PUP.Widdit

The detection of PUP.Widdit on your system indicates the presence of a potentially unwanted program (PUP) that may be compromising your computer's security and performance. PUPs are software applications that, while not necessarily malicious, can still cause significant disruptions and pose risks to your personal data and system integrity. Understanding what PUP.Widdit is, how it operates, and the symptoms it causes is crucial for effective removal and prevention of future infections.

What Is PUP.Widdit?

PUP.Widdit refers to a type of potentially unwanted program that is detected by security software due to its suspicious behavior or characteristics that are deemed unwanted or unnecessary by the user. PUPs can include a wide range of applications, from adware and browser toolbars to software bundlers and other utility programs that may not provide the expected benefits but instead consume system resources, display unwanted advertisements, or collect user data without consent.

How PUP.Widdit Operates

PUP.Widdit, like other PUPs, typically operates by integrating itself into your system through various means, such as software bundling, where it is included in the installation package of another program, or through exploits in web browsers or other vulnerabilities. Once installed, it may alter system settings, modify browser configurations, or run background processes that can lead to decreased system performance, increased risk of malware infections, and potential data breaches. The operation of PUP.Widdit is designed to be as stealthy as possible, making it challenging for average users to detect and remove without proper tools and knowledge.

Symptoms of Infection

Symptoms of a PUP.Widdit infection can vary but often include an increase in unwanted pop-ups, redirects to suspicious websites, changes in browser homepage or search engine, sluggish system performance, and the presence of unfamiliar programs or toolbars in your browser or system. In some cases, users may also notice an increase in data usage or unexpected charges on their phone bills if the PUP is designed to exploit premium services. Recognizing these symptoms early on is key to preventing further damage and ensuring the removal of the PUP before it can cause more harm.

How to Remove PUP.Widdit

1. Boot your computer in Safe Mode with Networking to prevent PUP.Widdit from loading and to gain better control over the removal process.
2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components related to PUP.Widdit.
3. Uninstall any suspicious programs or applications that were installed around the time the PUP was detected, as these may be related to or compromised by PUP.Widdit.
4. Reset your web browsers (Chrome, Firefox, Edge, etc.) to their default settings to remove any changes made by the PUP, such as altered homepages, search engines, or the installation of unwanted extensions.
5. Reboot your computer and perform another full scan with your anti-malware tool to ensure that all remnants of PUP.Widdit have been removed and that your system is clean.

Conclusion

The removal of PUP.Widdit requires a combination of technical knowledge, the right tools, and cautious behavior to prevent re-infection. By understanding the nature of PUPs and taking proactive steps to secure your system, including keeping your operating system and software up to date, using strong antivirus programs, and being vigilant when installing new applications, you can significantly reduce the risk of PUP infections. Remember, prevention and early detection are key to maintaining the security and performance of your computer. Always prioritize caution when downloading software from the internet and consider seeking professional help if you are unsure about any aspect of the removal process.

Analysis Report

General information

Family Name:	PUP.Widdit
Signature status:	Modified signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 30a56e3f0085d1d092e1fd7030fc16cb SHA1: 1319265614c8291a78a998c5a8c717ed65715634 File Size: 921.90 KB, 921904 bytes

MD5: dd5eed9659f215120e5da8b73a181aad SHA1: 682d4e242152fbe0cc227b1af6fad5548e34ec80 File Size: 921.55 KB, 921552 bytes

MD5: 213d24f4cc1ae1590c43e2d00b02e770 SHA1: f9a10403ac4c728eff0cf597f3e6d215e999a5b0 SHA256: A1F0AA9B39B3393A1E38B4CD627D9D0150B5CC29BD88A8C9AEA308D08A185A71 File Size: 920.07 KB, 920072 bytes

MD5: 9073d11edad326d024f684e3784117c0 SHA1: 6d3d9988d4a01a334f1934d3ce272508ba8f9f0f SHA256: 6FBE12F243F0FDE667F8800DB245185C370ECCC95949A87ED75F3CDBBE8980EB File Size: 116.74 KB, 116736 bytes

MD5: a3a9787bff029f77f6e335d8abb71a58 SHA1: 97525f8f85dee3b75159cd3230e96be612936815 SHA256: 065B6A3D82FA1B6113C870E957E22258445F8428D89B27118005FFC65CD478CA File Size: 921.90 KB, 921904 bytes

Show More

MD5: bc63ce34c6138a77f2242baf09f218e5 SHA1: 18264cc7c7326367675011fd773c2c3bd2477ac6 SHA256: 2A952FF5F264B0A411C9532090EA98B12027B7030928B9D651FF491B98219361 File Size: 922.06 KB, 922064 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
• File is either console or GUI application

Show More

• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	OneFloorApp Ltd.
File Description	1 Media Player 2.2.0-git Installer Setup
File Version	13.1 12.5 12.0 2.2.0-git
Legal Copyright	Copyright (c) 2012, www.simplytech.com Copyright © OneFloorApp Ltd.
Legal Trademarks	OneFloorApp, OFA, 1FA
Product Name	1 Media Player Installer
Product Version	13.1 12.5 12.0 2,2,0,0

