PUP.Qiyi

The detection of PUP.Qiyi on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand what PUPs are and how they operate to effectively remove them and prevent future infections.

What Is PUP.Qiyi?

PUP.Qiyi is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems, such as displaying unwanted ads, collecting user data, or slowing down system performance. They often come bundled with other software or are downloaded from untrusted sources.

How PUP.Qiyi Operates

PUPs like PUP.Qiyi typically operate by installing themselves on a system and then executing their payload, which can include displaying ads, collecting user data, or modifying system settings. They may also use various tactics to evade detection, such as disguising themselves as legitimate programs or using code obfuscation techniques. In some cases, PUPs may also install additional software or modify system files to maintain their presence on the system.

Symptoms of Infection

Systems infected with PUP.Qiyi may exhibit a range of symptoms, including unwanted ads or pop-ups, slow system performance, and unexpected changes to system settings. Users may also notice that their browser homepage or search engine has been modified, or that they are being redirected to unwanted websites. In some cases, PUPs may also collect user data, such as browsing history or personal information, without the user's knowledge or consent.

• Unwanted ads or pop-ups
• Slow system performance
• Unexpected changes to system settings
• Modified browser homepage or search engine
• Redirection to unwanted websites

How to Remove PUP.Qiyi

1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for easier removal.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove any malware or PUPs.
3. Uninstall any suspicious programs or applications that may be related to the PUP.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any modified settings or extensions.
5. Reboot your system and perform another full scan to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Qiyi from your system requires a combination of technical knowledge and the right tools. By following the steps outlined above and using a reputable anti-malware tool, you can effectively remove the PUP and prevent future infections. It's also essential to practice safe computing habits, such as avoiding untrusted software downloads and being cautious when clicking on links or ads, to reduce the risk of PUP infections. By taking these steps, you can help protect your system and your personal data from the risks associated with PUPs like PUP.Qiyi.

Analysis Report

General information

Family Name:	PUP.Qiyi
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 7822220a3646a917561312c52c15edcf SHA1: 508ae336fa3b97b89bc20112bd88d0e9d1943649 SHA256: F0DF219975FBCA9D94377D3D4E65622640AB92EC4751E31C7B74999B1842B5F5 File Size: 2.69 MB, 2687880 bytes

MD5: ee5280bb0ebada69bbb8d8fba921d0bb SHA1: 0b587bc057d55ebe827e5906f4146a54e5a97178 SHA256: 3CC6B0845E018D9C7A55FAF131A4812D4F82994F0A23BFA393466D7B8693020A File Size: 4.66 MB, 4660776 bytes

MD5: b515e2ead63e82b8a2b15707a5b15deb SHA1: 6645a307b256ce1298c7c03db6441f59dc9ad005 SHA256: 0DF0817633C7D4E97B79C91CF18D4B0C9464C5DF7B76B883907E92F3F589BF3B File Size: 4.66 MB, 4660240 bytes

MD5: 90702feba256c01282d086de4fa0009e SHA1: ddc7898b875e5460f540948b899cf57aaf4cbb04 SHA256: 6B24A71117B792E3A6EB513D1D4789F5E19ECAD805BC72C6F93C70C29C943458 File Size: 103.50 KB, 103496 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed

Show More

• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	2020.07.17.16.10.07 2021.01.04.15.30.06 2021.09.01.16.49.10
Company Name	爱奇艺
File Description	崩溃投递模块 爱奇艺 卸载程序 爱奇艺 安装程序
File Version	7.7.116.2047 3.3.4.38 3.3.4.27 1.0.0.3
Internal Name	GpCrashPost.exe
Legal Copyright	Copyright (C) 2018 爱奇艺 All Rights Reserved Copyright (C) 2020 爱奇艺 All Rights Reserved Copyright (C) 2021 爱奇艺 All Rights Reserved
Original Filename	GpCrashP.exe IQIYIsetup_z27s.exe QyUninst.exe
Product Name	爱奇艺 爱奇艺万能播放器
Product Version	7.7.116.2047 3.3.4.38 3.3.4.27 1.0.0.3

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.	DigiCert Assured ID Code Signing CA-1	Self Signed
BEIJING QIYI CENTURY SCIENCE&TECHNOLOGY CO.,LTD.	DigiCert SHA2 Assured ID Code Signing CA	Self Signed
BeiJing IQIYI Science & Techonology Co.,Ltd	DigiCert SHA2 Assured ID Code Signing CA	Self Signed

File Traits

• HighEntropy
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	247
Potentially Malicious Blocks:	6
Whitelisted Blocks:	216
Unknown Blocks:	25

