PUP.2345.com
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 1,411 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 123,424 |
| First Seen: | July 13, 2015 |
| Last Seen: | October 18, 2026 |
| OS(es) Affected: | Windows |
Your system has been detected to have PUP.2345.com, a potentially unwanted program that may cause issues with your computer's performance and security. This detection indicates that your system may be at risk, and it is essential to take immediate action to remove the threat and protect your personal data.
Table of Contents
What Is PUP.2345.com?
PUP.2345.com is a type of potentially unwanted program that can be installed on your system without your knowledge or consent. It may be bundled with other software or downloaded from the internet, and its primary purpose is to display unwanted advertisements, collect user data, or perform other malicious activities. PUPs like PUP.2345.com can compromise your system's security and put your personal information at risk.
How PUP.2345.com Operates
PUP.2345.com operates by installing itself on your system and then executing its malicious code. It may create registry entries, add files and folders, and modify system settings to maintain its presence on your computer. The program may also communicate with its command and control servers to receive updates, send stolen data, or download additional malware. PUP.2345.com can also display unwanted advertisements, pop-ups, and banners, which can be annoying and disrupt your browsing experience.
Symptoms of Infection
If your system is infected with PUP.2345.com, you may experience several symptoms, including slow system performance, unwanted advertisements, and pop-ups. You may also notice that your browser homepage or search engine has been changed without your consent. Additionally, you may see suspicious programs or tools installed on your system, or notice that your system is crashing or freezing frequently. These symptoms indicate that your system is infected, and you should take immediate action to remove the threat.
- Unwanted advertisements and pop-ups
- Slow system performance
- Changed browser homepage or search engine
- Suspicious programs or tools installed
- System crashes or freezes
How to Remove PUP.2345.com
- Boot your system in Safe Mode with Networking to prevent PUP.2345.com from loading and to allow you to remove it more easily.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect and remove all instances of PUP.2345.com.
- Uninstall any suspicious programs or tools that you do not recognize or that were installed without your consent.
- Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by PUP.2345.com.
- Reboot your system and perform another scan with your anti-malware tool to ensure that all instances of PUP.2345.com have been removed.
Conclusion
