PUP.Gamehack.FYA
PUP.Gamehack.FYA is a heuristic detection that EnigmaSoft's SpyHunter and other security engines apply to files that behave like game-cheating tools — trainers, memory editors, aim/ESP helpers and, most commonly, injectable hack libraries that hook into a running game. The PUP.Gamehack.FYA label belongs to the broad, long-running GameHack classification (also seen as PUP.Optional.GameHack, PUA:Win32/GameHack and HackTool.Win32.Gamehack across vendors), which covers hundreds of unrelated programs that share one trait: they manipulate other software to give players an unfair advantage.
That category is deliberately cautious. Some GameHack files do exactly what they advertise, while others are trojanized builds that quietly bundle information stealers, coin miners, adware or account-theft malware. Because a cheat tool asks the user to disable protection, run as administrator and inject code into another process, even a "working" cheat opens a wide door on the host. This report describes the specific sample flagged as PUP.Gamehack.FYA, using data from EnigmaSoft's automated malware analysis sandbox (AMAS), and explains how to identify and remove it.
Table of Contents
What Is PUP.Gamehack.FYA?
PUP.Gamehack.FYA is a Potentially Unwanted Program in the GameHack family. The analyzed sample is not a standalone application but a 64-bit Windows dynamic-link library (DLL) — the classic delivery form for an injectable game cheat. Rather than launching on its own, this kind of module is loaded into the address space of a target game (often by a separate "loader" or "injector"), where it can read and rewrite game memory, patch functions and draw overlays from inside the trusted process.
The GameHack designation is a family/behavior class rather than a single authored strain, so attribution is intentionally general: publicly documented GameHack tooling ranges from Cheat Engine derivatives that trigger benign detections to malicious cheats that disable antivirus, add persistence and drop keyloggers. Treat any GameHack detection on a normal workstation as risky rather than harmless.
How It Spreads / Distribution
GameHack-class tools are not distributed through legitimate app stores. Based on well-documented public reporting on this category, the usual channels are:
- Cheat forums, Discord servers and YouTube/description links promising "free" trainers, aimbots or unlockers.
- Cracked game executables, key generators and "modded" APK/PC repacks that carry a hack DLL alongside the crack.
- File-locker and pay-per-install download portals that wrap the tool in an installer bundling extra unwanted software.
- Direct social-engineering: users are told to turn off Windows Defender or add an exclusion "so the cheat is not blocked," which removes the very protection that would stop a malicious payload.
Because the DLL analyzed here needs an injector or a compromised loader to run, distribution typically pairs it with a launcher archive rather than a single clickable file.
Technical Analysis & Behavior
The AMAS sandbox classifies the sample as a 64-bit DLL (file traits: dll, x64) that is not digitally signed — there is no signer or certificate chain, which is normal for cheat modules but abnormal for trustworthy software. The file is not packed with any recognized runtime packer, so its code sits on disk largely as compiled, meaning static and PE-based inspection is effective against it.
The standout behavioral trait recorded for this sample is direct system-call use (syscall_use). Instead of calling documented Windows API functions through the usual libraries, the code invokes kernel syscalls directly. In cheat and malware development this is a deliberate evasion technique: it sidesteps user-mode API hooks that anti-cheat drivers and endpoint security products install, making the module harder to monitor and to block from inside the target process. The sample also carries a set of PE characteristic flags (a header flag count of 11) consistent with a native x64 image.
During this particular detonation the module performed no on-disk file writes and no registry modifications inside the observed window — consistent with an injectable component whose real activity only begins once it is loaded into a host game process, and whose loader/injector is a separate artifact. AMAS did not associate the sample with any related family clusters in this run.
Indicators of Compromise
The following indicators come from the single analyzed sample. These values reflect one representative sample; specific indicators (hashes, size and packaging) rotate frequently across GameHack builds, so absence of an exact match does not mean a system is clean.
