Trojan.PeCan.A

The detection of Trojan.PeCan.A on your system indicates a potential security threat that requires immediate attention. This report aims to provide you with a comprehensive understanding of the threat, its operational methods, symptoms of infection, and most importantly, steps to remove it from your system.

What Is Trojan.PeCan.A?

Trojan.PeCan.A is identified as a Trojan-type threat. Trojans are malicious programs that can cause harm to your computer, steal your personal data, or provide unauthorized access to your system. They are often disguised as legitimate software, making them difficult to detect without proper security measures. Understanding the nature of this threat is crucial in taking the right steps towards its removal and preventing future infections.

How Trojan.PeCan.A Operates

Like other Trojans, Trojan.PeCan.A is designed to operate discreetly, avoiding detection by traditional antivirus software. It may exploit vulnerabilities in your system or application software to gain access. Once inside, it can perform a variety of malicious activities, including data theft, installation of additional malware, or even allowing remote access to your computer. The specific operations of Trojan.PeCan.A can vary, but its primary goal is to compromise your system's security and integrity.

Symptoms of Infection

Identifying the symptoms of a Trojan infection can be challenging due to their stealthy nature. However, common indicators include unexpected system crashes, slow performance, unfamiliar programs or toolbars, and unusual network activity. If you've noticed any of these symptoms, it's essential to take immediate action to secure your system and protect your data. Remember, some Trojans may not display any noticeable symptoms at all, making regular system scans crucial for early detection.

How to Remove Trojan.PeCan.A

1. Enter Safe Mode with Networking: This will help prevent the malware from loading and interfering with the removal process. Restart your computer, and as it boots up, press the F8 key repeatedly until you see the Advanced Boot Options menu. Select Safe Mode with Networking and press Enter.
2. Conduct a Full Scan with a Reputable Tool: Utilize a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This will help identify and remove all instances of the Trojan and any associated malware.
3. Uninstall Suspicious Programs: Go through your installed programs and uninstall any that you don't recognize or that were installed around the time the Trojan was detected. Be cautious, as some legitimate programs might be mistakenly uninstalled.
4. Reset Your Web Browsers: Trojans can often modify browser settings. Resetting Chrome, Firefox, Edge, or any other browser you use can help remove unwanted changes and ensure your browsing experience is secure. You can usually find the reset option in the browser's settings or preferences menu.
5. Reboot and Re-scan: After completing the above steps, restart your computer in normal mode and perform another scan with your anti-malware tool to ensure all threats have been removed. This step is crucial to confirm the effectiveness of the removal process.

Conclusion

Removing Trojan.PeCan.A from your system requires careful and systematic steps to ensure all components of the malware are eliminated. By following the guidance provided, you can effectively remove this threat and take proactive measures to protect your system against future infections. Remember, prevention is key; keeping your operating system, software, and security tools up to date, along with practicing safe computing habits, will significantly reduce the risk of malware infections. Stay vigilant and ensure your system's security is always a priority.

Analysis Report

General information

Family Name:	Trojan.PeCan.A
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 9d61232dceca966940288bdd8a1b6396 SHA1: 4072e2fe2e6083a73f1d14f754c07e5861278502 SHA256: 1A88FFFA3EE96460BD9CAD72EDCD9E450DF2E32E4925820F2926F494EE7A3879 File Size: 408.06 KB, 408064 bytes

MD5: 8344ca17b5f23ef7dbcec522779ec742 SHA1: 5270361d34e9034ee779c24d9840352c29e47ab8 SHA256: 05B4DFFE16C941E1C64357C9D13673B58F6D1DCC0DEEB11759851957D0D08D49 File Size: 704.54 KB, 704536 bytes

MD5: 9cb7474dba8b8e5fd70b7f0a4c03f78a SHA1: 1c5adefd84fc931f09899e14fd0f49e2b2991a66 SHA256: 06D86C0EC5ABC7BCDE3BE8BF0C1F45A0C85BE34255E4350F58E9A23D104D8B6E File Size: 316.95 KB, 316952 bytes

MD5: 6d2f7b79df0d35412cc9b224973e2b3b SHA1: 925829eb00887fe13e668b04d65b32e87bc68b1b SHA256: F6B11BF8DB895EFBD3F84B64DF136BD9470A76B4DD6FAFDEA1A928EF2E217297 File Size: 5.18 MB, 5180952 bytes

MD5: 55d6161c3780f1f6f10683ac9f138654 SHA1: fa9b2ec24b9a03c012b9dfd9be3cf1696c1b38d7 SHA256: BE7BD498AAFFEC7F0DCBAAD7042FFCA8BE24F0C0EED156FC21912DC52FD01D2F File Size: 2.19 MB, 2188288 bytes

Show More

MD5: 881e5217d5e047549e4190891ae828b8 SHA1: 0ccef5714cbef022b8116a775ff7b32604fbd132 SHA256: 089A7F64C9C437780D6642979608F1CEA8C2CEB731229449716DF2BCB4B58067 File Size: 707.10 KB, 707096 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)

Show More

• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Company Name	Hyperionics Technology LLC MRK SmartKey
File Description	CUDAOpen HyperSnap Sistema Cuántica Bio-Eléctrico
File Version	6, 81, 3, 0 3.7.4.0 1, 0, 0, 1
Internal Name	CUDAOpen Electret.exe HprSnap6
Legal Copyright	2007-2012(C)SmartKey.All rights reserved. Copyright (C) 1995-2010 Hyperionics Technology, LLC Copyright (c) MRK. All rights reserved.
Original Filename	CUDAOpen.dll Electret.exe HprSnap6.exe
Product Name	CUDAOpen HyperSnap v.6 Sistema Cuántica Bio-Eléctrico
Product Version	6, 81, 3, 0 3.7.4.0 1, 0, 0, 1

Digital Signatures

i

Digital Signatures

This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.

Signer	Root	Status
NGO	NGO	Self Signed

File Traits

• 2+ executable sections
• dll
• HighEntropy
• No Version Info
• x86
• Zprotect

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	7
Potentially Malicious Blocks:	1
Whitelisted Blocks:	5
Unknown Blocks:	1

Visual Map

0 0 0 0 0 x ?

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Crack.X
• PSW.Gamania.A
• PeCan.A

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\dxwmxlyfwm.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ecaqxkfurqwhlghscycs.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ejrjdrbzjk.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\mvygkxzcwaaovbunwnlq.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\osnvmrpndacdangnqlvz.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\puxisbmtajslhjohmlah.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\test.dat	Generic Read,Write Data,Write Attributes,Write extended,Append data

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtClose ntdll.dll!NtCreateFile ntdll.dll!NtCreateSection ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenProcessToken ntdll.dll!NtQueryAttributesFile Show More ntdll.dll!NtQueryDebugFilterState ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationToken ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationFile ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWriteFile
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess
Anti Debug	NtQuerySystemInformation

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1c5adefd84fc931f09899e14fd0f49e2b2991a66_0000316952.,LiQMAxHB