Hacktool.GameHack.CC
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 999 |
| Threat Level: | 50 % (Medium) |
| Infected Computers: | 8,725 |
| First Seen: | September 7, 2021 |
| Last Seen: | March 19, 2026 |
| OS(es) Affected: | Windows |
Table of Contents
Analysis Report
General information
| Family Name: | Hacktool.GameHack.CC |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
a126e4e992488c72a62ecd6c35794fdf
SHA1:
75a8c52233deb0a02cd4742f4872138615674157
SHA256:
ED38839BF0B34069217B9FD8A05CCDDF8EC649BF9C80D2E48CBB6BB0A707F950
File Size:
499.20 KB, 499200 bytes
|
|
MD5:
ec965389cc3d801a97350426057fc1d5
SHA1:
a9c4bbda24318ce75c29eff437528e9338273213
SHA256:
C79720A5F18801DC777256A54A7EF1EF570E1B262AB7F253547AFCCE517F9E13
File Size:
104.45 KB, 104448 bytes
|
|
MD5:
b298bd0ebdc1751414c1d6d3dbd5f9ee
SHA1:
ddb9ee601508d82c9310bcb3858731a99f571d60
SHA256:
ED23E573A7962C4E4B2AA61D4BC9EC07A459BAEDA21EC656F37B1F606E1252A7
File Size:
422.53 KB, 422528 bytes
|
|
MD5:
97c5ef0bc5dc259d2475196385a447a9
SHA1:
9d1441c466d502f786234b58184dce857a5a93ff
SHA256:
103A0DEBEE5B1A2746A7657BE3D1204B368985F1BBFE13596F25754ACA6BA5D6
File Size:
654.34 KB, 654336 bytes
|
|
MD5:
766a6066f4ca9eeb12fa8ee43a5709bb
SHA1:
d6bbe0842d8f526803f18f360f269aa9ac64edb5
SHA256:
66818BD987035E344FF46D7CA4FDC152327B672EEE835498894F70FF39CF4847
File Size:
185.86 KB, 185856 bytes
|
Show More
|
MD5:
a393053dad769e9519bc32a8c51b91bb
SHA1:
ba068cc2d8c22b74a925fe52f5a05ba788dada6e
SHA256:
63DBADEE3D6DB0A5C1F40A2DF1E63A14A3713AB2B104188D8069FAA6787AF741
File Size:
448.51 KB, 448512 bytes
|
|
MD5:
8a1384d00396133be129160c4e63e9be
SHA1:
571ce3e5a6de5eb833e053187193fba082f9ea16
SHA256:
C4EA8DF0B18821A32717A3B4E8A234457FC8A5BC915864B94385D3E1BF3703C6
File Size:
184.32 KB, 184320 bytes
|
|
MD5:
3ffb6c840dd205657b8d52fb18cde579
SHA1:
b6d23e77f158aaab0ad29a7d79fef71cf0ebf9a0
SHA256:
B5DE4F18C07DF1216FD5AE74C07A84D2424ECCA3CD5C07EF614A65BB43C4FC08
File Size:
806.40 KB, 806400 bytes
|
|
MD5:
a5baf53138ed99d8a88f5779c12008a0
SHA1:
59110eba310a75ec2867b189445c0eddb1048542
SHA256:
7790C2191FCDFCCAC65A782C4A2A97F19D9873B384236F77AB5D43441A225FB1
File Size:
3.26 MB, 3255808 bytes
|
|
MD5:
47b1431b4a8ebc9379ae3a93d3747dab
SHA1:
1cbffea7de125511d5a939fd316d8d87f71fa2bc
SHA256:
D7BD005EDE20F00B358B75C4D4844618024F2A74AAF60957553EBD964BEE527C
File Size:
342.66 KB, 342656 bytes
|
|
MD5:
b403b09c6d2ec9923c4f57b7f2ebed4e
SHA1:
269a11435b8f22aa077f349da593ee16c8730f39
SHA256:
B53578B49F3D8AA7E22A372762CB3666E8D1D435B37AE987EE681FA0FDA2FEB6
File Size:
167.94 KB, 167936 bytes
|
|
MD5:
000e01d48ed2f369510e576cc726da76
SHA1:
5301bf42952747c2afb8a46bfb95da52d3211994
SHA256:
EDC02A4F216F079665817E40C94F07A2106945BD800483DBD1AB336593D33B68
File Size:
1.40 MB, 1403392 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Junior_Djjr | Junior_Djjr | Self Signed |
File Traits
- dll
- fptable
- HighEntropy
- imgui
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,300 |
|---|---|
| Potentially Malicious Blocks: | 465 |
| Whitelisted Blocks: | 1,835 |
| Unknown Blocks: | 0 |
Visual Map
x
x
x
x
x
x
0
0
x
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
x
x
x
x
x
x
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
0
x
x
0
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
x
0
0
x
x
x
0
0
x
x
x
x
0
0
x
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
x
x
x
x
x
0
0
0
0
x
x
0
x
x
0
0
0
0
0
0
0
x
0
x
0
0
0
x
x
x
x
x
x
x
0
0
0
0
x
x
0
0
0
x
x
x
0
0
0
0
x
x
x
x
0
x
x
x
x
x
0
x
0
0
0
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
0
0
0
0
0
0
x
x
x
x
0
0
x
x
x
x
0
0
0
