Adware.agent.npo
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 3,891 |
| Threat Level: | 20 % (Normal) |
| Infected Computers: | 46,930 |
| First Seen: | November 11, 2013 |
| Last Seen: | February 7, 2026 |
| OS(es) Affected: | Windows |
Certain anti-malware programs use the Adware.Agent.npo detection to indicate that an adware or PUP (Potentially Unwanted Program) is present on your computer. Adware.Agent.npo is classified as adware. Basically, Adware.Agent.npo is designed to display pop-up advertisements on affected computers. Adware.Agent.npo is often linked to Web browser toolbars and other types of unwanted content that is often installed on the victim's Web browser.
Table of Contents
The Excessive Advertisements Displayed by Adware.Agent.npo My Interfere with Your Work
Technically, Adware.Agent.npo is not considered threatening. Rather, Adware.Agent.npo is not as harmful as other kind of threats. However, Adware.Agent.npo does have many characteristics that are often associated with more risky forms of threats and that may cause problems on the affected Web browser. Adware.Agent.npo may take over your Web browser, hijacking it and controlling the type of content computer users view on the affected Web browser. Adware.Agent.npo also interferes with the computer user's experience, interrupting it constantly with annoying advertisements and marketing content. In general, these types of applications are known by malware researchers as PUPs, or Potentially Unwanted Program. The main goal of Adware.Agent.npo is to generate revenue at the expense of the computer user. The people controlling Adware.Agent.npo make money by generating Web traffic for their low quality websites collecting marketing data, and displaying advertisements and sponsored marketing links on the affected Web browser.
A Freeware Application May Be the Portal of Entry of Adware.Agent.npo
Usually, Adware.Agent.npo enters a computer when its user installs a freeware application from a low quality source. Free programs typically associated with Adware.Agent.npo infections may include media players, PDF creators and download managers. These may be bundled with PUPs such as Adware.Agent.npo. In many cases, free software may be bundled with a specific installer designed to install a PUP along with the free application. Because of this, security analysts strongly recommend being careful when installing any new software. Using custom installation to monitor every single component being installed is usually a good idea. It is then a matter of preventing the installation of any content not directly associated with the freeware being installed. Content associated with Adware.Agent.npo infections may take the form of Web browser toolbars, add-ons or extensions. If Adware.Agent.npo has already been installed, Adware.Agent.npo should be uninstalled at once. After Adware.Agent.npo is removed, security researchers recommend that computer users undo any unwanted changes to their system settings and use a trusting anti-malware application to run a full scan of the affected computer.
