Home / malware

PDF

PUA:Win32/NetFilter

First posted on 05 July 2016.
Source: Microsoft

Aliases :

There are no other names known for PUA:Win32/NetFilter.

Explanation :

Installation

This application can be downloaded from websites that offer third-party software downloads. For example, we have seen it downloaded from:

• download2.manycams.com
• download3.manycams.com
• www.rimon.net.il
• installer.browsercleaner.com
• files.downloadnow.com

We have seen this application use the following file names:

• ManyCamWebInstaller.exe
• dlsecureTb_1.0.4.1.exe
• ManyCamWebInstaller (1).exe
• dlsecureTb_1.0.4.1 (1).exe
• ManyCamWebInstaller (2).exe
• manycam-5-3-0.exe
• dlsecureTb_1.5.0.1.exe
• ManyCamSetup_v4.1.2.exe
• ManyCamWebInstaller (3).exe

It can be digitally signed by the following vendors:

• Visicom Media Inc.
• chabaneltechnology.com
• Iminent
• Word Shark
• TRIORIS LLC

We have seen this application using product names such as:

• Iminent Protection
• ManyCam Virtual Webcam
• WS AutoUpdate Client

This application communicates with domains such as:

• urlfilter2.vmn.net
• brand.nonewtabs.com
• 8e199364a6.dataurls.com
• log.data-url.com

Payload

Exhibits suspicious behaviors

We have observed this application exhibit the following potentially unwanted behavior on PCs:

• Installs programs that start automatically when your PC starts
• Injects into other processes on your system
• Changes your browser's default homepage settings
• Changes your browser's default new tab page settings
• Installs extensions into your browsers - this is often used to inject ads, add toolbars, or change how your browser works
• Registers a Layered Service Provider (LSP) to intercept network traffic - this is commonly used to inject ads into your browsers

Installs other programs

We have seen this application install other software on your PC. Some of these applications might be bundled during the installation process and not intended to be installed. We have seen it installing programs such as:

• ManyCam 5.3.0
• Web Companion
• Setup versão 1.5
• Viva version 1.0
• Browser Cleaner
• Iminent
• ManyDownloader

This description was published using automated analysis.

Last update 05 July 2016

 

TOP