0
0
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
0
x
x
0
0
x
0
0
x
0
0
x
x
0
0
0
x
x
0
0
x
x
0
x
0
x
x
x
0
x
0
0
0
x
0
0
x
x
0
x
0
x
0
0
x
x
0
x
0
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
x
x
x
x
0
0
x
x
0
0
0
x
x
x
x
x
0
0
0
0
0
0
0
x
x
x
0
x
x
x
x
x
x
0
x
0
x
0
x
x
x
x
0
x
x
x
0
0
0
0
0
0
x
x
x
x
x
x
0
0
0
0
x
0
x
0
x
0
0
0
x
0
x
0
x
0
0
0
0
0
x
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
x
x
x
0
x
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
x
x
x
x
0
0
0
0
x
x
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
x
0
0
0
0
0
x
0
0
0
0
x
0
x
0
x
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
x
0
0
0
0
x
x
x
x
x
x
0
0
x
x
x
x
x
x
x
x
0
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
x
0
0
0
0
0
x
0
x
x
0
x
x
x
0
0
0
x
x
0
0
0
0
0
0
0
x
0
0
x
x
x
x
x
0
0
0
x
0
0
0
x
x
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
x
0
x
x
x
0
x
x
x
0
x
x
0
x
0
x
x
0
x
0
0
x
x
0
0
x
0
0
x
0
x
x
0
x
0
x
x
x
0
0
0
x
0
x
0
x
0
x
0
x
0
x
0
0
x
x
0
x
0
x
0
0
x
x
0
0
x
0
x
x
x
0
x
x
x
x
x
x
x
x
x
0
x
0
x
0
x
x
0
x
x
x
0
x
0
0
x
x
x
x
0
0
0
x
0
x
0
x
x
x
0
x
0
x
x
x
0
x
0
0
x
x
x
0
x
0
0
0
x
x
x
x
x
0
x
x
0
x
x
0
x
x
0
x
x
x
x
x
x
x
0
x
x
x
x
x
0
x
x
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
x
x
x
x
0
0
x
0
0
0
x
0
x
0
x
x
x
x
x
x
1
0
x
0
0
0
0
x
x
x
x
x
x
x
0
0
0
x
x
x
x
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
x
x
x
x
0
x
x
0
x
0
x
0
x
x
x
x
x
x
x
x
x
x
0
x
x
x
0
x
x
x
0
0
0
x
x
x
x
x
0
x
x
0
x
0
x
x
x
x
x
0
0
0
x
0
x
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
1
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
1
1
0
0
0
0
0
0
0
0
1
0
0
2
3
1
1
1
0
2
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
1
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
2
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
1
0
0
0
0
0
0
0
0
1
1
0
0
0
1
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
0
0
0
0
2
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
0
0
0
2
0
0
0
0
0
0
0
0
0
2
0
0
2
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
2
0
0
0
0
1
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.KGD
- Agent.TJQ
- Korplug.P
- Trojan.Agent.Gen.ABJ
- Trojan.Agent.Gen.XG
Show More
- Trojan.Downloader.Gen.IQ
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Anti Debug |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\75a8c52233deb0a02cd4742f4872138615674157_0000499200.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\a9c4bbda24318ce75c29eff437528e9338273213_0000104448.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ddb9ee601508d82c9310bcb3858731a99f571d60_0000422528.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9d1441c466d502f786234b58184dce857a5a93ff_0000654336.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d6bbe0842d8f526803f18f360f269aa9ac64edb5_0000185856.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ba068cc2d8c22b74a925fe52f5a05ba788dada6e_0000448512.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\571ce3e5a6de5eb833e053187193fba082f9ea16_0000184320.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\b6d23e77f158aaab0ad29a7d79fef71cf0ebf9a0_0000806400.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\59110eba310a75ec2867b189445c0eddb1048542_0003255808.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1cbffea7de125511d5a939fd316d8d87f71fa2bc_0000342656.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\269a11435b8f22aa077f349da593ee16c8730f39_0000167936.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5301bf42952747c2afb8a46bfb95da52d3211994_0001403392.,LiQMAxHB
|
