PUP.DDoS
The detection of PUP.DDoS on your system indicates that a potentially unwanted program has been identified, which may be capable of conducting distributed denial-of-service (DDoS) attacks. This type of program can be detrimental to your system's performance and security, as well as the security of other networks and systems it may target. It is essential to understand the nature of this threat and take immediate action to remove it.
Table of Contents
What Is PUP.DDoS?
PUP.DDoS is classified as a potentially unwanted program, which means it is not necessarily malicious in the traditional sense but can still cause significant problems. These programs often find their way onto systems through bundled software downloads, where they are included alongside legitimate applications without the user's full knowledge or consent. Once installed, PUP.DDoS can engage in various unwanted activities, including participating in DDoS attacks, which involve overwhelming a targeted system with traffic from multiple sources to disrupt its service.
How PUP.DDoS Operates
PUP.DDoS operates by utilizing the resources of the infected computer to launch or participate in DDoS attacks. This can lead to a significant increase in network traffic and system resource usage, potentially slowing down your computer and internet connection. Moreover, the program may communicate with its command and control servers to receive instructions on which targets to attack, further compromising your system's security and privacy. The presence of such a program can also indicate vulnerabilities in your system's security that need to be addressed to prevent future infections.
Symptoms of Infection
Symptoms of a PUP.DDoS infection can be subtle and may not always be immediately apparent. However, common signs include slowed system performance, increased network activity even when few or no applications are running, and unexpected changes in browser settings or the installation of unwanted software. If you notice any of these symptoms, it is crucial to investigate further to determine the cause and take appropriate action to secure your system.
- Slow system performance
- Unexplained increase in network activity
- Changes in browser settings or homepage
- Appearance of unwanted software or toolbars
How to Remove PUP.DDoS
- Boot your computer in Safe Mode with Networking to limit the program's ability to interfere with the removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of PUP.DDoS.
- Manually uninstall any suspicious programs that were installed around the time the infection was detected.
- Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any unwanted changes made by the PUP.
- Reboot your computer and perform another scan with your anti-malware tool to ensure all threats have been removed.
Conclusion
Removing PUP.DDoS from your system is crucial to prevent further damage and protect both your computer and other potential targets of DDoS attacks. By following the steps outlined above and maintaining good cybersecurity practices, such as regularly updating your software, using strong antivirus programs, and being cautious with downloads, you can significantly reduce the risk of future infections. Remember, proactive measures and vigilance are key to safeguarding your digital environment.
Analysis Report
General information
| Family Name: | PUP.DDoS |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
03b4b9430470d949c01c51a069181917
SHA1:
6013064236582e20bbf2a9925e5ff4c1b5998b17
SHA256:
855FA4A3044444FCC897C56AADC6E87A8B76AC29A512A2B15C51129C83B39E13
File Size:
724.99 KB, 724992 bytes
|
|
MD5:
603d8e3b8766832170ae2540e77c7826
SHA1:
e0e84e5d560dc739a9039ee3fc4b862762407da2
SHA256:
BF982E640B023AA7157F443D34D394ED6CED8F7F1C719406C0DD96363D62F779
File Size:
163.84 KB, 163840 bytes
|
|
MD5:
6a909cb788d00b0ef6aaee9c232757fe
SHA1:
d05c153de25fa5adc4ce4463b66a4fc0b275245b
SHA256:
37C48DFA2DA00E7BE718CEC4B24CE1427BE9D332137B11D1E389BAE0928169E8
File Size:
217.60 KB, 217600 bytes
|
|
MD5:
41605de39b02a48a1466239a69cf3022
SHA1:
c1a54dbfe6b4b1aec07d4e80fca0efbca39fcdc7
SHA256:
4D55C6D9371E3689630BB3C3257BABEED4199529CACDE715D2DD78A2AF86BBB3
File Size:
34.30 KB, 34304 bytes
|
|
MD5:
5e72c38f9efd1ae92c52ecff5c180710
SHA1:
10cf118c1b6756cc2366a9a391414b71790cd6c3
SHA256:
0CFEE4A9CE9EA2D12AE334F56B96E23E8B9A083A88E7524191A41CAE0794E2F8
File Size:
74.24 KB, 74240 bytes
|
Show More
|
MD5:
9ebcc9c1d6ddbd1d760198a1fa3cd57e
SHA1:
09223a11bd671e7eac885ca75ead59aaae2ccb71
SHA256:
AF7BE813ED5029D6FF0855ED471271DC630DF3C7CE84A1C1A38EAF44BA701C91
File Size:
77.82 KB, 77824 bytes
|
|
MD5:
7aa21fe2708c1e5640574595d7d5a184
SHA1:
060b09903882e6386b671f18e6503f9c1ede27d0
SHA256:
2BAED5E24BC61AD57331131864C7C593973B860FDED0AD1B5E21D1A4F408934E
File Size:
35.84 KB, 35840 bytes
|
|
MD5:
101b05b628ee5b2514b9ab1296f14504
SHA1:
3409ade3b138ac3634018afd8ebce9d86682d702
SHA256:
21153D05EC4FACF55BA461B31B4D5E05055C04EF13F38D64D029FAB85DAA2A82
File Size:
40.96 KB, 40960 bytes
|
|
MD5:
73a7d701b98c040a80bc24b01b1f0ef5
SHA1:
a02b63b55bc49b05f82869c2f293fa41a30076b3
SHA256:
BA83EF12A1CE751EB785F759024F90C2DBCFBE0D55FF7166609B14E9AE2A7444
File Size:
66.05 KB, 66048 bytes
|
|
MD5:
35cc3632e6afc84b1a98b2ea66921aa3
SHA1:
24fd73e4f4a15a77a3deb2b57139bf86464286d4
SHA256:
672AEEFA49412170869C0F2466772DB89309624D1E4152435800D76746A6603C
File Size:
41.98 KB, 41984 bytes
|
|
MD5:
c6b16d7a0cb8c3ea890647f605925f06
SHA1:
fdd4a38cdc8d2bc25859807dd60140811d6db297
SHA256:
7E2CCE8BC283D96A31E2B157879AC7C374FEA545CB012CD1E62B17EF3F9B3D37
File Size:
74.24 KB, 74240 bytes
|
|
MD5:
74bfe778df19770545b61c96c744cbc0
SHA1:
77168e1a855a8cb5be5ecdb47930fb038e60b381
SHA256:
1DFDBB6572D09A9A051316F297029F2BC130EDB2697386C419335BBF3488D354
File Size:
31.74 KB, 31744 bytes
|
|
MD5:
b79753306212b40f75fb7e0ed80bce0d
SHA1:
adabd5729dec9bc8c999952453c9220967c74df5
SHA256:
A2124562A547EF32F6C710194D94C9D8D6C25EA6A181B88B70771949E5527267
File Size:
55.30 KB, 55296 bytes
|
|
MD5:
b16f67fecbc0aa8cd10487f3ea946740
SHA1:
18e78c1b3237f7699e628b28a6e3b97221a1c5ac
SHA256:
49B4B3C4AA71E6DD853745556C737EAFE12A72BB5487A6E95838748A5C3C5271
File Size:
46.59 KB, 46592 bytes
|
|
MD5:
cff3f466dca5ecaaed51f0633bd65149
SHA1:
52a88e80d33275346bb38a7a83108695522e23a7
SHA256:
CB0FDD38DAEBC0D122E8FE7255DC8125C5A00B6CFB0DF63882FB1340C81D7ED0
File Size:
62.98 KB, 62976 bytes
|
|
MD5:
72801126dc7e2baed024ea69cad1961e
SHA1:
5ac6f2bc64bc0ab6f04c4291137ec28e57a570a9
SHA256:
BC876483914693CE24C963725736566FD9BA722A9042687CF5FC6A8D869D3065
File Size:
40.96 KB, 40960 bytes
|
|
MD5:
7657309b64c46df4b970d0d2f0153d52
SHA1:
c56e65ab3a68a1b1c1f11867ab1b640bfa9e970d
SHA256:
1B8E58033F111DFFD28E5CF5B0F086E03B4C12127A1CBB3CB7F0108E8CF901B7
File Size:
1.68 MB, 1676288 bytes
|
|
MD5:
18403e4912661215f315218ccfacedbf
SHA1:
e94b5592f88568b672dee934a2632752bfb07f06
SHA256:
56A0EFAE3479BA879711BFD3674D6D107CD59785F0CA099C6F90998BAB78269D
File Size:
45.57 KB, 45568 bytes
|
|
MD5:
c051cb1762148f0e0f788cdb6724f334
SHA1:
93f68c9186d20f106cbdc57a7809eec269f68907
SHA256:
AEFA881139C94DD8848A1E173EB8787E81444E216CC09C8C93E9AAE4C2E2A9B9
File Size:
52.74 KB, 52736 bytes
|
|
MD5:
6254ea6777953ce9f77e15f60f60ae3d
SHA1:
fbf1db197f5ddeb068eb23073b110c20e6278dc1
SHA256:
E23A96AFA548760EB79FC9E4388204B2082E269F935493EAD676EEFA39DAA68D
File Size:
50.18 KB, 50176 bytes
|
|
MD5:
c69867b10e5040fb55e40db2674c5db0
SHA1:
2865b7d1a8f2e64264c0f008227d7ec6ddf1fbab
SHA256:
74F4EB951B5C49EF83088224AF6C570A32576F71469939154880159A9A4503E7
File Size:
46.59 KB, 46592 bytes
|
|
MD5:
85ed0797edf4519b747f961405fb69c7
SHA1:
3632daa9d4ca7f7240f1fd41c22b5f549ca62a76