Analysis Report
General information
| Family Name: | Adware.Dealply.FA |
|---|---|
| Packers: | UPX! |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
9d5ec193945776c75a4d83d72aa36510
SHA1:
004339c44c7bc2c6f501d72704ac7c227502507d
File Size:
616.96 KB, 616960 bytes
|
|
MD5:
9beef804717227ceb3ad820334158a71
SHA1:
c4757ba51c22aa51f9f122229ccc58e774a4d811
File Size:
647.17 KB, 647168 bytes
|
|
MD5:
9b868b58ff98ffb0dd58e513fcde7151
SHA1:
12c640099067772b740c88a525286ce8897a4478
File Size:
710.66 KB, 710656 bytes
|
|
MD5:
7f065d7a97fe994bd748c9ab6c0f026e
SHA1:
2c3214c8e163ca71bbd5206dc84ccb0b84b5836b
File Size:
676.35 KB, 676352 bytes
|
|
MD5:
f0257172909c3aa2d470ec7d0c45941f
SHA1:
d4f5cf777cef347042341f2bb507177f1148af57
File Size:
378.37 KB, 378368 bytes
|
Show More
|
MD5:
9d7d787ddbc435a62017e22b73ccc85c
SHA1:
e0d5839e2063e03f2524ca1b7f8b7bf058f30e6a
File Size:
230.91 KB, 230912 bytes
|
|
MD5:
fc3d76851b6880d4a9a328c1900cfea5
SHA1:
a76c5f4c54f3bc788c80fe2d50c18e4b68f87365
File Size:
788.99 KB, 788992 bytes
|
|
MD5:
8252348f9d198216493ee07ea6d423ed
SHA1:
c3cfddc6e139ebac7ac155a549909478095413bd
File Size:
372.22 KB, 372224 bytes
|
|
MD5:
88d32fdc780391eb5cb6c57461dc7eff
SHA1:
7d1eefc506405d2e2d558033eadeadcdb6afd713
SHA256:
D5341040928E9E6F9757AF9F484B344CC9EBFF3CEDB5FA7CC84B6D04E1E65AA5
File Size:
244.74 KB, 244736 bytes
|
|
MD5:
ce8e96fe5e777223ff7d82a1d64de72c
SHA1:
72136ad50ce3da492dc2b86165c21a36461c153e
SHA256:
FBC59AF2D081322EDFB07DF37094C83BDB7C7B32B935EE6FE6E581998683A016
File Size:
850.43 KB, 850432 bytes
|
|
MD5:
f66a49755f068cf5002bb06956b6b0b1
SHA1:
74869e71a54e36b88da47d061d437a77fcff97fe
SHA256:
B665E20C1A5FA1AB557B4E0E72AA0083FC7ADB89806E4522A54ED468DC01EA58
File Size:
522.24 KB, 522240 bytes
|
|
MD5:
89ab71daa9e8ed88ca6cff4c204ab469
SHA1:
77305415f07b63d98ed685c08c39342605310b53
SHA256:
7B3935FC1EB30F4AC23453DABAA0BC8779773A0EBD5FDC9A367EFF4D34DBFC45
File Size:
715.26 KB, 715264 bytes
|
|
MD5:
c611191243f9918455c1c8088df723c8
SHA1:
22941a52686e10b8806f6eb75dd50faad210adc5
SHA256:
B3692DC9F27A01B6327BA4C1AAB795B6B00251A5A1BBEFB9451447BD66D9586B
File Size:
389.63 KB, 389632 bytes
|
|
MD5:
a0645989f0bbc5c9cb42d6e6c5745f68
SHA1:
5df49394829944ff35d3df347aad9b285da48e0a
SHA256:
E05853FBFE8EAA4576A453CE0093A743A91CDB4657E35A98B520F81913D9FB4E
File Size:
646.14 KB, 646144 bytes
|
|
MD5:
b701597a1c9305f861185fc1cbc4cf1e
SHA1:
787d77c1032982166a1c4921275783665aa0d0b8
SHA256:
955F35DB1DA9DC51B7DDBDDE735303E0BA90D98A407D66195374BDA88DAB29D8
File Size:
330.24 KB, 330240 bytes
|
|
MD5:
84bcd731348cce54bc051189dc25b2c1
SHA1:
fe999ed15aef3e9b2052877cc51f7b60267b73d9
SHA256:
020634335384D17422DF01FC1A50D07B5823DB0352D5A65B7B2B329BC058B85D
File Size:
299.52 KB, 299520 bytes
|
|
MD5:
ce8ca5d2793c0423f146e972a50448e3
SHA1:
cd8c3ecf426d8dc1b91a66c2448fccbe943c3a53
SHA256:
1EF0C85C12218ECBB61F53E5A4BADF6BBA1516ACCCD752E9CE458144C66761C6
File Size:
572.93 KB, 572928 bytes
|
|
MD5:
