PUP.Gamehack.DSC
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.DSC |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
cc49c69085ae6bc3996bf3fb33269eb7
SHA1:
83cded469d4fbf97802b706dd09998ff29e05219
SHA256:
74AE8B13601C2E193B69EFF3D58240330853820FD166CC1AA767A75ED15C9A7B
File Size:
422.40 KB, 422400 bytes
|
|
MD5:
e7e6f425640f1d772f8730c1e79579f2
SHA1:
1db2301d1f6e52a7509e858825f8cd305a667d1a
SHA256:
A3F65358B96C31A03C92BE73B67A06D32ABC8CA264493A6F4FCC61E20D374776
File Size:
368.13 KB, 368128 bytes
|
|
MD5:
04df6349d23f4a3cdc1591385e881a4c
SHA1:
9e967908e04d26e7bcb582d375ca4cfdcf36c7b7
SHA256:
A15596E8F4DE0FB6B4AC4AFC34B023F32D2471937F8813F1951BF56F090C26B3
File Size:
421.38 KB, 421376 bytes
|
|
MD5:
06ab08d9ddf3cf8dc817c753633bf1cb
SHA1:
c578779d6cad168867a875fa077486ba1e753747
SHA256:
AC19295D94CC644A057C028D489471FA32AE76C1E0D1423EE3D5BFA6DB59814E
File Size:
641.02 KB, 641024 bytes
|
|
MD5:
dac3b1aa098ba6e9d1ef918c510eddbd
SHA1:
7f2934e33d747b52013c6973649ed7add6bb8659
SHA256:
E2B9CB48FED31CF480F38C51D0458C6C2090C02E869174D1EF12BF5B8E4940CA
File Size:
1.04 MB, 1043968 bytes
|
Show More
|
MD5:
bf12ac8f1522ce62343218cc12f36365
SHA1:
19641e5c5c7e355baf477e1a8bb1fa8b34c2f121
SHA256:
8A2555D669E133D9E60919A5B600AF3D4642376B797E653177D85247E95904E0
File Size:
256.51 KB, 256512 bytes
|
|
MD5:
74bb63081855a4074fb086946df51ae4
SHA1:
54bc07894b941738618b7b36ce888268dc76a32c
SHA256:
BCAB928D32840B232E419DBB6536F1C06800710EB99EA7004DECFE67B53054EC
File Size:
1.27 MB, 1270272 bytes
|
|
MD5:
6adf57936b0580fdaaa9074a56ec1aec
SHA1:
116e99c6aa1265f676693f1b70624f3f807e93e6
SHA256:
4D5A6E9F19877F8ACEFF0AC249507B62AE0CB053E0EECB04B412101158F505F9
File Size:
252.93 KB, 252928 bytes
|
|
MD5:
d93ad7fed8ff25a6f85b791db91f0278
SHA1:
7bb43ac5ae2cb83b98d88a68851125289bbd71dc
SHA256:
4256FC882556D93E619CCA7D28FC099E1FBC9919457341BAEA00C74B0925B4B0
File Size:
256.51 KB, 256512 bytes
|
|
MD5:
5475a15dc7d8ad26fb29390cb342b756
SHA1:
c399c914fc896245e5c58b9d6d8161fed9283f60
SHA256:
243261878C748BBD34BACF5A91FE57FF6F40B0AEA7092B47028ACD0D33654D4F
File Size:
1.23 MB, 1231872 bytes
|
|
MD5:
4160cb089ab39b0d5cb89e5e21bb88c5
SHA1:
fd2f36c67883b8e2a81dccd9228ad24c36748243
SHA256:
72D25F4F268AADA96387668D03BDF86A070C7F11AE5F5F5AE46131056E1CC9EE
File Size:
1.26 MB, 1256960 bytes
|
|
MD5:
564b63083948961e18dc71a51aa5c62c
SHA1:
7c051905d4cc59fa5e5ab9ea6be581497f4a5696
SHA256:
C441D13987658F557DD693A9D4FB0A0E28F30E1C20E329774D5D5109E8B66112
File Size:
674.39 KB, 674395 bytes
|
|
MD5:
942af5a893dcbc09458344e7f856ba22
SHA1:
379b187428b4c0ef9b72055c687f10b8997a4ec8
SHA256:
