PUP.Keygen.MA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 7,412 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 2,380 |
| First Seen: | January 24, 2013 |
| Last Seen: | October 6, 2026 |
| OS(es) Affected: | Windows |
PUP.Keygen.MA is a heuristic detection that EnigmaSoft's SpyHunter assigns to "key generator" (keygen) programs — small utilities that claim to manufacture serial numbers, license keys, or activation codes so users can unlock commercial software without paying. Files flagged under this name are classified as Potentially Unwanted Programs (PUPs) or riskware because they are tightly bound to software piracy, are routinely bundled with additional unwanted components, and are one of the most common delivery vehicles for outright malware.
The analysis below is drawn strictly from a real sample examined through the AMAS automated malware-analysis system, together with well-established public knowledge of the keygen threat category. No campaign-specific first-seen dates, geographic spread, victim counts, or command-and-control infrastructure are claimed, because that data does not exist for this heuristic detection — only the verifiable file characteristics do.
Table of Contents
What Is PUP.Keygen.MA?
A keygen is a program that generates — or pretends to generate — valid product keys for paid applications and games. Even when a keygen "works," running one is risky for two reasons. First, using it to activate software you have not purchased is unauthorized and violates licensing terms. Second, and more importantly from a security standpoint, keygens are distributed almost exclusively through piracy channels where there is no accountability for what the file actually does. Threat actors know that people who download keygens will deliberately disable their antivirus and click through warnings, so keygens are an ideal disguise for trojans, information stealers, cryptocurrency miners, and loaders. PUP.Keygen.MA marks a file whose structure and behavior match this pattern.
How PUP.Keygen.MA Spreads
Files that trigger this detection typically reach a computer through warez and "crack" websites, peer-to-peer and torrent networks, links posted in comment sections and video descriptions promising free activation, and bundled "installer" archives that pack the keygen alongside adware or a second-stage payload. Because the user is actively seeking the file out, distribution relies on social engineering rather than exploits — the victim runs the program voluntarily, often after being told to turn off security software so the keygen "isn't blocked."
Technical Analysis and Behavior
The analyzed sample is a compact 32,768-byte (32 KB) 32-bit (x86) Windows executable. It is compressed with the UPX runtime packer and shows two or more executable sections and high entropy — classic signs of packing used to shrink the file and hide its real code from static inspection. The binary carries no version information and is not digitally signed, both of which are red flags for a tool claiming to be legitimate software. During automated sandbox execution the sample demonstrated two notable behavior categories: it employs anti-debugging and anti-analysis techniques to resist inspection, and it reads user files and personal data on the machine. It wrote to two files on disk during the run and did not establish registry-based persistence in this particular execution, though absence in one sandbox run does not guarantee a clean bill of health on a live system.
Indicators of Compromise (IOCs)
The values below reflect one analyzed sample; specific indicators rotate between builds, so treat them as representative rather than exhaustive.
- SHA-256:
48fc1c9a62d4beab28393f1e977268dabc54ffc1e2118a46b46852b29931918d - SHA-1:
4a0d0524588f6e601122cdd8ea2d41bf76792f27 - MD5:
9b77b1d4525a56f8ecd8f24f8277fcfd - File size: 32,768 bytes
- Packer: UPX — traits: high entropy, two or more executable sections, no version information, unsigned, x86
Detection Heuristics
PUP.Keygen.MA is a heuristic (behavior- and structure-based) verdict rather than a match to one named malware family. Engines arrive at it by combining several weak signals into a strong one: a small UPX-packed executable, high section entropy consistent with obfuscation, missing version metadata, the lack of a valid code-signing certificate, and runtime behavior such as anti-debugging and reading user data. Individually each trait is common; together, on a file presented as a "key generator," they justify a PUP/riskware classification. Because the detection is generic, two files flagged as PUP.Keygen.MA may not be identical — they share a risk profile, not necessarily a code base.
Digital Forensics
If you are triaging a machine, look for a recently created, unusually small (~32 KB) executable in Downloads, the Desktop, temporary folders, or an extracted archive from a piracy site. Because the sample modified two files during execution, review recently written files in the user profile and temp directories around the time the keygen ran. Although this sample did not add registry persistence in the sandbox, still inspect the common autorun locations (the Run and RunOnce keys and the Scheduled Tasks library) and the Windows Prefetch folder for evidence of execution. UPX packing and high entropy in an otherwise tiny binary are strong forensic tells.
Symptoms of Infection
Users may notice new browser toolbars or changed search settings (from bundled adware), unexpected pop-ups, sluggish performance or high CPU usage (possible bundled miner), security software being disabled, or additional unknown programs appearing after the keygen was run. In many cases there are no obvious symptoms at all, which is exactly why a full scan matters.
How to Remove PUP.Keygen.MA
1. Run a full malware scan. Download and install SpyHunter, update it, and run a complete system scan to detect and remove PUP.Keygen.MA and any secondary payloads it may have introduced.
2. Uninstall suspicious programs. Open Settings > Apps (or Control Panel > Programs and Features), sort by install date, and remove the keygen and anything unfamiliar installed alongside it.
3. Boot into Safe Mode with Networking if the file resists removal, then repeat the scan and uninstall steps.
4. Reset your web browsers to clear bundled adware:
- Chrome: Settings > Reset settings > Restore settings to their original defaults.
- Firefox: Help > More troubleshooting information > Refresh Firefox.
- Edge: Settings > Reset settings > Restore settings to their default values.
- Android: uninstall recently added unknown apps, and in Chrome for Android clear site data and reset any changed search engine.
5. Clear temporary files and empty the Recycle Bin, then change any passwords you entered while the machine may have been compromised, since the sample accessed user data.
Conclusion
PUP.Keygen.MA represents the broad, persistent risk posed by pirated-software key generators. Even when such a tool appears to do what it promises, its origin, its obfuscation, and its access to your personal files make it untrustworthy. The safest response is to avoid keygens entirely, obtain software through legitimate channels, and remove any flagged file with a reputable security tool followed by a browser reset and a password review.
Analysis Report
General information
| Family Name: | PUP.Keygen.MA |
|---|---|
| Packers: | UPX |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
9b77b1d4525a56f8ecd8f24f8277fcfd
SHA1:
4a0d0524588f6e601122cdd8ea2d41bf76792f27
SHA256:
48FC1C9A62D4BEAB28393F1E977268DABC54FFC1E2118A46B46852B29931918D
File Size:
32.77 KB, 32768 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- .UPX
- 2+ executable sections
- HighEntropy
- No Version Info
- packed
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 118 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 117 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