SHA256:
BA74A0BFFB477E40846A3B5F37BBAEDC28FEF67A572524B58654F00D72A32D28
File Size:
34.82 KB, 34816 bytes
|
|
MD5:
9f619efcbd3f63ea298fe8d27c81a325
SHA1:
9346513998e5163a4d68ade178e79ac85efe1bbb
SHA256:
BE3584C7593D70CFC5042814F0032D739D2CAA75981ABD3A8B53CE9DED072EA4
File Size:
46.59 KB, 46592 bytes
|
|
MD5:
e55c65171a66510fe69566b9283f7b97
SHA1:
e08e8b40b3ed22f944f71552ed141423739e8ab7
SHA256:
E511BD43F1B5674E44CDD2B747BCCA2E67AD40309DDD4EF99B768B2258625344
File Size:
49.66 KB, 49664 bytes
|
|
MD5:
f6deecd58c464fa75e253b9643f64eb4
SHA1:
157b1d242ca3e378df23599b9ce3c79ac5726919
SHA256:
232F6AFD5F68B483D5508E4E3B3E8574359E1B2FB2C7C500A10F70CD41FFBB6E
File Size:
33.28 KB, 33280 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments | ISB (I'm so bored) is a network-stress testing utility for Windows. |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
Show More
|
| Legal Copyright |
|
| Original Filename |
Show More
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- Installer Version
- NewLateBinding
- No Version Info
- ntdll
- RijndaelManaged
- Run
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 68 |
|---|---|
| Potentially Malicious Blocks: | 44 |
| Whitelisted Blocks: | 20 |
| Unknown Blocks: | 4 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
x
x
x
?
x
x
x
x
x
x
x
x
0
x
x
x
x
x
0
?
?
x
x
x
x
x
x
x
x
0
0
x
x
x
x
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
x
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Injector.DFF
- Injector.GPB
- Injector.GSD
- MSIL.Agent.KA
- MSIL.Krypt.UJB
Show More
- MSIL.Kryptik.UJA
- MSIL.Spy.Agent.AOD
- MSIL.Spy.Agent.DX
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\programdata\iashost.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\masonkit.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\24fd73e4f4a15a77a3deb2b57139bf86464286d4_0000041984 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\93f68c9186d20f106cbdc57a7809eec269f68907_0000052736 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\fbf1db197f5ddeb068eb23073b110c20e6278dc1_0000050176 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\24fd73e4f4a15a77a3deb2b57139bf86464286d4_0000041984 | Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144 |
| c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\24fd73e4f4a15a77a3deb2b57139bf86464286d4_0000041984 | Synchronize,Write Attributes |
| c:\users\user\appdata\roaming\microsoftupdate.exe | Generic Write,Read Attributes |
| c:\users\user\appdata\roaming\system32.exe | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\tracing\rasapi32::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::enableconsoletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasapi32::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKLM\software\microsoft\tracing\rasmancs::enablefiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableautofiletracing | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::enableconsoletracing | RegNtPreCreateKey |
Show More
| HKLM\software\microsoft\tracing\rasmancs::filetracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::consoletracingmask | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::maxfilesize | RegNtPreCreateKey | |
| HKLM\software\microsoft\tracing\rasmancs::filedirectory | %windir%\tracing | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\run::24fd73e4f4a15a77a3deb2b57139bf86464286d4_0000041984 | C:\Users\Eazakgdu\AppData\Roaming\24fd73e4f4a15a77a3deb2b57139bf86464286d4_0000041984 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
6 additional items are not displayed above. |
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
| Anti Debug |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Network Winhttp |
|
| Network Info Queried |
|
| Process Manipulation Evasion |
|
