Home / malware

PDF

PUA:Win32/SubTab

First posted on 01 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/SubTab.

Explanation :

Installation

It can be digitally signed by the following vendors:

• Thinknice Co. Limited
• Zhang Ling
• Giner Tech Inc
• Minidigital Technology Co., Limited
• 合肥智明星通软件科技有限公司

We have seen this application using product names such as:

• IePlugin control
• SupTab
• RSHP IePlugin control
• Winzipper
• XTab

This application communicates with domains such as:

• www.tabwpm.us
• d1mxvenloqrqmu.cloudfront.net
• dv2m1uumnsgtu.cloudfront.net
• d26yaxxlnmhaem.cloudfront.net
• www.upwpm.us

For example:

• www.tabwpm.us/Wpm/up?
• www.tabwpm.us/Wpm/up?
• d1mxvenloqrqmu.cloudfront.net/searchprotect/up?

Payload

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• WinZip
• qksee
• YAC(Yet Another Cleaner!)

This description was published using automated analysis.

Last update 01 July 2016

 

TOP