Home / malwarePDF  

PUA:Win32/PullUpdate


First posted on 03 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/PullUpdate.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

  • directionsformapstadium.com
  • easytodownload123.com
  • xz.cr173.com
  • aiweibang.oss-cn-hangzhou.aliyuncs.com
  • d.getspeedbrowser.com


We have seen this application use the following file names:
  • Setup.exe
  • Setup (1).exe
  • 612xx.exe
  • 7Zip_Setup.exe
  • setup.exe
  • Setup (2).exe
  • Impress_Setup.exe
  • DownloadManager.exe
  • aMSN_Setup.exe


It can be digitally signed by the following vendors:
  • Web Cake
  • Creative Island Media, LLC
  • Acute Angle Solutions Ltd.
  • DOTPITCH.INC
  • Small Island Development


We have seen this application using product names such as:
  • WatchDog
  • Desktop OS
  • Updater
  • Desktop
  • WebCake Desktop


This application communicates with domains such as:
  • www.p2psearchers.com
  • p2ps.dorapp.com
  • le.so.letv.com
  • tc.ci123.com
  • imgcdn.sxxjdz.com


For example:
  • p2ps.dorapp.com/air/adbrier/?
  • www.p2psearchers.com/client/?
  • www.p2psearchers.com/clientdata/setting648.lua


Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:
  • Installs programs that start automatically when your PC starts
  • Injects into other processes on your system
  • Changes your browser's default homepage settings
  • Changes your browser's shortcuts - often this can be used to take over your homepage by adding command-line arguments that change how the page is loaded
  • Changes your Internet Explorer proxy auto-configuration setting - we often see this used to inject ads in your browser as you browse the web


Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:
  • WindowsTab Uninstall
  • speed browser
  • Internet Updater
  • 暴风秀场
  • Adobe Flash Player 10 Plugin
  • MapsWorldSearch
  • TuneUp 2.6.5.1
  • Windowviewcon Uninstall
  • CrimeWatch


This description was published using automated analysis.

Last update 03 July 2016

 

TOP

Malware :