PUP.GameHack.Gen.BG
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 1 |
| First Seen: | October 1, 2026 |
| Last Seen: | October 11, 2026 |
| OS(es) Affected: | Windows |
PUP.GameHack.Gen.BG is a detection name used to identify a potentially unwanted program (PUP) that targets Windows systems. While it is not classified as highly dangerous, its presence on a computer is still considered undesirable because it is typically installed without a user's full knowledge or clear consent, and it may introduce unwanted changes or behaviors to the affected system.
Table of Contents
What PUP.GameHack.Gen.BG Does
As its name suggests, PUP.GameHack.Gen.BG is associated with game-hacking or game-modification tools — applications that claim to alter or enhance video game functionality, such as unlocking features, providing in-game advantages, or bypassing normal game restrictions. Programs in this category are often built as 64-bit Windows GUI applications and may use low-level system functions to interact with memory and files on the machine. This type of behavior is typical of PUPs that attempt to manipulate running processes or monitor system activity, which can raise security and privacy concerns even when the program does not perform overtly destructive actions.
Like many PUPs, this detection may be bundled with other unwanted behaviors common to this category, including the display of unwanted advertisements, installation of additional browser components, or changes to default system settings. Because the specific payload can vary between samples, users should not assume the program is limited only to game-hacking functionality.
How It Usually Gets Onto Computers
PUPs like PUP.GameHack.Gen.BG commonly spread through software bundling, where the unwanted program is packaged alongside free downloads, game modification tools, cracks, cheat engines, or other third-party utilities. Users may inadvertently install it by rushing through installation wizards, accepting default settings, or downloading software from unofficial or untrusted sources such as file-sharing sites and forums dedicated to game hacking. In many cases, the user may have technically agreed to the installation by clicking through an end-user license agreement without fully reading it.
Risks for the User
Although this threat carries a low danger rating, it can still pose risks. Programs of this type often lack proper digital signatures, meaning their origin and integrity cannot be verified. This absence of a trusted signature makes it difficult for users to confirm whether the software is safe or has been tampered with. Additionally, because such tools frequently interact with system memory and processes, they can sometimes conflict with other software, cause instability, or be exploited as a vector for more harmful code if the download source is compromised.
Signs of Infection
Users may notice unexpected new programs or files appearing on their system, unusual network activity, or unfamiliar processes running in the background. Some PUPs in this category may cause game clients or antivirus software to flag files as suspicious, generate pop-up warnings, or trigger changes in system performance without a clear explanation.
How to Stay Protected
To avoid PUPs like this one, users should download software only from official and reputable sources, carefully review installation prompts, and opt out of bundled offers whenever possible. Avoiding game cheats, cracks, and unofficial modification tools significantly reduces exposure to this type of unwanted software. Keeping security software updated and performing regular system scans can also help detect and remove such programs before they cause further issues.
Analysis Report
General information
| Family Name: | PUP.GameHack.Gen.BG |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
a9ee6ff41d77946fbbaa8c44bc649c7a
SHA1:
a1a5530445acde49a0ab7ed871abf140498af607
SHA256:
6E15EFB2B3485952C6F56B213915C5A023088778A9EF39B9B4ABEB296A41B0A6
File Size:
2.95 MB, 2950144 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- imgui
- No Version Info
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 113 |
|---|---|
| Potentially Malicious Blocks: | 2 |
| Whitelisted Blocks: | 111 |
| Unknown Blocks: | 0 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
|