Removing PUP.2345.com from your system is essential to protect your personal data and prevent further damage. By following the steps outlined above, you can remove the threat and restore your system to its normal state. It is also essential to practice safe computing habits, such as avoiding suspicious downloads, using strong passwords, and keeping your operating system and software up to date, to prevent similar infections in the future. Remember to always use reputable anti-malware tools and to be cautious when installing software or clicking on links from unknown sources.
SpyHunter Detects & Remove PUP.2345.com
Registry Details
PUP.2345.com may create the following registry entry or registry entries:
File name without path
http_skin.ie.2345.com_0.localstorage
Software\2345.com
Software\2345Explorer
SOFTWARE\2345Pic
SOFTWARE\Classes\.htm\OpenWithProgIds\2345ExplorerHTML
SOFTWARE\Classes\.html\OpenWithProgIds\2345ExplorerHTML
SOFTWARE\Classes\.shtml\OpenWithProgids\2345ExplorerHTML
SOFTWARE\Classes\.webp\OpenWithProgids\2345ExplorerHTML
SOFTWARE\Classes\.xht\OpenWithProgIds\2345ExplorerHTML
SOFTWARE\Classes\.xhtml\OpenWithProgIds\2345ExplorerHTML
SOFTWARE\Classes\2345ExplorerHTML
SOFTWARE\Classes\Applications\2345Explorer.exe
Software\Classes\http\shell\2345Explorer
Software\Classes\https\shell\2345Explorer
SOFTWARE\Clients\StartMenuInternet\2345Explorer
SOFTWARE\Clients\StartMenuInternet\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDITIONAL_IE8_MEMORY_CLEANUP\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_INTERNET_SHELL_FOLDERS\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_REQUIRE_VALID_MAILTO_APP_PPROTOCOL_REGISTRATION_KB941193\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\2345Explorer.exe
Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_USE_WEBOC_OMNAVIGATOR_IMPLEMENTATION\2345Explorer.exe
SOFTWARE\Microsoft\MediaPlayer\ShimInclusionList\2345Explorer.exe
SOFTWARE\Microsoft\Tracing\2345Explorer_RASAPI32
SOFTWARE\Microsoft\Tracing\2345Explorer_RASMANCS
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345Explorer.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\2345PicViewer.exe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids\2345Pic.bmp
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids\2345Pic.dib
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.emf\OpenWithProgids\2345Pic.emf
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.gif\OpenWithProgids\2345Pic.gif
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithProgids\2345Pic.ico
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jfif\OpenWithProgids\2345Pic.jfif
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpe\OpenWithProgids\2345Pic.jpe
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithProgids\2345Pic.jpeg
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithProgids\2345Pic.jpg
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.png\OpenWithProgids\2345Pic.png
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithProgids\2345Pic.tif
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tiff\OpenWithProgids\2345Pic.tiff
