PUP.Open Downloader Manager

The detection of PUP.Open Downloader Manager on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take prompt action to remove it and prevent further damage.

What Is PUP.Open Downloader Manager?

PUP.Open Downloader Manager is a type of potentially unwanted program that can be installed on a computer without the user's knowledge or consent. It is often bundled with other software or downloaded from the internet, and its primary purpose is to manage downloads, but it can also exhibit malicious behavior, such as displaying unwanted ads, collecting user data, or downloading additional malware.

How PUP.Open Downloader Manager Operates

PUPs like Open Downloader Manager typically operate by installing themselves on a computer and then executing their payload, which can include a range of activities, such as displaying ads, redirecting browser traffic, or stealing user data. They may also attempt to download and install additional malware or PUPs, which can further compromise the security of the infected system. In some cases, PUPs may also modify system settings or configure themselves to start automatically when the computer boots up.

Symptoms of Infection

Systems infected with PUP.Open Downloader Manager may exhibit a range of symptoms, including slow system performance, unwanted ads or pop-ups, browser redirects, and unexpected changes to system settings. Users may also notice that their browser homepage or search engine has been changed, or that they are being redirected to unfamiliar websites. In some cases, the presence of a PUP may also lead to additional malware infections or other security issues.

• Unwanted ads or pop-ups
• Browser redirects or changes to system settings
• Slow system performance
• Unexpected changes to browser homepage or search engine

How to Remove PUP.Open Downloader Manager

1. Boot your computer in Safe Mode with Networking to prevent the PUP from loading and to allow for easier removal.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove any malware or PUPs.
3. Uninstall any suspicious programs or applications that may be related to the PUP.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by the PUP.
5. Reboot your computer and perform a follow-up scan to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Open Downloader Manager from your system is crucial to preventing further damage and protecting your personal data. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove this PUP and restore your system to a safe and secure state. It is also essential to practice safe computing habits, such as avoiding suspicious downloads and being cautious when installing software, to prevent similar infections in the future.

Analysis Report

General information

Family Name:	PUP.Open Downloader Manager
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 375dc889b1ea948121498ebfd3107837 SHA1: f5bee47df02fe59769d7218d5935e8604e69d906 SHA256: 3BFBC771520637850A1F2495FFE75DE253E2E1F3BB21B19863C16ADF65A64041 File Size: 405.28 KB, 405280 bytes

MD5: 634e03e8cb8d1a25498c36b7d6da0ed4 SHA1: aab05ffabe2a826409aeef764079408e6e622523 SHA256: ED330CAE685849EA7312A2EB8EFD2D9158D9285D8365DCA347ED305198865C2B File Size: 686.65 KB, 686648 bytes

MD5: 82b17363dc174023ba306de57364eb5d SHA1: 1be4a7f4402ccdf3044f28242a5f09bb9fcfba3a SHA256: A313B12A05C564337DEADC433FEA83F23FDEFE2C3C95CFD3CB45C4C548A477E7 File Size: 619.68 KB, 619680 bytes

MD5: d38cee61cb787609c1588493fc581ba5 SHA1: 933c2eed4f3e1a817786f96387f4131bf0484163 SHA256: A8AB4D21D5FE6E837ED97AE2E5A6514C78F5D3E1364308CB7B1310D0ADCDBCED File Size: 333.70 KB, 333704 bytes

MD5: 831705ec4c8ad8fbe3ad045f42bd3e0d SHA1: ee92e745545298b88041b305307ef1d8b50d7792 SHA256: FF186D46DABFAF5619D0A1B77B321F4A8A57D8DEF4DF5B167916018F572BBB42 File Size: 1.21 MB, 1208832 bytes

Show More

MD5: f71e6ed06ed275b84d633ad2f944f556 SHA1: 85e6886db8be841afc7f6933e861eeeb4da6875a SHA256: 6E8CB09C1EFE14314E9D7C5578724522728564BDB8788C505A26B7E67F88E74F File Size: 1.60 MB, 1599032 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is 64-bit executable
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	ASM Software LLC diakov.net VolatileSpeedup Stream
File Description	driverhelper64 Open Downloader Manager Open Downloader Manager Punto Switcher 4.1.0 Build 432 WAudit Module
File Version	4.1.0.432 3.1.0.0 3.0.0.0 1.0.0.1 1, 0, 0, 231
Internal Name	ddrx.dll DownloadAll_v2.exe WAudit
Legal Copyright	(c)2015 (c) VolatileSpeedup Stream 2020 All rights reserved. Copyright 2015 Copyright © 2011
Original Filename	ddrx.dll DownloadAll_v2.exe WAudit.exe
Product Name	BlackBox Security Monitor Professional driverhelper64 O D M ODM
Product Version	1.0.0.1 1, 0, 0, 231

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
INSTALLER TECHNOLOGY CORP	COMODO RSA Code Signing CA	Self Signed
InstallerTech Co	COMODO RSA Code Signing CA	Self Signed
Antanda, LLC	Go Daddy Secure Certification Authority	Self Signed
Traffic Space, LLC	Symantec Class 3 SHA256 Code Signing CA	Self Signed
diakov.net	diakov.net	Self Signed

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Kryptik.FTP

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\3.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\banner.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\dialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\quid.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsbbd5b.tmp\toplogo1.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsd733f.tmp	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nsebfc0.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsec05e.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi6702.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsi72bf.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsi735f.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nskc11c.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7846.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsm7847.tmp\aero.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\brandingurl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\langdll.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\modern-header.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\modern-wizard.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\modern-wizard.bmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\nsdialogs.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsm7847.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsn72df.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsn737f.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsobf61.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsobfff.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss7211.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nss72ff.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nst67cf.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nstbf31.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsuc15b.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx6712.tmp\banner.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx6712.tmp\inetc.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx6712.tmp\ipbhelper.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx6712.tmp\quid.txt	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx6712.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsx7231.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsybdc9.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nszc0dc.tmp	Generic Write,Read Attributes
c:\users\user\downloads\1.txt	Generic Write,Read Attributes
c:\windows\syswow64\drivers\khcap.sys	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateMutant ntdll.dll!NtCreateSection ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection Show More ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenSemaphore ntdll.dll!NtOpenThread ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtQueryWnfStateData ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseSemaphore ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtSubscribeWnfStateChange ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWriteFile UNKNOWN
Network Wininet	HttpOpenRequest HttpQueryInfo HttpSendRequest InternetConnect InternetOpen InternetQueryOption InternetReadFile
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Network Winsock2	WSAStartup
Service Control	StartServiceCtrlDispatcher
Process Manipulation Evasion	ReadProcessMemory