PUP.Keygen.H

Your system has been detected with a potentially unwanted program (PUP) known as PUP.Keygen.H. This detection indicates that your computer may be at risk due to the presence of this unwanted software. It is essential to understand the nature of this threat and take appropriate steps to remove it and secure your system.

What Is PUP.Keygen.H?

PUP.Keygen.H is classified as a potentially unwanted program, which means it is not necessarily malicious but can still cause issues with your computer's performance and security. PUPs are often installed unintentionally by users, usually as part of a software bundle or through deceptive download links. These programs can display unwanted advertisements, collect user data without consent, or even install additional unwanted software.

How PUP.Keygen.H Operates

Once installed, PUP.Keygen.H may operate in various ways to achieve its goals, which could include displaying advertisements, redirecting browser searches, or collecting user data. It might also install additional components or software to enhance its capabilities or to monetize its presence on your system. Understanding how PUPs operate is crucial for effective removal and prevention of future infections.

PUPs like PUP.Keygen.H often exploit user behavior and system vulnerabilities to gain access to computers. They can be distributed through various means, including but not limited to, freeware or shareware programs, infected websites, or spam emails. The key to avoiding these threats is being cautious with downloads and avoiding suspicious links or email attachments.

Symptoms of Infection

Symptoms of a PUP infection can vary but commonly include an increase in unwanted advertisements, unexpected changes in browser settings, slow system performance, or the appearance of unfamiliar programs. If you have noticed any of these symptoms, it may indicate the presence of PUP.Keygen.H or another similar threat on your computer.

• Unwanted advertisements or pop-ups
• Changes in browser homepage or search engine
• Slow computer performance
• Appearance of unfamiliar programs or icons

How to Remove PUP.Keygen.H

1. Boot your computer in Safe Mode with Networking to prevent PUP.Keygen.H from loading and to give you a clean environment for removal.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This can help identify and remove all components related to the PUP.
3. Uninstall any suspicious programs that you do not recognize or that were installed around the time you noticed the symptoms of the infection.
4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any unwanted changes made by the PUP.
5. Reboot your computer and perform another scan with your anti-malware tool to ensure that all threats have been removed.

Conclusion

Removing PUP.Keygen.H from your system is crucial to restoring your computer's performance and security. By following the steps outlined above and maintaining good computing practices, such as regularly updating your software and being cautious with downloads, you can help protect your system from future infections. Remember, prevention and vigilance are key in the fight against potentially unwanted programs and other cyber threats.

Analysis Report

General information

Family Name:	PUP.Keygen.H
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 9d493a5c8a3d9bfa6d08fb01ab99cffa SHA1: 98fa587dbaeab264f688ef7af7a755da8a3c53d5 SHA256: A59FD12A460C27668305950E0CDD3D193DE77333875E950888CE9BEDBB8C4D0B File Size: 1.21 MB, 1209856 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have security information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Synaptics
File Description	Synaptics Pointing Device Driver
File Version	1.0.0.4
Product Name	Synaptics Pointing Device Driver
Product Version	1.0.0.0

File Traits

• .UPX
• 2+ executable sections
• HighEntropy
• packed
• UPX!
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\programdata\synaptics	Synchronize,Write Attributes
c:\programdata\synaptics\rcxe6c0.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\synaptics\synaptics.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Attributes
c:\programdata\synaptics\synaptics.exe	Synchronize,Write Data
c:\users\user\downloads\._cache_98fa587dbaeab264f688ef7af7a755da8a3c53d5_0001209856	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\._cache_98fa587dbaeab264f688ef7af7a755da8a3c53d5_0001209856	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries	`$�!�:i��+00�� �Gs]XM���"�2� �FX D�':D��exA-��LG=�A��J� �C �	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m ��8 tXz�jg�B �8 �� �6 �v z�Z xy �� �a��T���B�����������5���� +Bx�< ��5�R �!wz"Wc#�#�� $��%:�%`�%� &� &�-(�(X�)E )�`*J*9 *�" +�[,��-!R/9�/��0P% 1`1�	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\windows\currentversion\run::synaptics pointing device driver	C:\ProgramData\Synaptics\Synaptics.exe	RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey

Show More

HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	鳪 ȁ砍y ਪˣ 鈯ˣ 遙̃ 豤̃偫~ অˣ 炑̃龡^ 濖̃ 賬̃ 攘ťE獖}$偫~$엦1 鰚² ਷ˣ 邯̃ 뫯ʃe"ꙥž ֢ᐊ엦1-¶ fꙥž g ֢h	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	�m ��8 tXz�jg�B �8 �� �6 �v z�Z xy �� �a��T���B�����������5���� +Bx�< ��5�R �!wz"Wc#�#�� $��%:�%`�%� &� &�-(�(X�)E )�`*J*9 *�" +�[,��-!R/9�/��0P% 1`1�	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Service Control	OpenSCManager
Process Shell Execute	ShellExecuteEx
Anti Debug	IsDebuggerPresent
Process Manipulation Evasion	NtUnmapViewOfSection

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

runas c:\users\user\downloads\._cache_98fa587dbaeab264f688ef7af7a755da8a3c53d5_0001209856

runas C:\ProgramData\Synaptics\Synaptics.exe InjUpdate