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wdp\OpenWithProgids\2345Pic.wdp
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmf\OpenWithProgids\2345Pic.wmf
SOFTWARE\RegisteredApplications\2345Explorer
SOFTWARE\Wow6432Node\2345Explorer
SOFTWARE\Wow6432Node\2345Pic
SOFTWARE\Wow6432Node\Clients\StartMenuInternet\2345Explorer
SOFTWARE\Wow6432Node\Microsoft\MediaPlayer\ShimInclusionList\2345Explorer.exe
SOFTWARE\Wow6432Node\Microsoft\Tracing\2345Explorer_RASAPI32
SOFTWARE\Wow6432Node\Microsoft\Tracing\2345Explorer_RASMANCS
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\2345Explorer.exe
SOFTWARE\Wow6432Node\RegisteredApplications\2345Explorer
SYSTEM\ControlSet001\services\Protect_2345Explorer
SYSTEM\CurrentControlSet\services\Protect_2345Explorer
Directories
PUP.2345.com may create the following directory or directories:
| %APPDATA%\2345Explorer |
| %APPDATA%\2345Pic |
| %APPDATA%\Shield_2345Explorer |
| %LOCALAPPDATA%\2345Explorer |
| %PROGRAMFILES%\2345Soft\2345Explorer |
| %PROGRAMFILES%\2345Soft\2345Pic |
| %PROGRAMFILES(x86)%\2345Soft\2345Explorer |
| %PROGRAMFILES(x86)%\2345Soft\2345Pic |
| %TEMP%\2345Explorer |
| %appdata%\softmgr_2345 |
Analysis Report
General information
| Family Name: | PUP.2345.com |
|---|---|
| Signature status: | Modified signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
8bbc9928aa2e6bcc3fbcbc1a445fa0d7
SHA1:
d226a5ea3aa41c628cff31297b7b60a1175f2797
File Size:
2.53 MB, 2530072 bytes
|
|
MD5:
f2d1d09971f8fad5922d5de4c7567332
SHA1:
941f2ef8ae5ea83d0faacaa77f72db02eb7b0b31
File Size:
5.26 MB, 5264680 bytes
|
|
MD5:
473a984cd9306bf095ac67cc7fab375b
SHA1:
6a77f3fd80f2b465636bb74aeb1c0687a966bd02
SHA256:
7348543EE8299A5C09B455B0C30232332F641792738A863E7BAB70C9640C255E
File Size:
4.55 MB, 4552896 bytes
|
|
MD5:
da97896ce72ad9e8d327d2c2a8f4f3b5
SHA1:
4c684e5c848233b0deb2de0dd33b891955f2d330
SHA256:
74FB5F6D3B30FF33077B6A6D92FF6F873C2ECDFDDA163A27EED75365003CE023
File Size:
1.14 MB, 1142488 bytes
|
|
MD5:
8e7871ad233b88745ada7a1763c1c581
SHA1:
81762b51fb2676f6b53d69e0c5b0d744fb4575df
SHA256:
3BD4EB43419FF7B65B9F28351D3357E0033EBE229EC629056A9AD7777AA897CD
File Size:
210.62 KB, 210616 bytes
|
Show More
|
MD5:
7ff366f5f7982e21084d085df2650d6b
SHA1:
f1e4015789afa7b457d3f6e757113b2da8718fe0
SHA256:
CE47AA057441008315AFD445F9BD355CD943A8BD602EB8952912590C33B3ECB5
File Size:
5.26 MB, 5264568 bytes
|
|
MD5:
5e61087e84607131582313cbbd3853ec
SHA1:
131a278d8a1e276e654f1a53ddebaae6e0396ac1
SHA256:
D8DBD1E1ED43614C2336A23D1CD39AC78511CBD8406516EA01DC2475702CD844
File Size:
4.13 MB, 4132568 bytes
|
|
MD5:
48f468f8a2531e997ab50e9c2834ad39
SHA1:
f96f13b3f4e592cd3b7e046f64bbd3c6fc3ccc48
SHA256:
F91F89B463074E028B8D0F851A24DF6DDF5EC5971418423073E09C3CB8C5D0C1
File Size:
2.96 MB, 2957624 bytes
|
|
MD5:
5e9792de539a74f1f2b99c14411676ca
SHA1:
4e54a50e80ef48a515a43c5467da73c21208c4a9
SHA256:
82F76D0C8A1C02CDD011E5A09453C59C35FBD878D742950D159BC41E3ED26113
File Size:
2.53 MB, 2530200 bytes
|
|
MD5:
38dab1f94d4de2bf0d461cee5f0adf44
SHA1:
