PUP.Gamehack.GADB
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.GADB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
94aa268e3532523be43587bfbaf4ab8b
SHA1:
da9259ed4d2e9a4d389b8081f6c9c58ccbc19485
SHA256:
4D42BB1AA7F7764F2168B0C7C23F0C0BCF303D8843A9B4CDC355D565EFB64460
File Size:
350.21 KB, 350208 bytes
|
|
MD5:
18afaa472fb8fb9c9786193dff06f3fa
SHA1:
a34e61cd4e76601076975b965034f7ce601f4134
SHA256:
66BD473BDA7A7208CECD43767F780F76ACDEE34E5DB0B49E7419DDCB1FE2DFD6
File Size:
631.30 KB, 631296 bytes
|
|
MD5:
6d19a65a5cca76d707e526e828cea8fd
SHA1:
6c4637c8edce34e38eb466b9840200608718891c
SHA256:
FA1E2809A35E0CA678E2B516FD99EB9EA14C4B310A0D56EE2998E6434A5F28A7
File Size:
357.89 KB, 357888 bytes
|
|
MD5:
42b6f7765c7e55de741d2bee827babbd
SHA1:
94e61662faed5accea1b384858ee13b0668c2ff6
SHA256:
A2C389CD08D558CD8B92C5C31D23C5911D890FAE7D26CCC30D5CA4A39AD85DB3
File Size:
482.82 KB, 482816 bytes
|
|
MD5:
7a62250e54bd29150400492af8817215
SHA1:
cbde33e81ae4f13844da23dde39a707fc705cb7a
SHA256:
655D9EC9BD962DCEC556622BFB1F1D3954FF850B2B2A569C6D5B5EE3A58B378D
File Size:
1.32 MB, 1317376 bytes
|
Show More
|
MD5:
344e6b3aa2b347d75e1c4f5f016a3e28
SHA1:
a02e83121cef3358d8e67fa66e03c9bb3dd37eca
SHA256:
066F0FCD24D1BF7AFED3A4D079A40F72EF0BD84FC6377C142EA2FE92E8682ABC
File Size:
415.23 KB, 415232 bytes
|
|
MD5:
44ff64a64a93d6a10900b8be832f138f
SHA1:
3b91d4731ead15c03b9ceeb6ea5a756151855122
SHA256:
3D7841DA964BD25D4EE6DB6BFBEEC664C33935039C67EC5F50D5CF371D7ED648
File Size:
760.32 KB, 760320 bytes
|
|
MD5:
fa7d089196576450c19b2a1c84be40cf
SHA1:
a0faaf8a867e0c4fba6d002caf9d03a621eee3ed
SHA256:
01EF238C5D73CC7CBA5F7C3FEFA1E2C0B3EF893A4A1F8CA6A5606BAA227247FB
File Size:
515.07 KB, 515072 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright | Copyright (C) 2023 |
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- dll
- GetConsoleWindow
- HighEntropy
- imgui
- No Version Info
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,342 |
|---|---|
| Potentially Malicious Blocks: | 76 |
| Whitelisted Blocks: | 1,168 |
| Unknown Blocks: | 98 |
Visual Map
?
?
x
0
?
?
?
?
?
0
?
?
0
0
?
?
0
?
?
?
0
0
?
0
0
1
?
0
?
?
0
0
0
1
?
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
x
0
0
x
x
0
x
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
0
0
0
x
0
x
?
0
0
0
x
0
0
0
x
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
x
?
0
0
0
0
0
0
x
0
0
0
0
0
0
?
0
?
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
?
?
0
0
x
0
x
x
0
?
?
0
?
?
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
x
0
0
0
0
0
x
0
0
x
0
x
x
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
x
?
?
0
x
0
0
0
0
0
0
0
0
0
0
1
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
?
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
x
0
0
0
1
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
?
?
?
x
?
x
x
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
?
0
0
0
?
?
?
?
?
?
?
0
0
?
?
?
0
?
?
?
?
?
?
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.AEM
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\conerr$ | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ᱲ狶綸ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | 폛ر쉬ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
109 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Process Terminate |
|
| Process Manipulation Evasion |
|
