PUP.UniDL
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 18,120 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 918 |
| First Seen: | July 24, 2023 |
| Last Seen: | October 13, 2026 |
| OS(es) Affected: | Windows |
The detection of PUP.UniDL on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.
Table of Contents
What Is PUP.UniDL?
PUP.UniDL is a type of malware that is classified as a potentially unwanted program. This category of threats includes software that, while not necessarily malicious in the classical sense, can still cause significant problems for users. PUPs often exhibit behaviors such as displaying unwanted advertisements, collecting user data without consent, or altering system settings for the benefit of the software's creators rather than the user. The presence of PUP.UniDL suggests that your system has been compromised by such a program.
How PUP.UniDL Operates
PUPs like PUP.UniDL typically operate by exploiting vulnerabilities in software or by being installed alongside other programs without the user's full knowledge or consent. Once installed, they can start modifying system settings, displaying unwanted content, or even downloading additional malware. Their operation is often stealthy, aiming to remain undetected by the user for as long as possible to maximize their effectiveness.
Symptoms of Infection
Symptoms of a PUP.UniDL infection can vary but commonly include an increase in unwanted advertisements (pop-ups, banners, etc.), changes in browser settings (such as a new homepage or default search engine), slowdowns in system performance, and the presence of unknown or suspicious programs in the list of installed applications. Users may also notice that their browsing data is being collected or that their system is more prone to crashes.
How to Remove PUP.UniDL
- Boot your computer in Safe Mode with Networking to prevent PUP.UniDL from loading and interfering with the removal process.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the PUP.
- Manually uninstall any suspicious programs that were installed around the time the PUP was detected. Be cautious and only remove programs you are certain are not necessary for your system's operation.
- Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any changes made by the PUP, such as altered homepages or search engines.
- Reboot your computer and perform another full scan with your anti-malware tool to ensure that all components of PUP.UniDL have been removed.
Conclusion
Removing PUP.UniDL requires careful and thorough action to ensure that all components of the potentially unwanted program are eliminated from your system. By following the steps outlined above and maintaining vigilance in the future, you can protect your computer from similar threats and keep your personal data and system performance safe. Regularly updating your operating system, browsers, and security software, as well as being cautious when installing new programs, are key practices in preventing PUP infections.
Analysis Report
General information
| Family Name: | PUP.UniDL |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
585cd3eef3480c262fdbd2e632ade8db
SHA1:
8f9a20253c4c6a48668b3a6a909f258b372a0c36
File Size:
2.10 MB, 2103684 bytes
|
|
MD5:
c0d8659c1a9402c50e602c9e42e9d168
SHA1:
68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a
SHA256:
9F1B2224948E26DD6AAE0603327EA788253EC02C207B4ED521280885D855C655
File Size:
2.21 MB, 2205599 bytes
|
|
MD5:
be58b71d2f29fbd282a5a7b4cc4373c3
SHA1:
1b4c22cb7cdba8b531fd62c76c0b2893e2146630
SHA256:
8248DB5E80A0B2EDDBAEDABF781196282DC90AC459ED3981C79F438BDCFFC055
File Size:
2.14 MB, 2137547 bytes
|
|
MD5:
5af890ee0a599edd9ca3f633edc699d3
SHA1:
2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12
SHA256:
0264AE3CC90EC8FAA56A5153B7801F9E5F86E2EABDCC5568F64FB68633043888
File Size:
1.96 MB, 1957006 bytes
|
|
MD5:
0b460fc44273a535ec823f1f613e5c6c
SHA1:
1caba232f66d1ea0f39867952fdd713c239ec89c
SHA256:
D9EAA4EB78CE4567DBBCC31AD9C950377DA0112CC2FA40E8BC15FBA85A714763
File Size:
1.90 MB, 1896568 bytes
|
Show More
|
MD5:
c607a4e212f02ef70ca4b287a9d9da43
SHA1:
98d886bb5752ee52f42015ff20cbecf1b3bff98b
SHA256:
A4D137E7191F761640B7E2CF1DE23B557719F7B29E20B8F73D575B9CF45CD4A5
File Size:
6.06 MB, 6064812 bytes
|
|
MD5:
b10601dbdf62923031a9adac864bca5d
SHA1:
56cabd671ef85ee642df7368714da18551eb6e10
SHA256:
CD339F8FAA868A027846A2A57CAA79B282B69556FACEF64A2715831FAEF4928A
File Size:
2.41 MB, 2414423 bytes
|
|
MD5:
061c29e194653c8e0dcf5ac7fcf50f7a
SHA1:
96777095054b6b067c74e46320bfdd9db8cc1896
SHA256:
6410199F7C4DC4022501508E77AD9ED3AEC6E2423F03122ABCA6426489344ABC
File Size:
2.01 MB, 2010538 bytes
|
|
MD5:
f0471b3ec752fbbe2f442df775bc17ca
SHA1:
8a3f56fe159c9513b63d2358510a6612519123dd
SHA256:
7EA5DCFA15991822F08AD23FA68AF47B60EA86C78986340FB99EDEED4B3E283C
File Size:
1.86 MB, 1855020 bytes
|
|
MD5:
