PUP.QQPC.AA

The detection of PUP.QQPC.AA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.

What Is PUP.QQPC.AA?

PUP.QQPC.AA is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that may not be malicious in nature but can still cause problems for users, such as displaying unwanted advertisements, collecting personal data, or modifying system settings without consent. PUPs can be installed on a system through various means, including bundled software downloads, infected websites, or exploited vulnerabilities.

How PUP.QQPC.AA Operates

Once installed, PUP.QQPC.AA may operate in the background, potentially collecting user data, displaying unwanted ads, or modifying system settings to facilitate its activities. It may also attempt to connect to remote servers to download additional components or receive updates, which can further compromise system security. The exact behavior of PUP.QQPC.AA can vary, but its primary goal is often to generate revenue for its creators through affiliate marketing, advertising, or data sales.

Symptoms of Infection

Systems infected with PUP.QQPC.AA may exhibit a range of symptoms, including slowed system performance, increased pop-up ads, unwanted browser extensions or toolbars, and changes to default search engines or home pages. Users may also notice unfamiliar programs or icons on their desktop or taskbar, or experience frequent system crashes or freezes. If you've noticed any of these symptoms, it's crucial to take action to remove the PUP and restore your system to a healthy state.

How to Remove PUP.QQPC.AA

1. Boot your system in Safe Mode with Networking to prevent PUP.QQPC.AA from loading and to allow for a more effective removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect all components related to PUP.QQPC.AA.
3. Uninstall any suspicious programs or applications that may be associated with the PUP, using the Add/Remove Programs feature in the Control Panel.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions, toolbars, or search engines.
5. Reboot your system and perform a follow-up scan with your anti-malware tool to ensure that all components of PUP.QQPC.AA have been removed.

Conclusion

Removing PUP.QQPC.AA from your system is essential to prevent further damage and protect your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a healthy state. It's also crucial to practice safe computing habits, such as avoiding suspicious downloads, using reputable antivirus software, and keeping your operating system and software up to date, to prevent similar infections in the future. Remember to always be cautious when installing new software and to carefully review the terms and conditions before agreeing to any installations.

Analysis Report

General information

Family Name:	PUP.QQPC.AA
Signature status:	Self Signed

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 1553ffa3614c5a7e3356e4bbb2f924eb SHA1: a3fc420c5314d6fa94f258dd9944a6218421bb2d SHA256: D37DC3191072EC04BB4ABE2D4459F280E0F51B0B3B53937F7C67037D73DC6A9B File Size: 4.67 MB, 4674880 bytes

MD5: ae9dce858b3b0c44f66e5db90378d184 SHA1: 5058255c2c1219c0c81329e399a84a68ab834261 SHA256: 142488197E0D70564B4D7AA8E3DF516878DA94F82E972F82F2DE24AC7DA567F4 File Size: 1.01 MB, 1008520 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have exports table
• File doesn't have relocations information
• File has exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)

Show More

• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
Tencent Technology(Shenzhen) Company Limited	Symantec Class 3 SHA256 Code Signing CA	Self Signed
Tencent Technology(Shenzhen) Company Limited	VeriSign Class 3 Code Signing 2010 CA	Self Signed

File Traits

• dll
• HighEntropy
• VirtualQueryEx
• WriteProcessMemory
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\programdata\tencent\qqpcmgr\txdlcom.exe	Generic Read,Generic Execute,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 786496
c:\users\user\appdata\local\temp\tencentdownload\~65f12b\qmdr\dr.dll	Generic Read,Generic Execute,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 786496
c:\users\user\appdata\local\temp\tencentdownload\~65f12b\qqpcdownload.dll	Generic Read,Generic Execute,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 786496
c:\users\user\appdata\local\temp\tencentdownload\~65f12b\setup.xml	Generic Read,Generic Execute,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 786496
c:\users\user\appdata\local\temp\~dfadac6b4a9a688181.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\~dfb2efb66110a4d4cb.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\roaming\tencent\qqpcmgr\txdlproxy.exe	Generic Read,Generic Execute,Write Data,Write Attributes,Write extended,Append data,Delete,LEFT 786496

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWriteFile
Process Shell Execute	CreateProcess
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
Network Winsock2	WSAStartup
Network Winsock	closesocket
User Data Access	GetUserObjectInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a3fc420c5314d6fa94f258dd9944a6218421bb2d_0004674880.,LiQMAxHB