a88be403dbe227cdd99a84c0945565687a369596
SHA256:
092E1E86171486724DC034344B28FD99FE9CEFAD5B8FECE9A381B16A4B060354
File Size:
1.19 MB, 1190296 bytes
|
|
MD5:
6c1956c5256732581acc4c68301910a0
SHA1:
5800ba5410db37b0497d948fcb946bbc9abac497
SHA256:
98A2C2B1C245DC3F0484225289211F4BFFCD91FF27B87F78C4B37A2947967BCC
File Size:
210.74 KB, 210736 bytes
|
|
MD5:
876dfb723199b071b11f333cc51b5f5a
SHA1:
1d1cb51e2a334cd74a02d94d2adc76051ece7149
SHA256:
4E5A6D9F8AC7FEBFC949F4669DF4D51C6461068BDA26841B4A4E240D087AADC1
File Size:
2.53 MB, 2530200 bytes
|
|
MD5:
9da400b213a462fa77ed0694a9db8e40
SHA1:
4d7e6e710e7309f8c6c4f0c9c9c9dc6bc2424fe8
SHA256:
BC9865BEA3BF1BF4F8549C4D6FC4B87EB7FF9F5CBEA4742789AE47D4F45A43A9
File Size:
1.97 MB, 1966080 bytes
|
|
MD5:
f819428ce3071815353b6327e4c9c131
SHA1:
7886d54707f9402edd7b2826cdbe2f1f7196f577
SHA256:
A9A925943B2786B728561C7F57D6039A64FE6B07A6A2418C77ACF585D6AAC5BD
File Size:
1.19 MB, 1190296 bytes
|
|
MD5:
bf0514afc9743041b4e5cd11a75916f8
SHA1:
89a7bb0649f37563454ec941d9bf6b9c9a97b035
SHA256:
4851687900F8A94FA161106E53EA72064FEBE2363FF4D2D51BDC548B9CC88A24
File Size:
2.53 MB, 2530200 bytes
|
|
MD5:
9ebec41415ca018d9364ac5b7f2ec72f
SHA1:
4c4fcb87d5a7284f9ba575f5fd18bdb0a2350df3
SHA256:
A84DDEE469C5C6343FA5A89BBB519F4F2FB02AA165D32F93DCE824065749E623
File Size:
1.80 MB, 1801000 bytes
|
|
MD5:
ecda0fc4586e6083e6f005d4e6a9d560
SHA1:
8096da9e8d0b1d7f10150646795948435fcc4872
SHA256:
1EB0FEE3CAA50B879FE61B556474FC19E14C230E912027949FF2A960E7ED50EC
File Size:
5.26 MB, 5264680 bytes
|
|
MD5:
c4881d293f7ffb57ee137ac748de3cd2
SHA1:
0a1dd18cb3da3e99310016edaa2b1f7dd25c8278
SHA256:
43E366CCC26C01EEA675AF6BC5925B7718450623507CEBE565F1BDED115C4FC0
File Size:
210.73 KB, 210728 bytes
|
|
MD5:
b4ba6fa86c0428262e868fcac7f29814
SHA1:
713c901210251a996de387b590c930fd69702c5d
SHA256:
BFBC2BA96C7678959675C2CBAE9C14D211CD448D9AA3C566F5D69C59C0E6C7B3
File Size:
1.51 MB, 1513944 bytes
|
|
MD5:
1a85fb39bcd81fb7af3b20a182e1e31e
SHA1:
7f975dc5c4bdcd95f672b5cca30536584130b6a5
SHA256:
78C377702183982A9BAE6B9BE2796CE04A25587B09CCFB0FDC31D4AE188AD15D
File Size:
530.73 KB, 530728 bytes
|
|
MD5:
2570c849c179682f7bb5e0d440579aea
SHA1:
9e7f2878d30e6a2dc3c8124ff0b96ba1bb652030
SHA256:
4937ED3D5CCB30A32E3C018484A1861A29AD4CEB8915DCD12E9B16296D66F463
File Size:
1.03 MB, 1025336 bytes
|
|
MD5:
8e962433a0e54acfe7e12dac2008f297
SHA1:
f037cf478acb8cd796cf082124832184f9977333
SHA256:
626B232F58A4772A33DDE9F53345124CE791BD850FD61A20300B8A95096DDFBB
File Size:
103.94 KB, 103936 bytes
|
|
MD5:
1797a7c85b3df551cf053d94c7338b34
SHA1:
0fea6d2fcfca07c1b2cb371a7e6cfb5fc7a81531
SHA256:
621B6171422B74F3B7DABF785697D053D344F425C158982B9D9738350B24C6B3
File Size:
3.69 MB, 3692328 bytes
|
|
MD5:
23ed7e43f949d6139ed5a6c4302bc16c
SHA1:
bee1e148a6baa6129a1361ee27741b0a799cc226
SHA256:
40FAFECECAB6ECB1568E0FAFCDFD8CFAA0A4F1F996E38E5676898D5263E702DE
File Size:
2.54 MB, 2544008 bytes
|
|
MD5:
c4c10f52bcfccc812ae823e1f3d7835d
SHA1:
c38a64e4daf721cd7e3ecc1b4a8ae8a2e975ae06
SHA256:
246CCCE335C01BE2E677D28D9C9E7353D6813655DA204E20622CC2D996DFCBAD
File Size:
1.75 MB, 1749912 bytes
|
|
MD5:
57da136dec531cfc48132915102577bb
SHA1:
390870024f44700bc20225c2d2edc658e4d210cf
SHA256:
8D082D09A6FA2AC4420AF9F39AA493E868D3B3432348350B8A77942FCCAD8FB7
File Size:
2.54 MB, 2544024 bytes
|
|
MD5:
856f42e27ad6142120e4e9bc13f42633
SHA1:
491383220ff0e129f4b626ad02ac302ecf79a781
SHA256:
78718558D214D1A21301A79DA95CA131B0F9FE79B534D20B3BAA2035715B4ED2
File Size:
2.91 MB, 2905392 bytes
|
|
MD5:
bae6d181177f3c82a22763f8ce22413c
SHA1:
fb3db3e3e359a6057fe65907367bde55b86903d0
SHA256:
8A70FF5A88D674CA95A30F0C7BEA886CE1D49CAFE0DEA107483F85718CF42959
File Size:
1.25 MB, 1253848 bytes
|
|
MD5:
fe183f602a977c39e2bb45f0ef80709f
SHA1:
75019ef76cd8b04d7eb5dd7ec540ccda266bfa75
SHA256:
A55D342CE08434FEC1AFA7E0492A550CB1567E4E4A95D09EE135D42E3D3189B8
File Size:
2.91 MB, 2905392 bytes
|
|
MD5:
19e5a1babe52ea04ddc0e0709abe1433
SHA1:
d2e8c4715e7c28a5d838cb05b4dc46dd5bb06810
SHA256:
5753A83FD13673672BCECF16D77FBA0F8B0894F86FBEC27161838CDB13B1ED3E
File Size:
266.65 KB, 266648 bytes
|
|
MD5:
262687068f00359aba9e0ab54d054682
SHA1:
6cc3b7f99b2e146fb84e70edbf60960a11d33e30
SHA256:
E1CB18C50CC84E1CDAD031A400D00B6B91E95A2AA214399BF120D4A83D1053C6
File Size:
279.22 KB, 279216 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
Show More
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments |
|
| Company Name |
|
| File Description |
Show More
|
| File Version |
Show More
|
| Internal Name |
Show More
|
| Legal Copyright |
Show More
|
| Original Filename |
Show More
|
| Private Build |
|
| Product Name |
Show More
|
| Product Version |
Show More
|
| Special Build |
|
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Shanghai 2345 Mobile Technology Co., Ltd. | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Self Signed |
| Shanghai 2345 Mobile Technology Co., Ltd. | DigiCert Trusted Root G4 | Root Not Trusted |
File Traits
- HighEntropy
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 922 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 647 |
| Unknown Blocks: | 274 |
Visual Map
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
x
0
0
0
0
?
?
?
?
?
0
0
0
0
1
?
?
?
0
?
?
?
0
?
0
?
?
0
?
?
?
?
?
0
?
0
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
0
?
0
0
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
0
0
1
?
?
?
?
?
0
0
?
?
?
0
0
0
?
?
0
0
0
0
0
0
?
0
1
0
0
0
0
0
0
0
0
0
0
0
?
0
?
0
?
?
?
?
?
0
?
?
?
0
?
?
0
0
?
0
?
?
0
0
?
?
?
?
0
?
?
?
?
?
?
0
?
1
0
0
?
0
0
?
?
?
0
?
?
0
?
0
?
?
?
?
?
?
?
?
0
?
0
0
?
0
0
?
?
?
?
?
?
?
0
?
?
?
?
0
0
?
?
0
0
0
0
0
?
0
?
?
?
0
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
?
?
0
?
?
0
0
?
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
0
?
?
0
0
0
0
?
0
1
?
?
?
?
0
?
0
?
?
0
0
?
0
0
?
0
0
0
0
0
0
?
?
0
?
?
?
0
?
0
?
0
?
0
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
0
0
1
0
?
0
0
0
0
?
?
?
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
1
0
0
?
0
0
0
0
0
1
0
0
0
0
0
?
0
0
0
0
0
?
?
?
0
?