d7fde511fc4ff4359106020426d90653
SHA1:
64bd6b1bf237a6f18fe410fee0fec24ce0c2db34
SHA256:
672A0C7EDD66D11208FD23FD48FFEA87CF888966B4EFE7C1FC0467BD92663F6A
File Size:
2.33 MB, 2329853 bytes
|
|
MD5:
2dd2532a10e1fc25a8dba895dae3090a
SHA1:
cbf8019987e50754cd9c88a63211459b42e2b459
SHA256:
5DD006C9DF361EBDDABE0F72B1BA01CC5AAB062BA7E63277FDE4A6F965E85E1E
File Size:
2.24 MB, 2235945 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Comments | This installation was built with Inno Setup. |
| Company Name |
|
| File Description |
Show More
|
| File Version | 1.0.0.0 |
| Legal Copyright | Copyright |
| Product Name |
Show More
|
| Product Version |
|
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Farfli.BZ
- Gamehack.QAB
- Kryptik.BBL
- Remcos.AM
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\appdata\local\temp\is-40v5e.tmp\8a3f56fe159c9513b63d2358510a6612519123dd_0001855020.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-69c6v.tmp\1b4c22cb7cdba8b531fd62c76c0b2893e2146630_0002137547.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-906s3.tmp\96777095054b6b067c74e46320bfdd9db8cc1896_0002010538.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-cgnsn.tmp\cbf8019987e50754cd9c88a63211459b42e2b459_0002235945.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-j1cu1.tmp\8f9a20253c4c6a48668b3a6a909f258b372a0c36_0002103684.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-nq069.tmp\2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12_0001957006.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-qcpo1.tmp\98d886bb5752ee52f42015ff20cbecf1b3bff98b_0006064812.tmp | Generic Write,Read Attributes |
Show More
| c:\users\user\appdata\local\temp\is-rg6a8.tmp\1caba232f66d1ea0f39867952fdd713c239ec89c_0001896568.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-ubull.tmp\64bd6b1bf237a6f18fe410fee0fec24ce0c2db34_0002329853.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-useam.tmp\56cabd671ef85ee642df7368714da18551eb6e10_0002414423.tmp | Generic Write,Read Attributes |
| c:\users\user\appdata\local\temp\is-vvqd5.tmp\68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a_0002205599.tmp | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | m n 8� �� �6 �v �� T���� ��dc�%�� 3bBx �I$kF%`� %�&� '@j(�(X�(�)A*J*9*�"1�1HO 1��5,]@V� A��G�IH[uH�� N$N� X�._�za$b"hc�w h�rj�bk`k�ql(�lR q@� q�XsU�tǤvy�w�ny�9 {b�~D�P� | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | m o 8� �� �6 �v �� T���� ��dc�%�� 3bBx �I$kF%`� %�&� '@j(�(X�(�)A*J*9*�"1�1HO 1��5,]@V� A��G�IH[uH�� N$N� X�._�za$b"hc�w e�vh�rj�bk`k�ql(�lR q@� q�XsU�tǤvy�w�ny�9 {b�~D | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Process Shell Execute |
|
| User Data Access |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"C:\Users\Kmptfqsk\AppData\Local\Temp\is-J1CU1.tmp\8f9a20253c4c6a48668b3a6a909f258b372a0c36_0002103684.tmp" /SL5="$20238,1047040,0,c:\users\user\downloads\8f9a20253c4c6a48668b3a6a909f258b372a0c36_0002103684.exe"
|
"C:\Users\Cpsnawua\AppData\Local\Temp\is-VVQD5.tmp\68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a_0002205599.tmp" /SL5="$40224,876032,0,c:\users\user\downloads\68a3f4ecfbfd4eb3500b3c6e05027e1fde76226a_0002205599"
|
"C:\Users\Kulragln\AppData\Local\Temp\is-69C6V.tmp\1b4c22cb7cdba8b531fd62c76c0b2893e2146630_0002137547.tmp" /SL5="$70044,1046016,0,c:\users\user\downloads\1b4c22cb7cdba8b531fd62c76c0b2893e2146630_0002137547"
|
"C:\Users\Chegvwzr\AppData\Local\Temp\is-NQ069.tmp\2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12_0001957006.tmp" /SL5="$90366,904704,0,c:\users\user\downloads\2c3e738c2666d3828bd6b8160eca1f9f3e4e1e12_0001957006"
|
"C:\Users\Nzybypjb\AppData\Local\Temp\is-QCPO1.tmp\98d886bb5752ee52f42015ff20cbecf1b3bff98b_0006064812.tmp" /SL5="$11052A,5302744,721408,c:\users\user\downloads\98d886bb5752ee52f42015ff20cbecf1b3bff98b_0006064812"
|
Show More
"C:\Users\Bdzbdnse\AppData\Local\Temp\is-USEAM.tmp\56cabd671ef85ee642df7368714da18551eb6e10_0002414423.tmp" /SL5="$60276,1046016,0,c:\users\user\downloads\56cabd671ef85ee642df7368714da18551eb6e10_0002414423"
|
"C:\Users\Dtrjjnfl\AppData\Local\Temp\is-906S3.tmp\96777095054b6b067c74e46320bfdd9db8cc1896_0002010538.tmp" /SL5="$5033E,945664,0,c:\users\user\downloads\96777095054b6b067c74e46320bfdd9db8cc1896_0002010538"
|
"C:\Users\Ukfazixt\AppData\Local\Temp\is-40V5E.tmp\8a3f56fe159c9513b63d2358510a6612519123dd_0001855020.tmp" /SL5="$5027C,864768,0,c:\users\user\downloads\8a3f56fe159c9513b63d2358510a6612519123dd_0001855020"
|
"C:\Users\Vqijhpci\AppData\Local\Temp\is-UBULL.tmp\64bd6b1bf237a6f18fe410fee0fec24ce0c2db34_0002329853.tmp" /SL5="$30366,1339392,0,c:\users\user\downloads\64bd6b1bf237a6f18fe410fee0fec24ce0c2db34_0002329853"
|
"C:\Users\Gmgwcunz\AppData\Local\Temp\is-CGNSN.tmp\cbf8019987e50754cd9c88a63211459b42e2b459_0002235945.tmp" /SL5="$1F0388,956928,0,c:\users\user\downloads\cbf8019987e50754cd9c88a63211459b42e2b459_0002235945"
|
