Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.EHBA

PUP.Gamehack.EHBA

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Gamehack.EHBA on your system indicates the presence of a potentially unwanted program (PUP) that may compromise your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it and prevent future infections.

What Is PUP.Gamehack.EHBA?

PUP.Gamehack.EHBA is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may exhibit malicious or unwanted behavior, such as displaying unwanted advertisements, collecting user data, or modifying system settings. The name PUP.Gamehack.EHBA suggests that this particular PUP may be related to gaming or hacking activities, but its exact purpose and behavior can only be determined through further analysis.

How PUP.Gamehack.EHBA Operates

PUPs like PUP.Gamehack.EHBA often operate by exploiting vulnerabilities in software or using social engineering tactics to trick users into installing them. Once installed, they may run in the background, consuming system resources and potentially causing problems with system stability and performance. PUPs may also communicate with remote servers, sending and receiving data that can compromise user privacy and security.

Symptoms of Infection

Systems infected with PUP.Gamehack.EHBA may exhibit a range of symptoms, including slowed system performance, unwanted pop-ups or advertisements, and modified system settings. Users may also notice unusual network activity, such as unexpected data transfers or connections to unknown servers. In some cases, PUPs may also cause problems with other software applications, leading to crashes, errors, or other stability issues.

  • Unwanted advertisements or pop-ups
  • Modified system settings or configuration
  • Slowed system performance or responsiveness
  • Unusual network activity or data transfers
  • Problems with other software applications or system stability

How to Remove PUP.Gamehack.EHBA

  1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for easier removal.
  2. Run a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all instances of PUP.Gamehack.EHBA.
  3. Uninstall any suspicious programs or applications that may be related to the PUP.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or add-ons.
  5. Reboot your system and run another scan to ensure that all instances of the PUP have been removed.

Conclusion

Removing PUP.Gamehack.EHBA from your system is essential to preventing further damage and protecting your privacy and security. By following the steps outlined above, you can effectively remove this PUP and prevent future infections. It is also important to practice safe computing habits, such as avoiding suspicious downloads and links, using strong antivirus software, and regularly updating your operating system and applications. By taking these precautions, you can help protect your system and data from the threats posed by PUPs like PUP.Gamehack.EHBA.

Analysis Report

General information

Family Name: PUP.Gamehack.EHBA
Signature status: No Signature

Known Samples

MD5: 388408213403f30551fe07fab227e364
SHA1: 52b519936101420412c1bffac9ac3501b072e0e9
SHA256: DFF7EF70B6BAABCE08DD37186ABCABEE108E756BCCDA246B27DCB0F632CAC2F5
File Size: 2.20 MB, 2198528 bytes
MD5: 304f6a59f83ffff38650d6b7ad09e1eb
SHA1: 91409ead4525a4eb70251a66264eff03d269b8a8
SHA256: 2C27038690F40BFCA77CFDBE527C874AEB1C668DF0074A96E235AAF4E4932590
File Size: 2.23 MB, 2229248 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 64-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • imgui
  • x64

Block Information

Total Blocks: 11,158
Potentially Malicious Blocks: 597
Whitelisted Blocks: 9,047
Unknown Blocks: 1,514

Visual Map

0 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 x x x x 0 ? x x x x x x x x 0 ? x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 ? ? ? ? ? x x ? ? ? ? ? ? ? 0 ? 0 ? ? 0 0 0 0 0 ? 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 ? 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 x 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 x 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 x ? x 0 0 0 x 0 x 0 0 x x 0 0 0 0 0 0 0 0 ? 0 0 ? 0 1 0 0 0 0 ? x 0 ? 0 0 ? 0 0 0 ? 0 x x 0 0 ? 0 ? ? 0 x 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
Show More
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN

Related Posts

Trending

Most Viewed

Loading...