C42A233E41F7F622005F7E5C7AAE1470593CAEE6A0A7D6899381F4D4717BC8CC
File Size:
1.12 MB, 1122304 bytes
|
|
MD5:
8838bb357c597f016f9662219f38ebdc
SHA1:
70215d5e0b0384599d84380c0fbce32025cdbc58
SHA256:
68BC0B11A6F733C8087360EC6FD272F1C2E9661695AFD837B96F8F22EC2F4B18
File Size:
1.17 MB, 1167360 bytes
|
|
MD5:
a89b69012f9d0b0613828091df660123
SHA1:
ad1a139a13a1bfd581328974011f07300f6b89cb
SHA256:
77AE72916DBD40BE6D9A158F6AAF78E3BD22449173854E26A36867E8B7485E30
File Size:
265.22 KB, 265216 bytes
|
|
MD5:
702b50aee4bf61674b94475689778300
SHA1:
d1d6d501d7a64fed20a209930fa343aafb6241a4
SHA256:
430C389CB2FA4FFD1718E06D78F89A3194D5BE9F6BC817379BF10C9D7F273387
File Size:
813.57 KB, 813568 bytes
|
|
MD5:
e08616b0607074a0773ace5f82b1e13c
SHA1:
2e609159e0b60f5b4c3dd42cefd042245be25a60
SHA256:
CC8E9E7FBB1053338F5E2DFDC5E4A350F312F7F13C38B09658263CA297621CAA
File Size:
3.00 MB, 2997248 bytes
|
|
MD5:
5f25fe6d9455f0e299c695692d833151
SHA1:
4386fcb9df2decbcefcd1c32ce768233bcc97499
SHA256:
43D097E7309CF8E73777DBF1AC36A411A9D66C219030E4C0F9E3307EB73A5A5E
File Size:
453.63 KB, 453632 bytes
|
|
MD5:
700aa9883c469c4ecacbed8460def465
SHA1:
f3d004695fe1752547c5a625867a2d981f754d80
SHA256:
9BDD8ABB0E6AF193080E008F071707EC3C1513541D0C4F69C00495C86641026B
File Size:
602.62 KB, 602624 bytes
|
|
MD5:
1a33952d6c2d854961a6bf9658a2b780
SHA1:
9272fefc2650e0eb7ee2db908b21198682bed7ba
SHA256:
2F6D62DDF7B2A91B30CC827E95F8F7FB79AB665635CC4954AF1721288849C6D6
File Size:
412.67 KB, 412672 bytes
|
|
MD5:
7688104a3c5b08a3b389c832dcca9161
SHA1:
60d72ad89c002a1ae523f7d1423d214b372e6c76
SHA256:
AA7ED26B646611B50B0EAF3ED97C3583BCBC3B3DB6E7A798DE9BB9C594D92208
File Size:
568.83 KB, 568832 bytes
|
|
MD5:
27feef7a4cf8196188d8574868bd21bb
SHA1:
9fcfa54918d0e885eda07af724ba15cb4488b503
SHA256:
88A763DA86357CF8EDC153A650FC5B87AB56EF02893688FCA2B453A917A4A014
File Size:
1.29 MB, 1285120 bytes
|
|
MD5:
f456543bfb2b57c5e3ee9ae1955f8b94
SHA1:
9e6f9de47c49bfc91629bccfa6206f0319d845d6
SHA256:
69D563B6AC158DF66BCAE6F8350C052D44341C99BE468583EEB4B43F22D4BBE7
File Size:
638.46 KB, 638464 bytes
|
|
MD5:
d81a9e81c165ca9a6e60f576f33dd489
SHA1:
f5a381a16fa82ec5c3e2b7cfa947ef9b4b1bbe51
SHA256:
0A36C9C64523004695E3C988CDB584DC3BCFF621739116960AC1FA34B678C5AB
File Size:
794.11 KB, 794112 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks |
|
| Product Name |
|
| Product Version |
|
File Traits
- big overlay
- dll
- HighEntropy
- imgui
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,349 |
|---|---|
| Potentially Malicious Blocks: | 245 |
| Whitelisted Blocks: | 904 |
| Unknown Blocks: | 200 |
Visual Map
x
0
x
0
0
x
0
0
x
x
x
x
0
0
x
0
x
x
?