9c1326c2539a47c899999c4d698e0325
SHA1:
4d7e75421c3cf4d7807726eb0fba7a4f4fa84e7e
SHA256:
2238AA176853379279C18EDBCCEDF32029EDE28020DBB3B75571A3DFA482B45D
File Size:
186.37 KB, 186368 bytes
|
|
MD5:
87ca15f9a1d7ca8f7d593913bba638b0
SHA1:
f83cad9bb4b207ffbb820a33ab0f2fd8d3a23c09
SHA256:
25F7FAA2899A4A5B85B0D3C597FA8242481DCE967C9AADA011A3F3C7C5DA4E68
File Size:
642.05 KB, 642048 bytes
|
|
MD5:
fa0fd5f830c3f7c15a86e99bc3943729
SHA1:
0c89a4227c97b1f469e3a85c605d2de7ccd23695
SHA256:
D7998C63ABD97AE22128F39D663C09AD1BBE4DC9E7D8A75F3BC0091FFA58B47A
File Size:
372.74 KB, 372736 bytes
|
|
MD5:
0e47346d4f5a2a23eab923e63575735e
SHA1:
82782e33745ab5cc6d9a595248e9dea1c46b0b4e
SHA256:
ED2003DE895E61BB53754BC2A4B8DA4D7C78CDEDE545DC68EBF9C20B5191A4F8
File Size:
496.64 KB, 496640 bytes
|
|
MD5:
7f3e90f98df08a9506135f200a3579c4
SHA1:
6df1627fd71f1eba79cc8e52048826d17a40379b
SHA256:
6FF8CC99F0AE3DDC945C7C1BF00A37ABC65582FB95D9C8DF8306F66AB23EEA33
File Size:
298.50 KB, 298496 bytes
|
|
MD5:
67434cb544ac74d319c226246ee8acaa
SHA1:
b082720429277937fe50d2f816a0b0fe7cca36e7
SHA256:
A3901ADF303EE327EC85D0AB0CA2495CEB2A2D72C5E5BB1C284AAFFC0F465D4E
File Size:
757.25 KB, 757248 bytes
|
|
MD5:
02a15b38ff05e787882c3e6cc8fa5b47
SHA1:
cb59790232b19c697205714b98e58086afbf0da9
SHA256:
2358A5B4F42F8B0A17104125AE40EFB6DF711FAF8ADBB186E71A7EC7B5CB133D
File Size:
510.46 KB, 510464 bytes
|
|
MD5:
cf728a0a8968aa6cc164bb3a92efb128
SHA1:
cd5e7324f8fb4a1797d78a5bfdfb547043d3fba4
SHA256:
5A829D4889725B9ABB2D98522C00D2EC9CD8F7752BA358059ABF428B18A643C3
File Size:
351.23 KB, 351232 bytes
|
|
MD5:
40e2a7b87f725d248d7a0ec915f96a64
SHA1:
1f806549851194a725e7017f95128fe2989208f9
SHA256:
2266BE458BF1F6C35D1C8557D0F29BC7193DF62C19323FD9007C3082362022EB
File Size:
288.26 KB, 288256 bytes
|
|
MD5:
43064b418446d2cab0602a428519566b
SHA1:
6c8092c2e4c017c06169b0708c12d8642ec368dd
SHA256:
C6A82C3651E8B4158FEED72C87ECB5B86E9B498557D914BD6CC3E698A5B53B18
File Size:
719.87 KB, 719872 bytes
|
|
MD5:
ff600b2e570eddc524138450dc497a78
SHA1:
a1c40a1656641f4b005646194479b257398952dd
SHA256:
FA701DE29DAE65C617106DF2AD95A2DE3E7351CD6CCBC088B662B7771D42D4FC
File Size:
399.87 KB, 399872 bytes
|
|
MD5:
4b2677b4f98728b0ca1670670fd94b43
SHA1:
08f3c2c08fad60aae28c62790db5da151c4c7f07
SHA256:
ED004106216EC01C705A3C8F0149B2D9766684CE0D104017014A981BA449A186
File Size:
982.53 KB, 982528 bytes
|
|
MD5:
ddb93f336bfc829254dc6060ee48c490
SHA1:
ffab348d49f17f3a8e9eae3222f2841b42922a6f
SHA256:
F048F285F35D31D3F7E93C2B6AF164598D965076A22EF91380C43F80E7796C6A
File Size:
382.46 KB, 382464 bytes
|
|
MD5:
888cf7df83e365b7304c39c38c0dae1d
SHA1:
b877e45cf93469523d8cf255bc51d4693de6cdcf
SHA256:
55BB6DF476E220F623182E4979D176D354654B058115A8D6ACD32D7B66C76340
File Size:
502.27 KB, 502272 bytes
|
|
MD5:
874fc4ccc35c0394481d138b55b0667f
SHA1:
fc1080cda4f7bd1aecf337342cda67c174ffbb48
SHA256:
E1505F4915ECAC721421F42B1D2D5F922A91D5316C715C7D0460DB520542732C
File Size:
379.39 KB, 379392 bytes
|
|
MD5:
d7acca2152c0e01abe8fbbda43a53da0
SHA1:
62f5202568a419641c77968e8af238e666e22414
