PUP.Goobzo

The detection of PUP.Goobzo on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.

What Is PUP.Goobzo?

PUP.Goobzo is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your privacy. PUPs are often installed unintentionally, bundled with other software or downloaded from untrusted sources.

How PUP.Goobzo Operates

PUP.Goobzo, like other PUPs, can operate in various ways, including displaying unwanted advertisements, collecting user data, and modifying system settings. It may also install additional software or components that can further compromise your system's security. PUPs can be challenging to detect, as they often masquerade as legitimate programs or hide in the background, making it difficult for users to identify and remove them.

Symptoms of Infection

If your system is infected with PUP.Goobzo, you may experience a range of symptoms, including slow system performance, unwanted pop-ups or advertisements, and changes to your browser settings or homepage. You may also notice that your system is crashing or freezing frequently, or that your internet connection is being redirected to unfamiliar websites. Additionally, you may see suspicious programs or toolbars installed on your system that you don't remember installing.

• Unwanted advertisements or pop-ups
• Changes to browser settings or homepage
• Slow system performance
• Suspicious programs or toolbars installed
• Frequent system crashes or freezes

How to Remove PUP.Goobzo

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious components related to PUP.Goobzo.
3. Uninstall any suspicious programs or software that you don't recognize or that were installed without your consent.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or add-ons.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that all components of PUP.Goobzo have been removed.

Conclusion

Removing PUP.Goobzo from your system requires a combination of technical knowledge and the right tools. By following the steps outlined above, you can effectively remove this potentially unwanted program and prevent future infections. It's essential to remain vigilant and take proactive steps to protect your system, including keeping your operating system and software up to date, using strong antivirus software, and being cautious when downloading software or clicking on links from untrusted sources.

SpyHunter Detects & Remove PUP.Goobzo

Analysis Report

General information

Family Name:	PUP.Goobzo
Signature status:	Root Not Trusted

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 74a4c97ef962cea0dc4b4837190bb4fd SHA1: 31a5a6e02776d9bbb1df9e0cc9c768816aeba785 SHA256: 983B7A803C7D96A4786556740C03A432AC472EC2FE54D71956E1FA85E806DB94 File Size: 1.27 MB, 1269696 bytes

MD5: f6830f91583d97636dee8f7c48b9e8b1 SHA1: 302da210cad9626f0430e6483dc1f0eadcd6b908 SHA256: 5A134F5DA0320248ECACEE841191DA3BF1262CB9A889C31D5E7EE6361D93800D File Size: 4.69 MB, 4693823 bytes

MD5: 1125260c57291a0375971e98fb19e4d1 SHA1: dcdcad6e7ce46e2bbe3b8b7d9828318337e2d595 SHA256: 6B6BA2003C93D309173F2C13272966FC3633F30182921E12C10CBA541C4E43F7 File Size: 4.67 MB, 4667247 bytes

MD5: ada63bcc268ff4b17cdf109c00cd594f SHA1: f17cd7eabf50bf71e4828bf198947e14d7cf64f8 SHA256: 757931AF1BE201A67B5E51AB1C850C4F2C5E8D68A7566A5078C816C9B55CC468 File Size: 4.74 MB, 4737529 bytes

MD5: 983ed404c28f22b9a11f58e2b2308a21 SHA1: f180b15dfa02083d12c13cc4cfdea33bb8194329 SHA256: 2B924078D716E5B7E7A8DB348EA6630A4308C78E8DEFD83DD8C49A4146F4E562 File Size: 650.67 KB, 650672 bytes