File Traits

• dll
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-1c0f6.tmp\1319265614c8291a78a998c5a8c717ed65715634_0000921904.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-3fjg1.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-3fjg1.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-3fjg1.tmp\appimageorign.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-3fjg1.tmp\cinshlpr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-3fjg1.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-3fjg1.tmp\innosetuphelper.dll	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-3fjg1.tmp\innosetuphelpernet4.dll	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\is-3fjg1.tmp\isxdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-3fjg1.tmp\webbrowser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-40ss7.tmp\18264cc7c7326367675011fd773c2c3bd2477ac6_0000922064.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-6nakf.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-6nakf.tmp\appimageorign.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\appimageorign.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\appimageorign2.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\appimageorign2.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\cinshlpr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\innosetuphelper.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\isxdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-6nakf.tmp\webbrowser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-aikvj.tmp\f9a10403ac4c728eff0cf597f3e6d215e999a5b0_0000920072.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-c1c6k.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-c1c6k.tmp\appimageorign.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\appimageorign.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\appimageorign2.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\appimageorign2.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\cinshlpr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\innosetuphelper.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\isxdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-c1c6k.tmp\webbrowser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qmmkl.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-qmmkl.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-qmmkl.tmp\appimageorign.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qmmkl.tmp\cinshlpr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qmmkl.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qmmkl.tmp\innosetuphelper.dll	Synchronize,Write Data
c:\users\user\appdata\local\temp\is-qmmkl.tmp\innosetuphelpernet4.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qmmkl.tmp\isxdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-qmmkl.tmp\webbrowser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-saipl.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-saipl.tmp\appimageorign.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\appimageorign.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\appimageorign2.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\appimageorign2.zip	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\cinshlpr.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\innocallback.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\innosetuphelper.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\isxdl.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-saipl.tmp\webbrowser.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ubt2b.tmp\97525f8f85dee3b75159cd3230e96be612936815_0000921904.tmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-vk0j0.tmp\682d4e242152fbe0cc227b1af6fad5548e34ec80_0000921552.tmp	Generic Write,Read Attributes
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\1f356f4d07fe8c483e769e4586569404	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\3b6e683a7a45cc59bf035c9ba8c7ab9d	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\5457a8ce4b2a7499f8299a013b6e1c7c_d734ec3dd00546f46d368325396086b0	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\b90b117906b8a74c79d1bc450c2b94b1_a54f26a8a41de52c237d54d67f12793f	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\content\f4d9c889b7aebcf4e1a2daabc5c3628a_68d0f016ba3f0b9282b68842de23427f	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\1f356f4d07fe8c483e769e4586569404	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\3b6e683a7a45cc59bf035c9ba8c7ab9d	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\5457a8ce4b2a7499f8299a013b6e1c7c_d734ec3dd00546f46d368325396086b0	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\b90b117906b8a74c79d1bc450c2b94b1_a54f26a8a41de52c237d54d67f12793f	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\locallow\microsoft\cryptneturlcache\metadata\f4d9c889b7aebcf4e1a2daabc5c3628a_68d0f016ba3f0b9282b68842de23427f	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\microsoft\tracing::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableautofiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasapi32::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enablefiletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableautofiletracing		RegNtPreCreateKey

Show More

HKLM\software\wow6432node\microsoft\tracing\rasmancs::enableconsoletracing		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filetracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::consoletracingmask	￿	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::maxfilesize		RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\tracing\rasmancs::filedirectory	%windir%\tracing	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::left	ঔ	RegNtPreCreateKey
HKCU\software\microsoft\ctf\msutb::top		RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	n �8�tX�jg�8 �� �v�Z xy ����T�������dc�% ���5��3bBx�< ��#�� $kF %� &� &�-(�(X�(� )E )�`*J*9 *�" -!R0P% 1`1�1HO5,]=�@V�A��B��G�IH[uH�pI��J��K��N$ N�U_* X�.X�Z^�	RegNtPreCreateKey
HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75	n �8�tX�jg�8 �� �v�Z xy ����T�������dc�% ���5��3bBx�< ��#�� $kF %� &� &�-(�(X�(� )E )�`*J*9 *�" -!R0P% 1`1�1HO5,]=�@V�A��B��G�IH[uH�pI��J��K��N$ N�U_* X�.X�Z^�	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Encryption Used	BCryptOpenAlgorithmProvider
User Data Access	GetUserObjectInformation
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWriteFile
Anti Debug	NtQuerySystemInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Deqwfxap\AppData\Local\Temp\is-1C0F6.tmp\1319265614c8291a78a998c5a8c717ed65715634_0000921904.tmp" /SL5="$10242,500774,146432,c:\users\user\downloads\1319265614c8291a78a998c5a8c717ed65715634_0000921904.exe"

"C:\Users\Ekbyofye\AppData\Local\Temp\is-VK0J0.tmp\682d4e242152fbe0cc227b1af6fad5548e34ec80_0000921552.tmp" /SL5="$1025E,500148,146432,c:\users\user\downloads\682d4e242152fbe0cc227b1af6fad5548e34ec80_0000921552.exe"

"C:\Users\Gfmidnjx\AppData\Local\Temp\is-AIKVJ.tmp\f9a10403ac4c728eff0cf597f3e6d215e999a5b0_0000920072.tmp" /SL5="$2013E,498315,146432,c:\users\user\downloads\f9a10403ac4c728eff0cf597f3e6d215e999a5b0_0000920072"

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\6d3d9988d4a01a334f1934d3ce272508ba8f9f0f_0000116736.,LiQMAxHB

"C:\Users\Qzfhjbkm\AppData\Local\Temp\is-UBT2B.tmp\97525f8f85dee3b75159cd3230e96be612936815_0000921904.tmp" /SL5="$16029C,500774,146432,c:\users\user\downloads\97525f8f85dee3b75159cd3230e96be612936815_0000921904"

Show More

"C:\Users\Fvtmiple\AppData\Local\Temp\is-40SS7.tmp\18264cc7c7326367675011fd773c2c3bd2477ac6_0000922064.tmp" /SL5="$190220,500148,146432,c:\users\user\downloads\18264cc7c7326367675011fd773c2c3bd2477ac6_0000922064"