Visual Map

0 0 0 ? 0 0 0 0 0 0 0 0 0 0 1 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 x 0 x 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 ? ? ? ? 0 ? x 0 ? ? 0 x ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 2 3 1 0 0 0 0 0 0 0 0 1 1

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\programdata\iqiyi video\lstyle	Synchronize,Write Attributes
c:\programdata\iqiyi video\lstyle\unsetupinfo.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\programdata\iqiyi video\lstyle\unsetupinfo.ini	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\01.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\01_100.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\02.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\02_100.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\03.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\03_100.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\04.png	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\nsa52f5.tmp\04_100.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\05.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\05_100.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\banner_normal.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\banner_select.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\btn.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\btn2.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\button.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\change.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_125.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_150.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_175.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_200.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_225.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_250.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\closebtn_300.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_125.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_150.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_175.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_200.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_225.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_250.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonclose_300.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_125.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_150.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_175.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_200.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_225.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_250.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\custombuttonopen_300.png	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\dialogex.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\nsprocess.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\stdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsa52f5.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsda91d.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsdb66b.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsia93d.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsia93d.tmp\stdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsia93d.tmp\stdutils.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsia93d.tmp\stdutils.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsia93d.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsia93d.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsia93d.tmp\system.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsib69b.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsib69b.tmp\stdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsib69b.tmp\stdutils.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsib69b.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsib69b.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsna872.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsna872.tmp\stdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsna872.tmp\stdutils.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsna872.tmp\stdutils.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsna872.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nsna872.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsna872.tmp\system.dll_deleted_	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsrb36d.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nsv52d5.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\local\temp\nswb38d.tmp	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nswb38d.tmp\stdutils.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nswb38d.tmp\stdutils.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nswb38d.tmp\system.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\nswb38d.tmp\system.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\nsxa861.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete
c:\users\user\appdata\roaming\iqiyi video\lstyle	Synchronize,Write Attributes
c:\users\user\appdata\roaming\iqiyi video\lstyle\qyuninst.exe	Generic Read,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 262144
c:\users\user\appdata\roaming\iqiyi video\lstyle\qyuninst.ini	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\iqiyi video\lstyle\qyuninst.ini	Synchronize,Write Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKLM\system\controlset001\control\session manager::pendingfilerenameoperations	*1\??\C:\Windows\SystemTemp\MicrosoftEdgeUpdate.exe.old122e4*1\??\C:\Windows\SystemTemp\CopilotUpdate.exe.old12352*1\??\C:\P	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	.k 8��8 tXz��B �8 �� �6 �v z5��Z xy ��T�B�������������5����ee  +�� Bx�< 5 � �!wz"Wc#�#�� $kF $��%"�%:�%� &� &�x(�(X�)�`*J*9 *�" *�^ *�h+�[,��/9�/��0P% 1`	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	/k 8��8 tXz��B �8 �� �6 �v z5��Z xy ��T�B�������������5����ee  +�� Bx�< 5 � �!wz"Wc#�#�� $kF $��%"�%:�%� &� &�x(�(X�)�`*J*9 *�" *�^ *�h+�[,��/9�/��0P% 1`	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475	��  B xy * � /�� Y� d� kP~ �� � ��ރ �p��^ �o ���z ee *Vs} kP~ ��1��� 7 � �� ﺃee����1�� fe�� h	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	-k �8��8 tX��B �8 �� �6 �v5��Z xy ��T�B�������������5����ee �� Bx�< �!wz"Wc#�#�� $kF $��%"�%:�%� &� &�x(�(X�)�`*J*9 *�" *�^ *�h+�[,��/9�/��0P% 1`1�1HO1�D5�05�G	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	.k �8��8 tX��B �8 �� �6 �v5��Z xy ��T�B�������������5����ee �� Bx�< �!wz"Wc#�#�� $kF $��%"�%:�%� &� &�x(�(X�)�`*J*9 *�" *�^ *�h+�[,��/9�/��0P% 1`1�1HO1�D5�05�G	RegNtPreCreateKey

Show More

HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc3475

~�   % xy * � /�� Y� d� kP~ � ��ރ �p��^ �o ���z ee ,Vs} kP~ ��1��� 7 � �� ﺃee����1�� fe�� h �n

RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection ZwMapViewOfSection
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Ukakudrh\AppData\Roaming\IQIYI Video\LStyle\QyUninst.exe"

"C:\Users\Rruprcby\AppData\Roaming\IQIYI Video\LStyle\QyUninst.exe"