Show More

MD5: da11cbe4af330a433012cc69479c8808 SHA1: 9adfadf361e2d59c44243abeb34949a656500be5 SHA256: E12101A84AEB4C760228D0235FC2F47A5CEDDBB64B27744C4D1ACADEE96FD352 File Size: 2.68 MB, 2684304 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Goobzo LTD
File Description	Context menu handler
File Version	3.2.11073.2408 3.1.9588.1993 3.1.9588.1988 2.2.7764.463 2.0.7791.1471 1.0.1.1
Internal Name	SysMenu.dll
Legal Copyright	Copyright (C) 2014 Goobzo LTD
Original Filename	SysMenu.dll
Product Version	3.2.11073.2408 3.1.9588.1993 3.1.9588.1988 2.2.7764.463 2.0.7791.1471 1.0.1.1

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Shopper-Pro (GOOBZO LTD)	UTN-USERFirst-Object	Root Not Trusted
ytdownloader (Goobzo Ltd)	UTN-USERFirst-Object	Root Not Trusted

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• ShopperPro.A

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsd4407.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsgb1a9.tmp\accdownload.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsgb1aa.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsh4168.tmp\d1958.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsh4168.tmp\nk.lky	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsh4168.tmp\setup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsh4168.tmp\setup1.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsha7b6.tmp\d1958.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsha7b6.tmp\nk.lky	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nsha7b6.tmp\setup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsha7b6.tmp\setup1.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi4f42.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsl42be.tmp\accdownload.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsl42bf.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsm4e29.tmp\accdownload.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm4e2a.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsn4f63.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsqb198.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsr4147.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nss3938.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nss3939.tmp\d1958.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss3939.tmp\nk.lky	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss3939.tmp\setup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss3939.tmp\setup1.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nssa7a6.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nst4408.tmp\d1958.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst4408.tmp\nk.lky	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst4408.tmp\setup.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst4408.tmp\setup1.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsw42ae.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsx4e19.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsx4f52.tmp\accdownload.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszfa59.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nszfa69.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\7f8371bf969c55b8	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\7f8371bf969c55b8	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\d1989.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\d1989.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\dc31a5a6e02776d9bbb1df9e0cc9c768816aeba785_0001269696	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\dc31a5a6e02776d9bbb1df9e0cc9c768816aeba785_0001269696	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\nk.lky	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\nk.lky	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszfa69.tmp\system.dll	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	\??\C:\Users\Jpjjkrpe\AppData\Local\Temp\nszFA69.tmp\	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n 1 �v���5Bx%� (�*J1�1HO1�D9ߔ@V�G�IH[uR20_�z`�2a$ b"hi��l(�q�XrnJu�~{b�{�=�P��/���� �������X����T��T��T��T��T��m�Ù�������$ �>წ�����(��o� �=�SB1_T�Vw�`�V �R��i	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�n 2 �v���5Bx%� (�*J1�1HO1�D9ߔ@V�G�IH[uR20_�z`�2a$ b"he�vi��l(�q�XrnJu�~{b�{�=�P��/���� �������X����T��T��T��T��T��m�Ù�������$ �>წ�����(��o� �=�SB1_T�Vw�`�V �R	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection ReadProcessMemory
Process Shell Execute	CreateProcess
Anti Debug	IsDebuggerPresent NtQuerySystemInformation OutputDebugString
User Data Access	GetComputerName GetUserName GetUserObjectInformation
Network Wininet	InternetConnect InternetOpen InternetSetOption
Network Winhttp	WinHttpOpen
Keyboard Access	GetKeyState
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Jpjjkrpe\AppData\Local\Temp\nszFA69.tmp\DC31a5a6e02776d9bbb1df9e0cc9c768816aeba785_0001269696"

"C:\Users\Ejngewry\AppData\Local\Temp\nss3939.tmp\setup.exe"

"C:\Users\Ccpvdwdq\AppData\Local\Temp\nshA7B6.tmp\setup.exe"

"C:\Users\Cqkjjhnb\AppData\Local\Temp\nsh4168.tmp\setup.exe"

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\f180b15dfa02083d12c13cc4cfdea33bb8194329_0000650672.,LiQMAxHB

Show More

"C:\Users\Svxhplgg\AppData\Local\Temp\nst4408.tmp\setup.exe"