0
?
0
0
?
?
?
?
?
x
?
x
x
x
0
x
0
x
x
x
x
x
0
x
?
x
x
0
?
x
0
x
x
?
x
?
x
x
0
x
x
?
?
0
0
0
0
0
0
0
0
0
0
0
?
x
x
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
?
x
?
0
0
0
0
0
0
?
x
?
0
0
0
?
x
x
0
0
x
x
0
x
x
?
0
0
0
?
?
0
?
x
x
x
0
?
x
x
0
0
x
x
x
1
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
x
0
1
0
0
1
?
0
?
x
0
x
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
x
0
0
x
x
x
0
0
0
x
0
0
x
0
x
x
0
x
x
0
0
0
x
0
x
0
0
0
0
?
0
x
0
0
0
0
x
x
?
x
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
0
0
x
x
x
?
0
x
0
?
0
x
x
x
x
0
0
0
0
0
0
x
?
?
?
1
0
x
0
0
0
x
x
0
0
0
0
0
0
0
1
x
x
0
x
x
x
?
?
0
?
0
x
x
0
1
0
0
x
0
0
0
0
x
0
0
x
x
0
0
0
0
x
0
0
x
x
x
0
0
0
0
x
x
x
0
x
0
x
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
1
x
0
0
1
0
0
1
0
0
1
0
0
1
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
x
0
0
0
0
0
x
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
x
0
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
0
0
0
x
0
0
1
x
0
?
0
0
0
0
x
x
x
0
0
x
x
x
?
?
0
x
x
x
x
x
0
0
0
x
0
x
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
x
x
0
0
0
?
?
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
x
0
x
x
0
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
?
0
0
?
?
x
0
x
0
0
0
0
0
x
?
?
0
?
x
0
?
?
0
0
?
0
0
x
x
?
x
0
x
?
x
0
?
0
?
0
0
0
0
0
0
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
?
?
0
0
x
0
?
0
?
0
0
?
0
0
?
?
0
0
?
0
x
?
x
x
0
0
0
x
0
0
?
0
0
0
0
x
0
0
x
x
x
x
x
0
x
0
0
0
0
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
?
?
0
?
0
?
?
?
?
?
?
0
?
?
x
0
?
0
?
?
?
0
0
0
x
?
0
0
0
x
1
0
x
x
x
x
0
x
x
0
0
0
x
0
x
0
x
x
0
0
0
x
0
x
?
0
x
x
x
1
?
?
?
?
0
0
0
0
?
x
0
x
x
0
0
0
x
x
0
0
0
1
x
?
0
0
?
?
?
1
0
0
0
x
0
x
0
?
?
0
0
0
1
x
0
0
0
0
0
0
0
0
0
1
x
0
x
0
0
x
0
0
x
0
x
0
0
0
0
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
x
x
x
0
0
?
0
0
0
0
0
x
?
0
?
?
0
0
0
0
0
?
?
?
?
0
?
0
0
?
?
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
0
?
0
?
?
0
?
?
1
?
?
?
0
x
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
0
?
?
?
0
0
?
0
?
?
0
?
?
?
0
?
?
0
?
?
x
x
?
0
?
?
?
0
?
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
1
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 갡怄僶ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 荣์嫜ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | 栋 䠱O噀ñ뽹ɞ傄ë淃ߙĤ É | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 됙塵ꇲǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
102 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Process Terminate |
|
