PUP.Gamehack.GDDB
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.GDDB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
c392cbc81fe24e095dcdbf7f81706dd4
SHA1:
927c83e73508c700f452c7ca329d2b7e81c04705
SHA256:
388854547E1CFC6F5914D9357D1872281A59D3BCE5E619526F1E15C950AFC3F3
File Size:
339.97 KB, 339968 bytes
|
|
MD5:
60760d2fd3369908429144fe75d47a5a
SHA1:
505b3364fb68be70142ac8cae9f3bf1587c7526a
SHA256:
D3ECBF62A8E8B0A74ADFA79AF692B580BEA043A817E66B3D2BA15D493CBAE6B7
File Size:
286.21 KB, 286208 bytes
|
|
MD5:
3dceff17961128f90abda30db34d0b63
SHA1:
a0bfdd566e504da7e1a95e2687978eebf71215d8
SHA256:
4DAF61C2533626F83794EC43CD0CA5821BD781DFB0EAFF0E14741978AE9380EB
File Size:
5.83 MB, 5826560 bytes
|
|
MD5:
835406943c567bafc79f95f2656f0277
SHA1:
e7b875b86d7e9066618bb31bf306eec1e4a90c9e
SHA256:
91D72F834A875A422B9FE997179F7E3FF791978467AD33C2EF0ADC32B4EC348C
File Size:
296.96 KB, 296960 bytes
|
|
MD5:
0af17eb022df6be90ef84c615a2799ff
SHA1:
15effa38954b42d5faa843013b3b34403ef841f3
SHA256:
CBA797CBE470273FF1FFE2F400A67C992EBAE799914B8ECA4FF2A23638A7DBC5
File Size:
365.57 KB, 365568 bytes
|
Show More
|
MD5:
b3c9ee89d33b62557094b325bedb1d7e
SHA1:
c97a9170c97d9ac795d3056b358ed6b63eb8dad0
SHA256:
56175EAB59E3914914C1F7B89710FA94C7D46B7CA85DA3114B29C8B059167BC9
File Size:
477.70 KB, 477696 bytes
|
|
MD5:
40c002df775309f2a187c8ef915af7d9
SHA1:
350f904cd0920da7f16b574844152e7c5802eb36
SHA256:
0D01FE52DA708E45F4DC773C4506FC72E6079DD99F474ED49466858D6BC11A9F
File Size:
751.10 KB, 751104 bytes
|
|
MD5:
db2686bc8d000c2a41379f94bbe416c2
SHA1:
1305369393aad8ae1460c8bcc25e7df7195054a6
SHA256:
B1BF44CEC390AADCFC0F5A7D2840112E9BEF516F1ECFD18D4F9BDFEE4421A3EE
File Size:
3.08 MB, 3079168 bytes
|
|
MD5:
399427a62bbf22566f0571359a25f9db
SHA1:
3d64e7bbbe1248bdc8a2be22db2e6a7e2743cadf
SHA256:
4266527141AD1E7420B87983E7F87964E0678E2DADD7CEADB2B23DFEF6A9EE4B
File Size:
515.07 KB, 515072 bytes
|
|
MD5:
17c03a8ecd3b6caefe787b641626fe9b
SHA1:
efb3a1ac46ef6f50fa71b71b523e60f17ce683c3
SHA256:
CAD1368FA623E14E74D594379C55621A0D64B125AD7B9DEBAC54F87085DE607C
File Size:
1.84 MB, 1840640 bytes
|
|
MD5:
b8b78a542192170861881e35b4d29ec0
SHA1:
136cc6740eddc01553f4fe67c26a059436bca14b
SHA256:
26391EE6494E6BBF1E0F0155DBD8693A472503265CCF00E721265C3451CAF33D
File Size:
529.92 KB, 529920 bytes
|
|
MD5:
800f7b61ba7baa6fbbaf96137be56229
SHA1:
f6523d357f599973e9efa67dfc136ed5e6e2d795
SHA256:
3EC7B3377983FEDE41CCDC17B5F6B87E97AC4737AA928B7BD16A022D6FC8FDEC
File Size:
1.21 MB, 1208320 bytes
|
|
MD5:
37dd18af5c0a29eb37165eb740c4f515
SHA1:
697ec221ca7e6fec0efce6fa2133a2bf98d3f231
SHA256:
2C5690CCA9BB27E8990752EA7E1D01E381854B4162A37CCBFBB2C0AAFEE3AD6A
File Size:
8.48 MB, 8480768 bytes
|
|
MD5:
a12aeca651b3c644b315693c64b44e42
SHA1:
31395a10fb4d90ce094255b3209aca86d4cabc0c
