PUP.Gamehack.GDA

The detection of PUP.Gamehack.GDA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it to prevent any potential harm.

What Is PUP.Gamehack.GDA?

PUP.Gamehack.GDA is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as malicious as other types of malware, it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally by users, usually through bundled software downloads or by clicking on suspicious links.

How PUP.Gamehack.GDA Operates

PUP.Gamehack.GDA, like other PUPs, operates by installing itself on your system without your knowledge or consent. Once installed, it can start to collect your personal data, such as browsing history and search queries, and use it for malicious purposes. It may also display unwanted advertisements, slow down your system, and cause other issues. PUPs can be difficult to detect, as they often disguise themselves as legitimate programs or system files.

Symptoms of Infection

If your system is infected with PUP.Gamehack.GDA, you may notice several symptoms. These can include slow system performance, unwanted advertisements and pop-ups, and suspicious programs or icons on your desktop. You may also notice that your browser settings have been changed, or that your search results are being redirected to suspicious websites. Additionally, you may experience issues with your system's stability, such as crashes or freezes.

• Unwanted advertisements and pop-ups
• Suspicious programs or icons on your desktop
• Changed browser settings
• Redirected search results
• Slow system performance
• System crashes or freezes

How to Remove PUP.Gamehack.GDA

1. Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.Gamehack.GDA.
3. Uninstall any suspicious programs that may be related to the malware. Be cautious when uninstalling programs, as some may be legitimate.
4. Reset your browser settings to their default values. This can be done in the browser's settings menu, and will remove any changes made by the malware. Specifically, reset Chrome, Firefox, and Edge to their default settings.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that the malware has been completely removed.

Conclusion

Removing PUP.Gamehack.GDA from your system is crucial to prevent any potential harm. By following the steps outlined above, you can ensure that your system is clean and secure. It is also essential to be cautious when downloading software and clicking on links to prevent similar infections in the future. Regularly scanning your system with anti-malware tools and keeping your operating system and software up to date can also help to prevent PUPs and other types of malware from infecting your system.

Analysis Report

General information

Family Name:	PUP.Gamehack.GDA
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: f94e136f88de70216d9dc1749c9b77fc SHA1: 6c66b1947747f1ef1622c63210cca36ac1365923 SHA256: 8EE797DCD653868CEDB812FED271666691CF261642B73D3DD3EA4C11EFD3C657 File Size: 22.53 KB, 22528 bytes

MD5: 9f6901744d044ce7bc5df7eace6b18d4 SHA1: 62c78ab21f0067421af5e2762fa82c999dd1114d SHA256: 2799B421F8FC354FF337530A7E1A158BFEF90A82BECC9A5D055095E56DF72255 File Size: 32.26 KB, 32256 bytes

MD5: bf3209a7a8a4ff233f825af46c6d687b SHA1: 56a04000077cc4f522dd331241dcb16fca7b089c SHA256: 6F8B778A8D06CDBE2B0A2BCB5D4A0BAAB980EF752517D6E03834CD6EDCE82F06 File Size: 53.76 KB, 53760 bytes

MD5: 8819741ed093c23bcb973d94702c0806 SHA1: 802becaf65de848355f6e77dc623f6fd5233bb76 SHA256: 5E19EACBA99C53576F7944C8AAA9A19CE883929A082DAD23052B721C40A460C2 File Size: 44.54 KB, 44544 bytes

MD5: d6d0524c5a6286ae1fcde919913aa67a SHA1: 4e28445b14ce462683575d872fce6dcf61b585d0 SHA256: 77EC65DED9200A68DA3E8E7680D5FB881043AC41D37F90E0A977C3E9DB831F11 File Size: 43.01 KB, 43008 bytes

Show More

MD5: a2e361f9d612d798f2e4f810382344d2 SHA1: 711b10a64f34a9a8429891da53244bbaee650cee SHA256: BBEF9E03EACB02108D2B578E8F29F70C5D6E993E2F543C64462B2816F78384B6 File Size: 109.06 KB, 109056 bytes

MD5: 00b3026ef14aacc928ed5b6421967b3b SHA1: 84b8f9ff68e1662aa8a022bb7d0bfede232d2435 SHA256: D1CC0C51666888A9371A46EB938A3D484D25DCCE581E36FC26156476E3243FD1 File Size: 36.86 KB, 36864 bytes

MD5: 21fcf9ba73a22c8ef3a6eef03761300f SHA1: 0cc9bb2c622cdb3358e073eba0b07aa035f4f3ba SHA256: BB3C44873678463BDC587F054302A439F67AD2BB9D07AEF4D993FD64AA6A1003 File Size: 5.56 MB, 5556736 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have resources
• File doesn't have security information
• File has been packed
• File has TLS information
• File is 32-bit executable
• File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)

Show More

• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup.
Company Name	Jared Breland
File Description	Package for Universal Extractor
File Version	1.6.1
Legal Copyright	GNU General Public License v2
Product Name	Universal Extractor
Product Version	1.6.1

File Traits

• 2+ executable sections
• No Version Info
• packed
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• Gamehack.GDA
• Stealer.FDC

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\_isetup\_setup64.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-adj07.tmp\_isetup\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-adj07.tmp\arabic.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\bulgarian.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\chinese (simplified).ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\chinese (traditional).ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\croatian.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\dutch.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\english.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\french.ini	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\is-adj07.tmp\german.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\hungarian.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\italian.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\japanese.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\korean.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\polish.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\portuguese (brazilian).ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\portuguese.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\romanian.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\russian.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\slovak.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\spanish.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\taiwanese.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\thai.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\turkish.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-adj07.tmp\valencian (catalan).ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\is-ud1fl.tmp\0cc9bb2c622cdb3358e073eba0b07aa035f4f3ba_0005556736.tmp	Generic Write,Read Attributes

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::name	84b8f9ff68e1662aa8a022bb7d0bfede232d2435_0000036864	RegNtPreCreateKey
HKLM\software\wow6432node\microsoft\directdraw\mostrecentapplication::id	ﹳ䩻	RegNtPreCreateKey
HKCU\software\microsoft\windows nt\currentversion\appcompatflags\layers::c:\users\user\downloads\84b8f9ff68e1662aa8a022bb7d0bfede232d2435_0000036864	DWM8And16BitMitigation	RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Lwpggdso\AppData\Local\Temp\is-UD1FL.tmp\0cc9bb2c622cdb3358e073eba0b07aa035f4f3ba_0005556736.tmp" /SL5="$D0334,5065856,141824,c:\users\user\downloads\0cc9bb2c622cdb3358e073eba0b07aa035f4f3ba_0005556736"