PUP.Multikey

The detection of PUP.Multikey on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent further problems.

What Is PUP.Multikey?

PUP.Multikey is classified as a potentially unwanted program, which means it is not necessarily malicious but can still cause unwanted effects on your system. PUPs are often installed alongside other software without the user's full knowledge or consent. They can range from adware that displays unwanted advertisements to programs that modify your browser settings or collect your personal data without your permission.

How PUP.Multikey Operates

PUPs like PUP.Multikey typically operate by integrating themselves into your system through various means, such as bundled installations with freeware or shareware, deceptive downloads, or exploit kits. Once installed, they can alter system settings, modify browser configurations, or even install additional unwanted software. Their primary goal is often to generate revenue for their developers through advertisements, data collection, or by selling your personal information to third parties.

Symptoms of Infection

Symptoms of a PUP infection can vary but commonly include an increase in pop-up advertisements, changes to your default search engine or homepage, slowdowns in system performance, and the appearance of unwanted toolbars or extensions in your web browser. You might also notice that your browser is being redirected to unfamiliar websites or that you are receiving numerous spam emails. These symptoms can significantly disrupt your computing experience and pose risks to your personal data and system security.

How to Remove PUP.Multikey

1. Boot your computer in Safe Mode with Networking to limit the program's ability to interfere with the removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of PUP.Multikey.
3. Uninstall any suspicious programs that were recently installed or seem unnecessary. Be cautious and only remove programs you are sure are not needed for your system's operation.
4. Reset your web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge) to their default settings to remove any unwanted changes made by the PUP.
5. Reboot your computer and perform another scan with your anti-malware tool to ensure that all remnants of PUP.Multikey have been removed.

Conclusion

Removing PUP.Multikey from your system is crucial to restoring your computer's performance and protecting your personal data. By following the steps outlined above and maintaining vigilance when installing new software, you can significantly reduce the risk of future PUP infections. Regularly updating your operating system, browsers, and security software, as well as being cautious with email attachments and downloads, are also key practices in preventing such threats. Remember, a proactive approach to computer security is the best defense against potentially unwanted programs and more severe malware threats.

Analysis Report

General information

Family Name:	PUP.Multikey
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 0f545cf7092b341482a5d2e81084f38b SHA1: 660a0182e0b5364fde23f0f38d3579197c447725 SHA256: 15FFA33D545E68AA45E0A0E7E6491748786C0BE21D0C51E8F3EFA7B2D9C408BD File Size: 480.26 KB, 480256 bytes

MD5: a2c19058a54e6f90ed1ed41a6228dce6 SHA1: 29700c0ec01dd60cb8a482471da44855666f1385 SHA256: 28D666DC7711CC5A8E2556E4B512B664853C2A8ABA79A083518221BC5EDE8FC9 File Size: 5.69 MB, 5691110 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File is 32-bit executable
• File is 64-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Created for People
File Description	MultiKey Driver Installing for Windows 64bit
File Version	1.00 0,7,2,0
Internal Name	Delcam Installer x64 TJprojMain
Legal Copyright	(C) 2016, Created for People
Original Filename	TJprojMain.exe
Product Name	MultiKey Installer for Delcam Project1
Product Version	1.00 0.7.2.0

File Traits

• 2+ executable sections
• BINinO
• HighEntropy
• x64

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe	Generic Read,Write Attributes
\device\namedpipe	Generic Write,Read Attributes
c:\bf97.tmp\choose.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\cursorsize.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\dcam.paf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\delcam.reg	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\devcon.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\infclean.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\install64.bat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\mkicon.ico	Generic Read,Write Data,Write Attributes,Write extended,Append data

Show More

c:\bf97.tmp\multikey.cat	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\multikey.inf	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\bf97.tmp\multikey.sys	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	頔ٟ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	௥ڔ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	婤ڢ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	ઐڳ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	夅ہ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	꜕ۏ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	᱀ۥ唶ǜ	RegNtPreCreateKey
HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe	쵘۵唶ǜ	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAddAtomEx ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateNamedPipeFile ntdll.dll!NtCreateSection ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject Show More ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtFsControlFile ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcess ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSymbolicLinkObject ntdll.dll!NtOpenThread ntdll.dll!NtOpenThreadToken ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySymbolicLinkObject ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTerminateProcess ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile UNKNOWN
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Other Suspicious	SetWindowsHookEx

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"\BF97.tmp\install64.bat"

C:\WINDOWS\system32\mode.com mode con:cols=72 lines=24

c:\BF97.tmp\cursorsize.exe cursorsize 0

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "5.1"

Show More

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "5.2"

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "6.0"

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "6.1"

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "6.2"

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "6.3"

C:\WINDOWS\system32\cmd.exe C:\WINDOWS\system32\cmd.exe /S /D /c" ver "

C:\WINDOWS\system32\find.exe find /i "10.0"

c:\BF97.tmp\choose.exe choose -c 1234 -q -n