Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.GHG

PUP.Gamehack.GHG

By CagedTech in Potentially Unwanted Programs

Analysis Report

General information

Family Name: PUP.Gamehack.GHG
Signature status: No Signature

Known Samples

MD5: 560cffebee96d61032ce07a0d6741982
SHA1: fb434121fe4e7e8758bc384d4deb22f5af3544a6
SHA256: 82B1230429BA9D7D4254B43F5959C87766530DD0918E8698788BE0EF6C6BBBB6
File Size: 1.34 MB, 1337856 bytes
MD5: 3c7ace39f20b20a343373f4753ebe406
SHA1: dabd2826eb7cafa19b8bc596f004ba7e4020c15f
SHA256: 474CAA41EE2F23DFC283CE86A9BD0A4BF0DE9F5A5F79052BF6029E46AEAA976C
File Size: 983.55 KB, 983552 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 32-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • fptable
  • HighEntropy
  • imgui
  • x86

Block Information

Total Blocks: 4,707
Potentially Malicious Blocks: 215
Whitelisted Blocks: 3,544
Unknown Blocks: 948

Visual Map

? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 x 0 x x x x x x x x 0 0 0 0 x x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 1 0 x x 0 ? 0 ? 0 0 0 0 x 0 0 0 ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x x 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 x ? x ? 0 ? 0 x ? 0 ? 0 0 ? ? 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 ? 0 0 0 0 0 x 0 x 0 0 x 0 0 1 x 0 0 0 0 0 x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 x 0 ? 0 0 0 0 x ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 x x 0 ? ? x 0 0 0 0 0 0 0 x x x 0 ? 0 ? ? ? ? 0 ? x x x x x x ? ? ? ? ? ? ? ? ? ? 0 0 0 ? x x x 0 0 0 x ? ? ? ? ? 0 ? 0 x x x 0 ? 0 0 0 0 x x x ? 0 0 0 0 0 x 0 0 0 ? 0 0 x 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 ? ? ? 0 0 0 0 ? ? 0 0 0 x x x x x ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 0 ? ? 0 0 x ? 0 0 ? 0 ? ? ? ? ? ? 0 0 ? 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 ? 0 0 ? ? 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 x x x 0 0 x 0 0 0 0 0 0 0 0 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 ? 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 ? 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 ? ? 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? ? ? ? 0 0 ? 0 ? ? 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? 0 ? ? 0 0 0 0 x 0 0 0 0 0 0 x 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? 0 0 0 ? 0 0 0 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 ? ? ? ? ? ? ? 0 0 0 0 x 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 ? 0 0 ? ? ? 0 ? ? 0 ? ? 0 0 0 0 x 0 0 0 0 0 0 ? 0 ? 0 ? ? ? 0 0 0 x 0 0 0 0 0 0 0 0 0 ? 0 ? ? 0 0 0 0 0 ? ? ? ? 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 0 ? ? ? ? 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 ? 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 1 0 0 ? 0 ? 0 ? ? 0 x 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 ? ? 0 0 0 0 0 0 0 x 0 0 0 ? ? 0 ? ? 0 0 ? 0 ? 0 0 0 0 ? 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 ? 0 ? 0 ? ? 0 0 ? 0 ? ? 0 ? 0 x ? ? 0 0 0 0 x 0 0 0 ? 0 0 x 0 ? ? x 0 0 ? ? ? x 0 0 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 ? 0 x 0 x 0 0 ? ? ? ? ? ? x 0 0 ? 0 0 0 0 0 0 0 0 0 x ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 x ? ? 0 0 0 0 ? ? ? 0 0 0 0 ? 0 ? x ? ? ? ? ? 0 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? x x 0 ? 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 ? 0 0 ? 0 0 0 0 0 0 ? ? ? ? ? ? ? 0 0 ? x 0 ? ? 0 x x x x 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? 0 0 0 0 ? ? 0 ? ? ? ? 0 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 ? ? ? 0 ? ? ? 0 0 0 0 0 ? ? 0 0 0 0 0 0 ? 0 ? ? ? ? 0 ? ? ? ? ? 0 0 ? ? ? ? ? 0 0 ? 0 ? ? x 0 ? 0 ? x 0 0 0 0 0 0 0 x 0 ? 0 ? ? 0 ? 0 ? 0 x 0 0 0 ? 0 0 ? 0 ? ? ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? 0 0 ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? x ? ? ? ? 0 0 0 ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 x x 0 0 x x x x 0 0 ? ? 0 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 ? ? ? ? ? ? 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 ? 0 ? ? ? 0 ? 0 ? 0 0 0 ? ? ? ? ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? ? ? ? ? 0 0 0 x ? 0 ? ? ? ? ? ? ? ? ? x 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 ? ? ? ? ? ?
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fb434121fe4e7e8758bc384d4deb22f5af3544a6_0001337856.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\dabd2826eb7cafa19b8bc596f004ba7e4020c15f_0000983552.,LiQMAxHB

Trending

Most Viewed

Loading...