- SHA-256: 46EC83B37E3689C88EF6E8473AF2502B0947B97F1ECA8DB86C6438D8054A391D
- SHA-1: 43ee04b07be437fe3623644eb9121c869270e35e
- MD5: 5d34536b47e6435e967e566860f77ec7
- File size: 667,136 bytes (~651 KB)
- Type: 64-bit Windows DLL, unsigned, unpacked
- Notable behavior: direct syscall invocation (anti-hook / anti-monitoring)
Detection Heuristics
Engines flag PUP.Gamehack.FYA through a blend of signals rather than a single string. An unsigned x64 DLL that is delivered outside any installer, that imports or resolves low-level functions to fire raw syscalls, and that is designed to be injected into another process fits a well-known cheat/hack profile. Contextual heuristics add weight: origin from a cheat archive or crack bundle, sibling files named like injectors or loaders, and the absence of a valid Authenticode signature. Because GameHack is a behavioral class, reputable tools such as Cheat Engine can also trip these rules as PUP.Optional.GameHack — so detections should be judged by where the file came from and what it injects into, not by name alone.
Digital Forensics
When hunting for this sample or its relatives, focus on the artifacts an injectable cheat leaves behind rather than expecting heavy persistence footprints:
- Files: an unsigned ~651 KB x64 DLL in a downloads, temp, or game/cheat folder, usually accompanied by a loader or injector executable and a cheat-config or license file.
- Processes/memory: a game or unrelated process with an unexpected, unsigned module loaded — enumerate loaded modules and look for the DLL mapped into a host that should not need it; the direct-syscall behavior means user-mode API monitoring may miss its activity, so inspect module lists and memory rather than API traces.
- Registry & persistence: this sample made no registry changes in the sandbox run, but malicious GameHack variants commonly add Run-key entries or scheduled tasks — audit those and any Defender exclusions the user was told to add.
- Signature check: confirm the module is unsigned; a legitimate game component would normally carry a valid publisher signature.
Symptoms of Infection
- Antivirus or anti-cheat alerts naming GameHack, or repeated game bans/kicks.
- A request (from the tool or a guide) to disable Windows Defender or add exclusions before running.
- Unexplained CPU/GPU load, stutter or crashes in games and the desktop.
- Unknown DLLs injected into game or system processes.
- Follow-on symptoms if a trojanized build was used: stolen game/banking credentials, hijacked accounts, new browser extensions or startup entries.
How to Remove PUP.Gamehack.FYA
Because GameHack files often travel with additional payloads, remove the whole bundle, not just the DLL.
- Run a full SpyHunter scan. Update SpyHunter, run a complete system scan, and let it quarantine PUP.Gamehack.FYA plus any injectors, loaders and secondary threats it finds. A full scan (not a quick scan) is important because the loader may live in a different folder than the DLL.
- Boot into Safe Mode with Networking if the file is locked or the cheat auto-loads, then rescan and delete the leftover DLL, injector and cheat folder manually.
- Remove persistence. Check Task Scheduler and the Run keys, and remove any Windows Defender exclusion that was added for the cheat.
- Clean browsers in case a bundled payload changed settings:
- Chrome: Settings → Extensions (remove unknown items) → Settings → Reset settings → "Restore settings to their original defaults."
- Firefox: Add-ons and themes → remove unknown extensions → Help → More troubleshooting information → "Refresh Firefox."
- Edge: Extensions (remove unknown items) → Settings → Reset settings → "Restore settings to their default values."
- Android (for modded APK cheats): uninstall the modded game/app, boot into Safe mode to remove stubborn apps, revoke any Accessibility or Device-admin rights it was granted, then run a mobile security scan.
- Change credentials for game, email and financial accounts from a clean device if a trojanized cheat may have run, and enable multi-factor authentication.
Conclusion
PUP.Gamehack.FYA is a GameHack-class detection for an unsigned 64-bit cheat DLL that abuses direct system calls to slip past anti-cheat and endpoint monitoring. On its own it is a policy-violating, unwanted tool; in the wild it is frequently a delivery vehicle for stealers and other malware, and it only earns its access because the user is coaxed into disabling protection. The safest response is to remove the entire cheat package with a full SpyHunter scan, undo any protection changes it prompted, and rotate credentials if a trojanized build may have executed. Keep security software enabled and download games and tools only from official sources.
Analysis Report
General information
| Family Name: | PUP.Gamehack.FYA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
5d34536b47e6435e967e566860f77ec7
SHA1:
43ee04b07be437fe3623644eb9121c869270e35e
SHA256:
46EC83B37E3689C88EF6E8473AF2502B0947B97F1ECA8DB86C6438D8054A391D
File Size:
667.14 KB, 667136 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,117 |
|---|---|
| Potentially Malicious Blocks: | 84 |
| Whitelisted Blocks: | 743 |
| Unknown Blocks: | 290 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