SHA256:
167C0BF3303C306A749BB92258519468C6397487CEA66419A203DDC7737346F9
File Size:
5.97 MB, 5970432 bytes
|
|
MD5:
1ade6137521c11846ef395028580e34c
SHA1:
4484319cb751f127e1eaa11732d81cfb71a194b3
SHA256:
BAF375C40E88FB6C7F4E8C2038FBD03D13AD34A4CD63FE43974C5E65780D2089
File Size:
5.80 MB, 5803008 bytes
|
|
MD5:
3709ba53b9a6e57ea0f0431dd2adf0f7
SHA1:
9cbbedcb1746d2f5a663517b8101788e7047cf5b
SHA256:
23101E2B7708777F55D0D61C242139C8DA75119D1F5AC4CA36A2C3737A234054
File Size:
458.24 KB, 458240 bytes
|
|
MD5:
fba46ddfc1db953a0591521314ab943b
SHA1:
d2d613f31ac5c05ac7876edaa44c50c49cb6ac32
SHA256:
3F55FE80F50C14EB9064C8A44A52631B82006A78D31D4DB5F56793A0BCFE10E5
File Size:
5.86 MB, 5856256 bytes
|
|
MD5:
a012b7d27cc513b0c07fd4b65eef1218
SHA1:
b34c647d13fb68b909c2decba8dad5d0960e7377
SHA256:
D5F46B26523DBEC798EC6B0BB995FB55BC35831250B9D88129C432EB24BF59C9
File Size:
5.71 MB, 5708288 bytes
|
|
MD5:
23cc4bc8e67f46afa8f1b1f6dd9d02ec
SHA1:
fe793f42267073ebf145d5ea90fdc71f8f552472
SHA256:
35BEED5CFE7DE3D326C67DB421F57B60162FEFF6B9314A7F1CFFF265E31965F4
File Size:
2.48 MB, 2477056 bytes
|
|
MD5:
4ff595ed7960b3d3a3e5c3226b389dca
SHA1:
e6034bd7cce10a849b978707da56398ab70572ee
SHA256:
DA22E230D961BCB467F57FC9441D6504DA0394AB38D78A5E6314712A178C7786
File Size:
5.39 MB, 5387359 bytes
|
|
MD5:
def9a65b589866f902f45a73024bdb60
SHA1:
2ed27a8151b43e930c2e9276e2a208b25c966940
SHA256:
67113835988DC87368E64D24F5BFA19D3E366268E11027EF5AF97E3E10496A03
File Size:
7.35 MB, 7351808 bytes
|
|
MD5:
5176f8d7177da071be13181885a61ffc
SHA1:
ee236ebcb8d6a0033e48f5255fc7fbb7b082c148
SHA256:
0837D423009A8A304EA8A3D04A8EE960AD38DBEAF2086C44313C63E3165C9C74
File Size:
6.03 MB, 6025728 bytes
|
|
MD5:
7e6224e187047bcea8920a60d24c6ecf
SHA1:
b8172f28bb521d0ebed5e14929323e90771a428b
SHA256:
00FB1D727D76C23252D09A2DA57992A1C77BF3715FAA3D5089EBB1344D4EB822
File Size:
286.21 KB, 286208 bytes
|
|
MD5:
0c534b1d0e58ab5975d454365dfb2ddf
SHA1:
a739e5220052917efcc4801ba48b8a1e21c1966a
SHA256:
09D0200E0299304136E763CD2F37492E48D3E0A81383A38E378735F1395E8E62
File Size:
5.24 MB, 5241856 bytes
|
|
MD5:
31a07e1f4f175277aacbfa6fe8ca92a0
SHA1:
7de3ab51a5059b9a8d3d332e5fe9d53507e14864
SHA256:
49D6A48F998CBD49D58435585A2875DF28E1A6FACBEE6F4CACE3FACB9A10B07E
File Size:
425.98 KB, 425984 bytes
|
|
MD5:
7a7e27f6b91a04991d75432a01264e87
SHA1:
58a4fec5216a3153f11224e99cff3e542cddbfdf
SHA256:
D9DAD23B1A2E51E6C32F450E5BAE6853AA982FAEA31237B12E60E58EC9CB20C0
File Size:
503.30 KB, 503296 bytes
|
|
MD5:
8947255941fe03aa8785973633fbd876
SHA1:
e9b296c7e97867bc994ec7317d3fc4f587c53055
SHA256:
691086E93E7D4E7654C98C2D2BD7C337D0E30FF66D3A04C27540B7C57381037E
File Size:
1.21 MB, 1209856 bytes
|
|
MD5:
32303870cd187518ac03a4df5b19f0cb
SHA1:
a915e5faf31eca824f44671d369e8e9eab7745a1
SHA256:
