32.Tgenic
Endgame	malicious (high confidence)
SUPERAntiSpyware	Trojan.Agent/Generic
Microsoft	PUA:Win32/PornTool
VBA32	AdWare.Agent
MAX	malware (ai score=100)
Panda	PUP/Trainer
APEX	Malicious
Tencent	Malware.Win32.Gencirc.114b49d4
Yandex	Trojan.DR.VB!NRsiSk2s8as
eGambit	Unsafe.AI_Score_93%
Fortinet	W32/VB.ISP!tr
Webroot	W32.Trojan.Gen
Cybereason	malicious.a29790
Paloalto	generic.ml