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
1
0
0
0
0
0
0
0
0
0
0
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\0020bc10_rar\713c901210251a996de387b590c930fd69702c5d_0001513944 | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\0020bc10_rar\713c901210251a996de387b590c930fd69702c5d_0001513944 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\nse2602.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nse3909.tmp\fileinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nse3909.tmp\rcwidgetpluginuninstall.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsf273b.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nsi37ee.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
| c:\users\user\appdata\local\temp\nso38f8.tmp | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete |
Show More
| c:\users\user\appdata\local\temp\nsu274b.tmp\fileinfo.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\nsu274b.tmp\rcwidgetpluginuninstall.dll | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\local\temp\~nsua.tmp\un_a.exe.p | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\2345.com\713c901210251a996de387b590c930fd69702c5d_0001513944 | Generic Write,Read Attributes |
| c:\windows\system.ini | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Lgbqyhzy\AppData\Local\Temp\~nsuA.tmp\Un_A.exe | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\muicache::c:\users\lgbqyhzy\appdata\local\temp\~nsua.tmp\un_a.exe | 好压万能压缩 v1.1 安装程序 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Lgbqyhzy\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Lgbqyhzy\AppData\Local\Temp\~nsuA.tmp\Un_A.exe.p | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | \??\C:\Users\Lgbqyhzy\AppData\Local\Temp\~nsuA.tmp\Un_A.exe \??\C:\Users\Lgbqyhzy\AppData\Local\Temp\~nsuA.tmp\Un_A.exe.p \??\ | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\explorer\advanced::hidden | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::antivirusoverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::antivirusdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::firewalldisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::firewalloverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center::updatesdisablenotify | RegNtPreCreateKey |
Show More
| HKLM\software\wow6432node\microsoft\security center::uacdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::antivirusoverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::antivirusdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::firewalldisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::firewalloverride | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::updatesdisablenotify | RegNtPreCreateKey | |
| HKLM\software\wow6432node\microsoft\security center\svc::uacdisablenotify | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings::globaluseroffline | RegNtPreCreateKey | |
| HKLM\software\microsoft\windows\currentversion\policies\system::enablelua | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::enablefirewall | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::donotallowexceptions | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\sharedaccess\parameters\firewallpolicy\standardprofile::disablenotifications | RegNtPreCreateKey | |
| HKCU\software\apcr\1214104697::1919251317 | | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::-456464662 | RegNtPreCreateKey | |
| HKCU\software\apcr\1214104697::1462786655 | RegNtPreCreateKey | |
| HKCU\software\apcr\1214104697::-912929324 | # | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::1006321993 | ơ | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::-1369393986 | http://www.syattus.com.br/images/logo.gif http://zanzoul.aya.c | RegNtPreCreateKey |
| HKCU\software\apcr\1214104697::549857331 | Oz6�xd�(<��D5V�i�گX}�E9�0�a9J��E%�go[��1k��� �<�����/ ��A>M | RegNtPreCreateKey |
| HKCU\software\apcr::u1_0 | 賘蜭 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_0 | ◊ | RegNtPreCreateKey |
| HKCU\software\apcr::u3_0 | 権ă | RegNtPreCreateKey |
| HKCU\software\apcr::u4_0 | RegNtPreCreateKey | |
| HKCU\software\apcr::u1_1 | 껥 | RegNtPreCreateKey |
| HKCU\software\apcr::u2_1 | 嚿牥 | RegNtPreCreateKey |
| HKCU\software\apcr::u3_1 | ᥜ獦 | RegNtPreCreateKey |
| HKCU\software\apcr::u4_1 | 獵牥 | RegNtPreCreateKey |
| HKLM\system\controlset001\control\session manager::pendingfilerenameoperations | *1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old5af52 *1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old5af62 *1\??\C:\P | RegNtPreCreateKey |
| HKCU\local settings\software\microsoft\windows\shell\muicache::c:\users\ontdgwtl\appdata\local\temp\~nsua.tmp\un_a.exe | 2345看图王 v11.4 安装程序 | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | n - �v �Z����Bx #��(�1`1�1HO 5�0<.:@V� H[uH�pN$_�zb"hk`k�ql(�{b��P� ��!�/����� � ��3�� ��� ����X�������.�m� Ù� �gi�V ����$�8წ���l� A�~ �=�SB1_ B�� T�Vw���%�������� �A | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Service Control |
|
| Network Wininet |
|
| Anti Debug |
|
| Network Winhttp |
|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6a77f3fd80f2b465636bb74aeb1c0687a966bd02_0004552896.,LiQMAxHB
|
"C:\Users\Lgbqyhzy\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f96f13b3f4e592cd3b7e046f64bbd3c6fc3ccc48_0002957624.,LiQMAxHB
|
runas C:\Users\Wnjfhgyf\appdata\Roaming\2345.com\713c901210251a996de387b590c930fd69702c5d_0001513944 install_admin
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7f975dc5c4bdcd95f672b5cca30536584130b6a5_0000530728.,LiQMAxHB
|
Show More
"C:\Users\Ontdgwtl\AppData\Local\Temp\~nsuA.tmp\Un_A.exe" _?=c:\users\user\downloads\
|
