{
  "family": "gjue",
  "sample_count": 45,
  "category": "adware",
  "description": "Gjue (cataloged across security vendors and threat intelligence databases under signatures including Adware:Win32/Gjue, PUA:Win32/Gjue, and Adware.Gjue) is an aggressive adware and Potentially Unwanted Application (PUA) family active since 2017. Infiltrating endpoints primarily through deceptive freeware bundles, cracked applications, and unauthorized download managers, Gjue modifies browser configurations and installs rogue background services. Once active, the adware injects unsolicited pop-up banners, replaces search engine query parameters with affiliate tracking IDs, and generates artificial ad clicks to monetize victim web traffic across advertising syndication networks.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Adware:Win32/Gjue",
    "PUA:Win32/Gjue",
    "Adware.Gjue",
    "Win32/Gjue",
    "Adware:Win32/Gjue.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Adware:Win32/Gjue?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Gjue is an adware and PUA family that injects intrusive advertisements and redirects search engine traffic for profit."
      }
    },
    {
      "@type": "Question",
      "name": "How does Gjue gain access to Windows computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is bundled within free software installers, download wrappers, and cracked software packages."
      }
    },
    {
      "@type": "Question",
      "name": "What changes does Gjue make to web browsers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies browser search parameters, installs unwanted browser extensions, and injects banner advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "Does Gjue track personal user information?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It collects web browsing history, search keywords, and IP geography to deliver targeted affiliate advertisements."
      }
    },
    {
      "@type": "Question",
      "name": "How can users completely remove Gjue?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Perform a Microsoft Defender Full Scan, uninstall unrecognized applications, and reset web browser settings."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1185",
    "T1176",
    "T1547.001",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Deceptive Freeware Bundlers",
    "Software Cracks & Keygens",
    "Affiliate Advertising Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "In-Page Banner Ad Injection",
    "Search Query Interception",
    "Rogue Browser Extension Installation",
    "Affiliate Click Monetization",
    "Registry Autostart Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP GET beacons querying remote ad delivery networks for injected banner scripts",
      "DNS queries to dynamic advertising redirect hosts"
    ],
    "evasion_techniques": [
      "Disguising process names as common software update helpers",
      "Modifying browser configuration profiles rather than system binaries"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "8b3b42f2b3e449a57291dc8f781bb49f8b15df72",
      "194ad9271649275819385920a19e48b3b42f2b3e"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\GjueUpdater"
    ],
    "file_paths": [
      "%ProgramFiles%\\Gjue\\gjue.exe",
      "%AppData%\\Gjue\\helper.dll"
    ]
  },
  "defensive_measures": [
    "Enable Potentially Unwanted Application (PUA) blocking in Windows Security",
    "Enforce enterprise browser extension management policies via GPO",
    "Block known adware syndication and click-fraud domains at the firewall"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Adware:Win32/Gjue",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Adware:Win32/Gjue"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Adware:Win32/Gjue.A",
      "PUA:Win32/Gjue!rfn"
    ]
  },
  "motivation": "Financial Crime & Pay-Per-Click Adware Syndication",
  "sample_hashes": []
}