What is “TrinityObfuscated (PUA)”?

The TrinityObfuscated (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrinityObfuscated (PUA) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Deletes executed files from disk
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine TrinityObfuscated (PUA)?

File Info:
name: 6484408E12BFEC279A14.mlw
path: /opt/CAPEv2/storage/binaries/233f45b7da7ae04862598ef094c61c402f4b5c7d4eb28bf2ae19395c6fad463e
crc32: 5CF439F5
md5: 6484408e12bfec279a14b2119e15e812
sha1: 52ac8421e70daf094b0d1ad959123bdbb5f1ae3e
sha256: 233f45b7da7ae04862598ef094c61c402f4b5c7d4eb28bf2ae19395c6fad463e
sha512: 7e695d482db7f22ca6dea2f981b1f9df183a017219744df8063270cb71e178c6566be5fd979013f43dd9dba93d72eae163fbe9a4afd5b9c8308faaf27460aa03
ssdeep: 98304:HkLkwkX+H8mr/FGRs9lonTE9XdugEi2AyPJRy1cUmTO5cVjWFIPAbaKyVG:8vkX+H8mr/88lonTE9XYnMmvPE6AbXeG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D236123FB26CA53EC8AA9B3155739370997B7661B81A8C0E07F4C80DCF669701E3B651
sha3_384: 157112adaae5d9c29bfde32a6889e9c54d735496ed23720ca293a2f4af9d652f0c2791dad6a38a0b96d66be0dcfdfbe1
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2023-02-15 14:54:16

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: DuvyGuard © 2024                                            
FileDescription: DuvyGuard Firewall Setup                                    
FileVersion:                     
LegalCopyright:                                                                                                     
OriginalFileName:                                                   
ProductName: DuvyGuard Firewall                                          
ProductVersion: 1.3.1.1                                           
Translation: 0x0000 0x04b0

TrinityObfuscated (PUA) also known as:

How to remove TrinityObfuscated (PUA)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.