PUP.Gamehack.GAG
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.GAG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
e71aaf08b1f51fa1bf7baad94f783b4e
SHA1:
eccfe6e2fae6c1c17563ae5a7964084f12cae0b6
SHA256:
676BF5CED782F5BA2D0852A1B36FFBC47222082CBC962FBAD145B64EEDF06997
File Size:
445.95 KB, 445952 bytes
|
|
MD5:
5871a2aac2a9d0913ba40765b543463c
SHA1:
09df60e1ff98972fa53391f9f8edd600b806a73b
SHA256:
9867AA6214E822948095E082E4FDDEEEE892E4A4F9570BDE1922BD2D3C6FCCA0
File Size:
392.70 KB, 392704 bytes
|
|
MD5:
2871b90d38a1afe64f55448faaea790d
SHA1:
1be9a0fa76cb1ca3460f829c6401e9afed0248a8
SHA256:
E2CD8C12F5A14FDCD0BBF825B2BD7C3828AFA85992545F51F51C3133B562A77F
File Size:
358.91 KB, 358912 bytes
|
|
MD5:
edde96c2aa5b350be6ae6af71d4b5d3c
SHA1:
c2c16cfacee84bb0130800a7540cd24fd340d5ce
SHA256:
72D1423B28B253C98B9E144F038A01A7C0B3C9AAD823D192D0BE228E2AA0D0DC
File Size:
339.97 KB, 339968 bytes
|
|
MD5:
80ba492d7f275df368aa9c843530bbeb
SHA1:
b7066a45cc082dea799fbd16bfa8f10c1f79538e
SHA256:
25AD350CF833EDB947AC10D433D39F9F35847C56DE038C958E25A6EA7AB4F5E5
File Size:
707.07 KB, 707072 bytes
|
Show More
|
MD5:
4380169eccd47580dff040dd02f62062
SHA1:
55466b6c8df097f48bee081275e5422eb285b686
SHA256:
D3B0C4E4DEA0C89546A7B30E695D8091F417D69F00DAF2CBD66862698E8D8D66
File Size:
20.99 KB, 20992 bytes
|
|
MD5:
b2fb93783582e09d9bab389c9ca673f4
SHA1:
088816dff870e6ab7131a9c7fcd41c2e720a7094
SHA256:
05FDAAA3438F05EC670AC85C66D0F40B7678F2B97423F684542D7A601E3717FC
File Size:
716.80 KB, 716800 bytes
|
|
MD5:
bbe30fb71b31b2680ce115de87a0a27f
SHA1:
df882d71ff1786f6443d2ca19fb7becac584c337
SHA256:
A58C5A6B793802F673B0F79ED82178F7D88FCC812CB7D070DF93C00762889754
File Size:
605.18 KB, 605184 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Tsuda Kageyu |
| File Description | MinHook - The Minimalistic API Hook Library for x64/x86 |
| File Version | 1.3.3.0 |
| Internal Name | MinHookD |
| Legal Copyright | Copyright (C) 2009-2017 Tsuda Kageyu. All rights reserved. |
| Legal Trademarks | Tsuda Kageyu |
| Product Name | MinHook DLL |
| Product Version | 1.3.3.0 |
File Traits
- dll
- imgui
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,006 |
|---|---|
| Potentially Malicious Blocks: | 86 |
| Whitelisted Blocks: | 868 |
| Unknown Blocks: | 52 |
Visual Map
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
0
x
x
x
?
0
0
0
x
0
0
0
?
?
0
0
0
x
0
0
0
x
x
1
?
x
0
0
0
0
0
0
?
x
0
x
x
0
0
0
0
0
0
x
?
0
x
?
0
0
0
0
0
0
0
0
0
x
1
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
x
0
0
0
0
0
0
0
x
0
x
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
x
0
0
0
0
0
0
x
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
?
x
x
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
x
x
x
0
?
0
0
?
0
?
x
?
0
0
0
0
0
?
0
x
0
0
0
0
?
?
0
0
x
0
?
0
0
0
?
?
?
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
?
0
?
?
?
?
?
x
?
?
?
0
0
0
0
0
x
0
x
x
x
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
0
x
x
?
?
0
?
x
?
0
x
x
x
?
x
0
?
0
?
?
?
?
?
0
?
?
x
x
0
?
x
0
?
0
x
?
?
x
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
x
?
?
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
92 additional items are not displayed above. |
| Keyboard Access |
|
| Service Control |
|
| Network Wininet |
|
