Categories: PUA

About “Win32:Downloader-TOV [PUP]” infection

The Win32:Downloader-TOV [PUP] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Downloader-TOV [PUP] virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Guard pages use detected – possible anti-debugging.
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify proxy settings
Harvests cookies for information gathering

How to determine Win32:Downloader-TOV [PUP]?


File Info:
name: 34C2FD171B09C222A2A9.mlwpath: /opt/CAPEv2/storage/binaries/8483b85f20c2853da4cd98569ee5065d6d2ed83f4e1eb79b9882ab87d034b458crc32: FF6DF1AAmd5: 34c2fd171b09c222a2a9fcba530d0b30sha1: 804610b10c8dc2450c27845d2ecac9af0163f718sha256: 8483b85f20c2853da4cd98569ee5065d6d2ed83f4e1eb79b9882ab87d034b458sha512: d809470743d18d36bb34aeb4845f688f4de534e367fed3eb3751d15da8f8607d6479997b52ee53b268f27df971d0fa685ac289c50bc2a482bfdf075863151edassdeep: 49152:246ahtlpaSKrD5hAHFaV8sRfq9MfBq0t:R6+wfoFTmfqqw0ttype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T14EE55C13B284603AF0273E764EB7C590993B7E203A599C576FF49D8C0E39542BD3EA46sha3_384: cc0c2e3e9afca4d50f032117a8506cb3b28d7092f73355aa63d128146b22fd5a11326b57290470807d05d464b90d3277ep_bytes: 558bec83c4f0b8a0566500e84091dafftimestamp: 2013-05-23 17:17:08
Version Info:
FileVersion: 1.0.0.0ProductVersion: 1.0.0.0Translation: 0x0409 0x04e4

Win32:Downloader-TOV [PUP] also known as:

Lionic	Adware.Win32.DownloadWare.moVb
Elastic	malicious (high confidence)
DrWeb	Adware.Downware.971
Cynet	Malicious (score: 100)
FireEye	Generic.mg.34c2fd171b09c222
CAT-QuickHeal	AdWare.DownloadWare.BV11
McAfee	Artemis!34C2FD171B09
Cylance	Unsafe
Zillya	Downloader.Soft32Download.Win32.1
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Adware ( 004b99fc1 )
K7GW	Adware ( 004b99fc1 )
Cybereason	malicious.71b09c
BitDefenderTheta	AI:Packer.DAD2F6B219
Cyren	W32/Soft32Download.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Soft32Downloader.C potentially unwanted
TrendMicro-HouseCall	TROJ_GEN.R067C0WAK22
Paloalto	generic.ml
Kaspersky	not-a-virus:Downloader.Win32.Soft32.adez
BitDefender	Gen:Variant.Zusy.368158
NANO-Antivirus	Riskware.Win32.Dwn.cvxhzw
MicroWorld-eScan	Gen:Variant.Zusy.368158
Avast	Win32:Downloader-TOV [PUP]
Sophos	Generic ML PUA (PUA)
Comodo	Application.Win32.Soft32Downloader.S@561alr
VIPRE	Soft32Downloader (fs)
TrendMicro	TROJ_GEN.R067C0WAK22
Emsisoft	Gen:Variant.Zusy.368158 (B)
Ikarus	Trojan.Symmi
Jiangmin	Downloader.Soft32.ch
Avira	APPL/Soft32Down.diq
Antiy-AVL	Trojan/Generic.ASBOL.E7
Gridinsoft	Ransom.Win32.Occamy.sa
Microsoft	Trojan:Win32/Occamy.C84
ViRobot	Adware.Soft32Downloader.3125400
GData	Win32.Application.Soft32Downloader.A
SentinelOne	Static AI – Malicious PE
AhnLab-V3	PUP/Win32.Soft32Downloader.R191013
VBA32	TScope.Trojan.Delf
ALYac	Gen:Variant.Zusy.368158
Malwarebytes	Malware.AI.3462243848
APEX	Malicious
Rising	Trojan.Bancteian!1.A43E (C64:YzY0OpMqb4Qcci7p)
Yandex	Trojan.GenAsa!1G6x5A3WWSY
MAX	malware (ai score=100)
eGambit	Unsafe.AI_Score_100%
Fortinet	Adware/Softdownmgr
AVG	Win32:Downloader-TOV [PUP]
CrowdStrike	win/grayware_confidence_100% (W)
MaxSecure	not-a-virus:.Trojan.Soft32Downloader