Threat Database Potentially Unwanted Programs PUP.Boonty

PUP.Boonty

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Boonty on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.

What Is PUP.Boonty?

PUP.Boonty is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as harmful as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally, bundled with other software or downloaded from untrusted sources.

How PUP.Boonty Operates

PUP.Boonty, like other PUPs, can operate in various ways, including displaying unwanted advertisements, collecting user data, and modifying system settings. It may also install additional software or toolbars, which can further compromise your system's security and performance. PUPs can be challenging to detect and remove, as they often disguise themselves as legitimate programs or system files.

Symptoms of Infection

If your system is infected with PUP.Boonty, you may experience a range of symptoms, including slow system performance, unwanted pop-ups or advertisements, and changes to your browser settings or homepage. You may also notice that your system is running more slowly than usual or that certain programs are not functioning correctly. In some cases, PUPs can also cause system crashes or freezes.

  • Unwanted advertisements or pop-ups
  • Changes to browser settings or homepage
  • Slow system performance
  • System crashes or freezes
  • Unexplained changes to system settings or files

How to Remove PUP.Boonty

To remove PUP.Boonty from your system, follow these steps:

  1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow you to download and install removal tools.
  2. Download and install a reputable anti-malware tool, such as SpyHunter, and run a full scan of your system to detect and remove PUP.Boonty and any other malware that may be present.
  3. Uninstall any suspicious programs or software that may be related to the PUP.
  4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by the PUP.
  5. Reboot your system and run another scan with your anti-malware tool to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Boonty from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove this potentially unwanted program and prevent future infections. It is essential to remain vigilant and to regularly scan your system for malware to ensure that your computer and personal data remain secure.

Analysis Report

General information

Family Name: PUP.Boonty
Signature status: No Signature

Known Samples

MD5: f347f272c27aef22cd97e943c1418030
SHA1: f6651be2fbddc585e17b0a9b4b7b12569ac8d225
SHA256: FB754E7FAE75AA526213002A77C52E4A70CD1986B82B3F8C682E84EDE3A8BF3C
File Size: 69.12 KB, 69120 bytes
MD5: 4cab39729f57af6d7eec38cf2cd389cc
SHA1: 7898b8393035ca3b55885e98acd805701c7e5c7e
SHA256: F1C3C8FAF602D339D0AB2DE745BFB2213E5FB0ED4F5303D4C9E9624718BC3F98
File Size: 282.62 KB, 282624 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File has exports table
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

Windows PE Version Information

Name Value
Company Name BOONTY
File Description
  • System Level Service Installer
  • System Level Service Utility
File Version 2.60.030
Product Name
  • Boonty Games
  • Star Defender 3 - po
Service File 2.60.030
Service File For Win9x 2.60.030

File Traits

  • x86

Block Information

Total Blocks: 874
Potentially Malicious Blocks: 2
Whitelisted Blocks: 681
Unknown Blocks: 191

Visual Map

0 ? 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? ? ? 0 ? 0 0 ? 0 0 0 0 0 0 ? 0 0 ? ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? 0 0 ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 0 0 0 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 0 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? 0 ? 0 ? ? 0 ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? ? ? ? ? ? 0 ? ? 0 ? ? ? 0 ? ? 0 0 0 ? 0 ? ? ? ? ? 0 ? 0 ? ? ? ? ? 0 ? 1 0 0 0 0 0 0 1 1 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 1 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? ? ? ? ? 0 0 0 ? 0 0 ? ? 0 0 0 ? ? 0 ? 0 0 ? 0 0 ? 1 ? 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 0 0 0 ? ? ? ? ? ? x ? x 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Service Control
  • StartServiceCtrlDispatcher
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\7898b8393035ca3b55885e98acd805701c7e5c7e_0000282624.,LiQMAxHB