PUP.Gamehack.EHBD
PUP.Gamehack.EHBD is a detection name used to identify a potentially unwanted program (PUP) associated with game hacking or cheat tools. Programs in this family are typically marketed as utilities that modify video games, unlock hidden features, bypass restrictions, or provide an unfair advantage during gameplay. While these tools may appear harmless or even appealing to gamers looking for shortcuts, they are generally flagged because of the risks, invasive behaviors, or bundled components that often accompany them.
Table of Contents
What PUP.Gamehack.EHBD Does
Like most programs in the game hack category, PUP.Gamehack.EHBD typically functions by altering the memory, files, or behavior of installed games to grant players abilities they would not normally have, such as unlimited in-game currency, invincibility, or unlocked content. To achieve this, these tools often require elevated system permissions, disable security features, or inject code into running processes. This type of deep system access is a common reason why security tools classify such programs as potentially unwanted rather than fully legitimate software.
In many cases, game hack tools also bundle additional software components, such as adware, browser extensions, or other PUPs, which may run in the background without the user’s clear understanding. Some may also display intrusive advertisements, redirect web searches, or collect information about the user’s system and activity for advertising or analytics purposes.
How It Usually Gets Onto Computers
Programs classified under PUP.Gamehack.EHBD typically spread through channels associated with unofficial or unverified software sources. Common distribution methods for this category include:
- Downloads from third-party gaming forums, file-sharing sites, or cheat-tool repositories
- Bundled installers that package the game hack alongside other unwanted programs
- Deceptive advertisements promising free game modifications, unlocked content, or in-game advantages
- Cracked or pirated versions of games that include hidden hack tools
Because these tools are rarely distributed through official app stores or verified publishers, users who download them often have little assurance about what else is included in the installation package.
Risks for the User
Installing a program like PUP.Gamehack.EHBD can expose users to several risks typical of this category:
- Reduced system security due to disabled protections or elevated permissions granted to the hack tool
- Installation of additional unwanted software, such as adware or browser hijackers
- Exposure to intrusive ads, pop-ups, or redirected web traffic
- Potential violation of game terms of service, which can result in banned accounts
- Possible instability or crashes in the modified game or operating system
Signs of Infection
Users affected by this type of PUP may notice unexpected changes to their system or browsing experience, including:
- New toolbars, extensions, or programs that were not intentionally installed
- Increased pop-up ads or changes to browser homepage and search settings
- Unusual system slowdowns, especially while gaming
- Security software issuing warnings or being unexpectedly disabled
- Unfamiliar processes running in the background
How to Stay Protected
To reduce the risk of encountering PUP.Gamehack.EHBD and similar potentially unwanted programs, users should avoid downloading game modification tools from unofficial or unverified sources. Carefully reading installation prompts, declining bundled offers, and avoiding pirated game content can significantly lower exposure to this type of software. Keeping security software up to date and regularly scanning for unwanted programs can also help detect and remove such threats before they cause harm.
Analysis Report
General information
| Family Name: | PUP.Gamehack.EHBD |
|---|---|
| Packers: | UPX! |
| Signature status: | Hash Mismatch |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
b4684010d84cd64ae708b67256df1e82
SHA1:
6b02bd2fd90c0a4bb1cf2acc57da58a0e36fc71a
SHA256:
B37D3320E18A8D1AE0E7C35EE5CD99676E32D96E15E4481F80950FCFD27283E7
File Size:
5.27 MB, 5273648 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has been packed
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| Microsoft Windows | Microsoft Windows Production PCA 2011 | Hash Mismatch |
File Traits
- dll
- imgui
- ntdll
- packed
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 47,061 |
|---|---|
| Potentially Malicious Blocks: | 436 |
| Whitelisted Blocks: | 39,974 |
| Unknown Blocks: | 6,651 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
?
?
0
?
?
0
x
0
0
0
?
x
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
?
0
?
0
?
?
0
?
?
?
?
?
?
0
?
0
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
?
?
0
?
0
?
?
?
?
0
0
?
?
?
?
?
0
0
?
?
?
0
?
?
0
?
0
?
?
?
0
?
0
x
0
?
?
0
0
?
?
?
?
?
?
?
?
0
0
?
?
x
?
?
0
0
?
0
?
?
?
?
0
?
?
0
?
0
0
0
?
?
?
?
?
?
?
0
?
0
?
?
?
0
?
?
?
0
?
?
?
0
0
?
?
?
0
?
?
?
0
?
?
?
0
0
?
?
?
0
0
?
?
?
0
0
?
?
?
?
?
0
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
0
0
0
0
0
?
?
?
0
?
?
0
?
?
0
?
?
?
?
0
?
?
?
0
?
?
0
?
0
?
?
0
?
?
0
?
?
0
?
?
0
?
?
0
?
?
?
0
?
?
0
?
?
?
?
0
?
?
0
?
?
?
?
?
0
?
?
0
0
?
?
?
?
0
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
0
0
?
?
0
?
0
?
0
?
?
0
?
?
0
?
?
?
0
?
?
0
?
?
0
0
x
?
?
?
?
?
?
?
?
0
?
?
0
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
0
?
?
0
?
?
0
?
?
0
?
?
0
?
?
0
0
?
?
?
0
?
?
0
?
?
?
0
0
?
?
0
?
?
0
?
?
0
?
?
0
?
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
0
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
0
?
?
?
?
0
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
0
?
?
?
0
?
0
?
?
0
?
?
?
?
?
?
0
?
?
?
0
?
?
0
?
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