SHA256:
45CB82A1383798C13FB576C8A5D5DE140FEF795C40A4A9D3F89F10B74281C0A6
File Size:
285.70 KB, 285696 bytes
|
|
MD5:
4a8f9d92cdf8801b5d934d1215609233
SHA1:
4c1de8c96360832ca2697656d492c7706125d09d
SHA256:
A277F6AC6E97095B7960E259E2FD527B844CE2ED2591ED8F1EC31CEBD973A7C9
File Size:
746.50 KB, 746496 bytes
|
|
MD5:
556c39ab7dec8ebce0ed7728863938c7
SHA1:
a3727310649f3e2103dedaa53692dcbb7c527150
SHA256:
7BECFEBBA5F698C33159CA7F8A43D4BF5387A5650F247F03AF62C33A4D32D295
File Size:
286.21 KB, 286208 bytes
|
|
MD5:
0b30363233c556fbf9f6d862be2ea507
SHA1:
d3adad4fe604ae460993e5db82ad5c76587ca543
SHA256:
E6CDE033AD8BCD5128883786CAA929AF74692D310435CAF1CD3B640694CC61E4
File Size:
741.89 KB, 741888 bytes
|
|
MD5:
a38f5fe2c3b02652d1b8429776adcd6d
SHA1:
4d03beeae031304bad649eb03ad6f83f653c1073
SHA256:
FF2F45008036976E56226128B23997C0197B4DCC26DA09A818BDA4895178E187
File Size:
286.21 KB, 286208 bytes
|
|
MD5:
a3a3085c3f7ed1c4bfb55facfb6828fd
SHA1:
7b85d2410ddc05ba579c91e829be0fe464829511
SHA256:
5BF9DA44CDD606C212897704C792B2C509ADA35D0E5700F1029FD389D44E45FF
File Size:
194.05 KB, 194048 bytes
|
|
MD5:
422a6f5a3051d74ef3faa554a6ce260d
SHA1:
74036b378ab8467d4bf9380dbc680b2d728693fc
SHA256:
B4FA32387AC7772973C03508A44FECB7687AA885B18CBC9897C75B1FEC46D2F2
File Size:
895.49 KB, 895488 bytes
|
|
MD5:
1fcc6c26d3b937efa978c8c0a64adbcf
SHA1:
f79567d540f5b99df0cf6722abdb3c2b37897aa9
SHA256:
AF281AB3E5B269CA9C46D642AA34DFE3F0C0D3DA24F3C769C20B2368C5C1AC55
File Size:
379.39 KB, 379392 bytes
|
|
MD5:
a0645f9ee4e55ec4f72dce6360e5aed0
SHA1:
8af308e931b0e748c35241b5b164b28bd64c7f5f
SHA256:
4F66149EA0818A708D6FE0B741D98F67F209BFC92FFC52BA1C73B95EDE086CF1
File Size:
354.82 KB, 354816 bytes
|
|
MD5:
e593e158c18c4b59cdd18035151a64d3
SHA1:
28f2d871a9e96d143a6abef8420f953dc348a00e
SHA256:
D845672EAC7757E1A36EC84DCA5FEFCC9CD249A8CDFBD211B11525E211097D3D
File Size:
652.29 KB, 652288 bytes
|
|
MD5:
ca308d355a5a9363178e2485ba2cd3a2
SHA1:
d53acadf879a090e8921ff68f9485277a13dab75
SHA256:
6084E492893C74298E8E6537BBCDC1D9972E520BC9B4AF34D39CFA5D67BD5FBE
File Size:
374.78 KB, 374784 bytes
|
|
MD5:
71606346e352f31d0c4c267c18e5bc30
SHA1:
d728758c8e19e95a96d8e8ce85a43e29c887955f
SHA256:
34DF9ADDF299E76555769E764BF4468EF2259B275CDA490753CEDFF655CE7587
File Size:
380.42 KB, 380416 bytes
|
|
MD5:
3b4776f49b286ad09e52b04396f2a8de
SHA1:
28eab9ae64e36e0db4ad3a64acbd988f69e63d78
SHA256:
CADF370BFCF4EB7AE1D6F542B228F32B670EC92C65CD72BD6C275A738D6E00DC
File Size:
332.80 KB, 332800 bytes
|
|
MD5:
3ba03ce2dab1e86279201146f5d4dc41
SHA1:
b14c57a8182d58bfbb8f5851ef9fd975d178baca
SHA256:
845258137911FBB078E24A54D47C351057AE27A89E0F03B7ADF79A3E9396CCDC
File Size:
287.23 KB, 287232 bytes
|
|
MD5:
825b92d45a409bd2a7d443b1f1616a74
SHA1:
d87668e7811f5fce7108596b35b6e69c7876cf64
SHA256:
A22C85B0F137CED2FD1EA16E45A79AD4EDEA8B759D20B5569934C5C6C623D37B
File Size:
933.89 KB, 933888 bytes
|
|
MD5:
1a18dba69c4ef51b6e09327836a15c8f
SHA1:
5c2304bca0dc158cd726198181d6aaff0f0f94a4
SHA256:
F827E2F2D1BB5B100E3852A194F6E1B7F1AAF601E6665B6032182CBF5F3826B3
