PUP.Aller

The detection of PUP.Aller on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent future infections.

What Is PUP.Aller?

PUP.Aller is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that may not be malicious in nature but can still cause problems for computer users. PUPs can be installed on a system without the user's knowledge or consent, often through bundled software downloads or deceptive installation practices. Once installed, PUPs can display unwanted advertisements, collect user data, or modify system settings.

How PUP.Aller Operates

PUP.Aller, like other PUPs, can operate in various ways to achieve its goals. It may use deceptive tactics to trick users into installing it, such as disguising itself as a legitimate program or hiding in the fine print of a software license agreement. Once installed, it can start displaying unwanted ads, redirecting browser searches, or collecting user data without consent. PUPs can also slow down system performance, cause crashes, or conflict with other software.

Symptoms of Infection

If your system is infected with PUP.Aller, you may notice several symptoms. These can include unwanted pop-up ads or banners, unexpected changes to your browser homepage or search engine, slow system performance, or unfamiliar programs installed on your computer. You may also notice that your browser is being redirected to suspicious websites or that your search results are being manipulated. Additionally, you may experience system crashes, freezes, or error messages.

• Unwanted ads or pop-ups
• Changes to browser settings
• Slow system performance
• Unfamiliar programs installed
• Browser redirects
• System crashes or freezes

How to Remove PUP.Aller

1. Boot your computer in Safe Mode with Networking to prevent PUP.Aller from loading and to allow for a clean removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect all components of PUP.Aller.
3. Uninstall any suspicious programs that were installed without your knowledge or consent, as they may be related to PUP.Aller.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted changes made by PUP.Aller.
5. Reboot your computer and perform another scan with your anti-malware tool to ensure that all components of PUP.Aller have been removed.

Conclusion

Removing PUP.Aller from your system is crucial to prevent further damage and protect your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system's security and performance. It is also essential to practice safe computing habits, such as avoiding suspicious downloads, reading software license agreements carefully, and keeping your operating system and software up to date. By being vigilant and proactive, you can reduce the risk of future infections and keep your computer safe from malware threats like PUP.Aller.

Analysis Report

General information

Family Name:	PUP.Aller
Signature status:	Hash Mismatch

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 6c43a8be26b6a05cc9546b971ef68a3e SHA1: 399b5b1adad6a863bc66c629b47cf696f4f9bef9 SHA256: 11B351CEFA6F026D2D2F1C47CCDFA3DE48240782EFED980B481547DDA0CCF7E6 File Size: 202.06 KB, 202056 bytes

MD5: 7ab93f9b0fb4b7d2b4fc6dedc431324a SHA1: 77a90d78398676497089cc4024d199a3c3bc21f7 SHA256: 18199A008242EE90EB63E8801E4A4E8B0879DEB25EBB78CB8EE1B218584FBB83 File Size: 311.94 KB, 311935 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Aller Media e.K.	COMODO RSA Extended Validation Code Signing CA	Self Signed
Aller Media e.K.	Certum Extended Validation Code Signing 2021 CA	Hash Mismatch

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Agent.LA
• Agent.MH
• Agent.MI
• Agent.MU
• Parite.F

Show More

• Rozena.H

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\program files\common files\system\symsrv.dll	Generic Write,Read Attributes
c:\program files\common files\system\symsrv.dll.000	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\a1d26e2\a7651b04e14.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszdb35.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nszdb35.tmp\nsisdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszdb35.tmp\nsisdl.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\vlc plus player (x86) updater\setup_x86.txt	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.205.9\??\C:\Windows\SystemTemp\6768f512-bc4b-484b-834a-7e49eb4a3fbd.tmp\	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix	Cookie:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix	Visited:	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Network Winsock2	WSAStartup
Network Winsock	closesocket connect inet_addr socket
Keyboard Access	GetKeyState