50AC39D1FC7AC0453180B2CF69C5C3FEF8542302BC1F64FA13F76021A127DAEB
File Size:
1.37 MB, 1371136 bytes
|
|
MD5:
70be1879343c11ddacbc5498d190d52a
SHA1:
9afbc3c5e32de5d7f2fb70a1f5b13e7d0fdde445
SHA256:
2582BAC85D3AC0F91E4D65F33B2E2233F8B8024C375F83B4AF6FFFF388978CF7
File Size:
4.52 MB, 4518400 bytes
|
|
MD5:
73524d4f4e54fe0bb31c23b7c39cf056
SHA1:
bdebc7f098bdc545ab7ea015b6edcd03c5fb9332
SHA256:
A41FB1705F5AA17741ED901CC2F98435567F1E7B5E85A7976EF220C9D65F963A
File Size:
478.21 KB, 478208 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has exports table
- File has TLS information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
Show More
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments | @dimenordev |
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Legal Copyright |
|
| Legal Trademarks |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- 2+ executable sections
- dll
- GetConsoleWindow
- HighEntropy
- imgui
- No Version Info
- ntdll
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,521 |
|---|---|
| Potentially Malicious Blocks: | 124 |
| Whitelisted Blocks: | 1,351 |
| Unknown Blocks: | 46 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
x
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
0
x
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
x
x
0
0
0
x
x
?
0
0
0
0
0
0
?
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
x
x
0
0
0
x
0
0
0
?
0
?
0
0
0
0
0
0
0
0
0
0
x
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
?
?
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
1
0
0
1
x
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
0
0
0
x
x
0
0
0
0
0
?
0
0
0
0
0
0
0
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
1
x
x
0
x
0
0
1
x
?
0
0
x
0
x
?
0
?
?
0
0
0
?
?
0
x
x
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
?
?
?
0
0
?
?
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
?
?
0
?
?
?
?
?
?
?
?
0
?
?
0
0
0
0
0
0
0
0
0
x
x
0
?
0
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
?
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
1
0
0
0
0
1
0
0
x
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
x
x
x
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
x
0
0
0
1
1
1
1
1
1
0
0
x
0
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
x
0
x
x
0
x
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
2
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.KFP
- Downloader.Agent.BTW
- Gamehack.GACH
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | ﻔ崥䨭ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\cmd.exe | ࡿ髫ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
123 additional items are not displayed above. |
| Anti Debug |
|
| Process Terminate |
|
| User Data Access |
|
| Encryption Used |
|
| Other Suspicious |
|
| Process Manipulation Evasion |
|
| Network Wininet |
|