File Size:
288.77 KB, 288768 bytes
|
|
MD5:
c0bec93782e83eade614dc95828339a8
SHA1:
9d3e2845937bce3a417f19f233585d210140765b
SHA256:
F4293618BB5E65FB0071FC4CF25D74CDB87DD1E0246E7EC5F726FAEF36375C45
File Size:
361.47 KB, 361472 bytes
|
|
MD5:
d6b308a4dbe33d7906a487ff6d71b22d
SHA1:
365272ef8b08e71ef2f317e8a3b9533beae8e9e7
SHA256:
2017D49D1DCD721268B80193BA05A36BC92949F37D2820EAEA25AEA0AE49F341
File Size:
677.89 KB, 677888 bytes
|
|
MD5:
9636cf52dc7ecb8be9e85cdf17bada11
SHA1:
79b4887f968e184420bac8a5fb73d0ed8ba3125c
SHA256:
8DD427D8110461ECDCADF7990E78A8C090C6D62B79CA24B9B0F85F8C60172F81
File Size:
313.86 KB, 313856 bytes
|
|
MD5:
fe5ffd82ac804d960596347755b704b9
SHA1:
cb1bb6a4e010550b16fc55afa3ba762ffec3ae14
SHA256:
67C8B55BFDD34EF7D932011D37CAF36F6FB3FA1DB9A0172265B816E52BA26A2B
File Size:
287.23 KB, 287232 bytes
|
|
MD5:
9ba040b4c13b4993f61a60cfd39acfde
SHA1:
02572c929e4de5159512a7ec7c51e24d4054f12b
SHA256:
B49FA2D37F3F38619A1E8820A03AD426D12F96D6EF360EEA6BE75B8584BC73FF
File Size:
385.54 KB, 385536 bytes
|
|
MD5:
ebd1a1cc76e77ce8a7ff83ddb1f0746c
SHA1:
327739442c1f07442e8a4ecc61789120e5d10ab2
SHA256:
1AB67C244DEA50C0954FE3F5019B052ABFF6395CD2FD8BAF0D9E163A1502F740
File Size:
399.87 KB, 399872 bytes
|
|
MD5:
13f7dfa43e79e0a3ae4e2bf77376ce14
SHA1:
836fb08a9abdab1e25f7c53d0e782aa4ca1fef0f
SHA256:
3134A63DC099CE72C78EE6FE7988068CFE83325373F191E41D0E5CD0D2267AFD
File Size:
190.98 KB, 190976 bytes
|
|
MD5:
69d54b7398137fdfbca5f35a1970aee2
SHA1:
0ab453fc944ff83bc0af97ff511f0577fd128360
SHA256:
E9C5DB1C677FF41B8D2FBE7FF513C26E1C4E7A9908B874DFAA710EA722D8C838
File Size:
322.05 KB, 322048 bytes
|
|
MD5:
cbc0a1770d2d9e0784de6fe8ec35d292
SHA1:
dcb002a49194658a5fc4d1d531dfd0528eb9a930
SHA256:
FA750443CBFF53846450AD3E663824CADE69B78166BA07BE16C504AC790A7D1C
File Size:
169.47 KB, 169472 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
Show More
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Legal Trademarks |
Show More
|
| Original Filename |
Show More
|
| Product Name |
Show More
|
| Product Version |
Show More
|
File Traits
- HighEntropy
- No Version Info
- packed
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,362 |
|---|---|
| Potentially Malicious Blocks: | 0 |
| Whitelisted Blocks: | 1,353 |
| Unknown Blocks: | 9 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.HJG
- BadJoke.TH
- BadJoke.XA
- Banker.GF
- Banload.XA
Show More
- Banload.XL
- Banload.XN
- DelFiles.D
- Delf.Agent.F
- Delf.GDC
- Delf.XA
- Delf.XB
- Gamehack.PDFA
- Injector.DFF
- Injector.FGGA
- Injector.FHB
- Injector.FHBA
- Injector.GDSA
- Injector.GDSB
- Injector.HDFA
- Injector.HDFB
- Injector.KAL
- Injector.KFE
- Injector.KFR
- Injector.KTG
- Injector.KZK
- Injector.XF
- Kagee.A
- Kryptik.YFH
- Lamer.B
- Leprum.B
- Nanocore.G
- PWS.Fiu.A
- Proleeg.A
- Sadenav.B
- ScriptExpert.A
- Sholta.A
- Startpage.GA
- Trojan.Downloader.Gen.FD
- Trojan.Downloader.Gen.KL
- Trojan.Kryptik.Gen.FJ
- Trojan.Kryptik.Gen.MM
- Wingo.A
- Zbot.XAF
- Zbot.XAFJ
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
