PUP.Gamehack.GAIG
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.GAIG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
70649f83be72ac15b66ffd68cb68366b
SHA1:
f9fb3a0846a00e3191242bcc601a3e5a95306b08
File Size:
7.12 MB, 7122432 bytes
|
|
MD5:
8fdabfa893469765a77abf62e242fc74
SHA1:
1b0dbafe2989c15cddd6cdd59b90bc2f4e24c40c
SHA256:
D48AE050728717BB70F61523D90A2D0EF59F069BF03754F3F339F6858312E094
File Size:
3.51 MB, 3508224 bytes
|
|
MD5:
348ee17e0cf381da26cd31c9819d8ffa
SHA1:
f5fb7c556c8e4e1e3bad0c3e3cfc41cf510b1fd0
SHA256:
240A690A74244342D9F56A6C72004E98699FE9B2A79BB28D66E3BF8C25C1B203
File Size:
1.83 MB, 1833984 bytes
|
|
MD5:
fd5cadecc1aa8d0f4f13dc96128f783f
SHA1:
c4ea767d62d24505c56f50536551372999d823c2
SHA256:
720C79F414D729C999E896A41522938BF3E550C9681BC1D6DC6070FF83B711F0
File Size:
1.72 MB, 1716224 bytes
|
|
MD5:
aab9ca3e74b39e20450766f5d5d56ef0
SHA1:
c6aa02df0bc8881b647d48453b6b7d10667436ee
SHA256:
5704891C04D6704AE3C324446FF4B646F700E85C41BB49DED6C6F30D295E603B
File Size:
3.22 MB, 3220992 bytes
|
Show More
|
MD5:
e1dc9b281fc6a030165a6f30ba98939c
SHA1:
906a6b3055931f7a4b7a29f3edc7497e78b10dfb
SHA256:
C8A239FC2C8D175A13FC073F2E635C4609EC46EF0E955C93B8EB14FCCF92B10B
File Size:
1.41 MB, 1412608 bytes
|
|
MD5:
8ce0409e7832caa559e31c2c418eb573
SHA1:
59861285b6d7682b99f0498b8f9e5c1a3ac198ee
SHA256:
57B6248DD190330B14185290C808CE5853186F44F9E7A70D7421C14F9B50A5C0
File Size:
1.67 MB, 1667584 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| File Description | Opera installer SFX |
| File Version | 128.0.5807.78 |
| Internal Name | 7zS.sfx |
| Legal Copyright | Opera Software 2026 |
| Original Filename | 7zS.sfx.exe |
| Product Name | 7-Zip |
| Product Version | 128.0.5807.78 |
File Traits
- dll
- GetConsoleWindow
- HighEntropy
- imgui
- Installer Version
- No Version Info
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,971 |
|---|---|
| Potentially Malicious Blocks: | 95 |
| Whitelisted Blocks: | 1,657 |
| Unknown Blocks: | 219 |
Visual Map
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
?
?
?
0
0
0
?
0
?
0
?
0
?
?
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
1
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
?
1
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
0
?
0
x
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
x
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
x
0
0
0
0
0
0
0
?
0
x
0
1
x
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
0
?
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
?
0
?
0
?
0
?
0
?
?
?
0
0
?
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
x
0
0
0
0
0
x
0
0
0
0
?
0
0
x
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
x
0
0
x
x
x
0
x
0
?
x
0
x
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
?
?
0
0
?
0
0
0
0
0
0
0
?
0
?
x
?
?
0
0
x
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
?
0
?
0
0
x
?
x
0
0
0
0
x
1
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
x
0
0
0
x
0
0
0
0
0
0
?
?
?
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
x
0
0
1
0
0
1
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
0
0
?
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
?
x
x
0
0
x
x
x
x
0
0
?
?
x
0
?
0
x
x
x
x
0
x
0
0
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
?
?
0
0
0
?
?
0
0
?
0
0
?
0
0
x
0
x
0
0
?
?
0
x
x
?
x
x
?
x
0
?
?
?
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
0
?
?
?
?
x
?
0
?
?
?
?
?
0
0
?
0
0
?
0
?
?
?
?
0
0
?
?
0
?
0
0
?
?
?
?
0
?
?
0
0
?
0
0
0
0
0
?
0
0
0
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
?
0
?
?
?
0
x
0
0
0
0
0
0
0
1
0
0
0
0
0
0
x
0
0
x
0
0
0
0
?
0
?
0
0
0
0
?
x
?
?
?
?
?
?
?
?
?
?
0
?
0
0
?
0
0
0
0
?
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.AVBA
- Agent.JYT
- Agent.KFL
- Agent.UTA
- Downloader.Agent.BFD
Show More
- Downloader.Agent.BTW
- Gamehack.GACI
- Gamehack.GAIF
- Gamehack.GAIG
- Kryptik.KBBI
- Stealer.GTA
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 鯺ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
44 additional items are not displayed above. |
| Anti Debug |
|
| Process Terminate |
|
| Keyboard Access |
|
