PUP.GameHack.GL
Table of Contents
Analysis Report
General information
| Family Name: | PUP.GameHack.GL |
|---|---|
| Signature status: | Root Not Trusted |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0bb0c0beaf06aa5b1f093ec8cd0666de
SHA1:
64c64d7d68fa18fb41e7a4d4e50a8eb1fa698162
File Size:
467.97 KB, 467968 bytes
|
|
MD5:
f9192da8c5c46b87b3a8364a2498f5a3
SHA1:
4a70d4d46237a37335b4d470e09dd8c7abbfcb68
File Size:
365.09 KB, 365088 bytes
|
|
MD5:
735e962c5c09e2a1ab6f43fadd1cf7ba
SHA1:
82e9c4c7788afaadb41750327ada1b3a951b9b10
SHA256:
7403366A72C514986246F454DB1BCFDF4858401896B7EE0B82D6D24E43BE9FAF
File Size:
455.68 KB, 455680 bytes
|
|
MD5:
bf12f4bb93bff1f5b805e033d2104f35
SHA1:
c11b0b1d6b91b60ba1be72d4f40d04da63f40a85
SHA256:
3254A6A9A9FBEC7BDFE0FEAF04BC5941A4A2C7B0987B57667428093DD8454C09
File Size:
494.08 KB, 494080 bytes
|
|
MD5:
69731aaefc64345bc18eff5ef3e238a3
SHA1:
3a5557844e0638f76aea7aabbbedc03366dc83c7
SHA256:
50455F3643B5349C8430DE23BEF1578CDDB460E5E2A8B2976286B5063D93A94C
File Size:
469.50 KB, 469504 bytes
|
Show More
|
MD5:
e1cf504f4e68a6dd2856b77a090e41c8
SHA1:
cd3c0cb6944f842122d61e31fc71fc2a425821fc
SHA256:
B4BAC6889E0822DF2E138EABA89C182BE719F0C6A3FEDA8392EF6E268C29DF0D
File Size:
1.07 MB, 1074176 bytes
|
|
MD5:
3eeca123adca108288b41c84cbb1c13b
SHA1:
f3d464ee782ca8a6d8a516dcbd4cc3cd89c07875
SHA256:
0567C62493D9E3E454F0EDCEE4A10923C5C4C4F3603F08B403F05D68E53D8244
File Size:
803.84 KB, 803840 bytes
|
|
MD5:
07a8531fd0188f105e6488195f4f2cc7
SHA1:
0f9d53aa1fa744a2c382ed8c563222c5b8d749ad
SHA256:
C8E635BCC658AE999282BA8C8E858F85A6965D9F7D47B314127AF42CABBF2A0F
File Size:
1.03 MB, 1031752 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Digital Signatures
Digital Signatures
This section lists digital signatures that are attached to samples within this family. When analyzing and verifying digital signatures, it is important to confirm that the signature’s root authority is a well-known and trustworthy entity and that the status of the signature is good. Malware is often signed with non-trustworthy “Self Signed” digital signatures (which can be easily created by a malware author with no verification). Malware may also be signed by legitimate signatures that have an invalid status, and by signatures from questionable root authorities with fake or misleading “Signer” names.| Signer | Root | Status |
|---|---|---|
| NVIDIA Corporation | VeriSign Class 3 Code Signing 2010 CA | Self Signed |
| NVIDIA Corporation | VeriSign Class 3 Public Primary Certification Authority - G5 | Root Not Trusted |
File Traits
- dll
- HighEntropy
- imgui
- No Version Info
- ntdll
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,411 |
|---|---|
| Potentially Malicious Blocks: | 162 |
| Whitelisted Blocks: | 1,821 |
| Unknown Blocks: | 428 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
x
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
?
0
?
?
0
?
0
?
?
0
0
0
0
0
?
?
?
?
?
0
?
?
0
?
?
0
?
0
0
?
?
?
0
?
0
?
?
?
?
?
?
?
?
0
?
?
?
?
0
?
?
0
?
?
?
0
?
?
?
0
?
?
0
?
?
?
?
?
?
?
?
?
0
0
?
?
?
0
0
0
0
1
0
0
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
0
0
0
0
?
0
0
0
?
?
0
0
0
0
x
?
?
?
?
?
?
0
?
?
0
?
x
?
?
?
0
0
0
?
?
?
?
?
?
0
0
?
?
0
?
?
?
?
?
?
?
0
?
0
0
0
?
?
?
x
?
0
?
0
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
1
?
?
0
?
0
?
0
?
0
?
?
?
0
0
?
?
?
0
0
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
0
?
0
?
?
0
?
?
?
?
0
?
?
?
0
?
?
?
0
?
?
?
?
?
0
?
?
?
0
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
0
?
?
?
0
?
?
?
0
0
0
?
0
0
?
0
0
0
0
0
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
0
x
0
x
0
x
?
x
0
?
x
0
?
x
0
?
x
0
?
x
0
?
?
?
?
0
?
0
?
?
0
0
?
0
?
?
0
?
?
?
?
0
?
?
0
?
?
0
0
0
?
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
?
?
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
?
?
0
0
0
0
?
?
0
0
0
0
0
?
0
0
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
x
0
0
x
0
1
0
0
0
0
0
0
0
0
0
x
?
0
0
0
0
0
?
0
0
x
0
0
0
?
0
x
0
0
x
0
0
0
0
0
0
0
x
0
0
x
1
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
0
?
0
0
?
0
?
?
?
x
0
x
x
0
?
x
0
0
0
0
0
0
0
0
x
1
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
x
0
?
?
0
?
0
0
0
?
0
0
0
0
?
0
?
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
0
x
?
0
x
0
0
x
0
0
0
0
0
x
0
x
?
0
0
0
0
0
0
1
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
1
0
0
?
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
0
0
0
1
0
0
0
0
0
0
0
?
0
0
1
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
?
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
0
?
x
0
0
?
?
?
?
?
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
?
0
0
0
?
x
x
?
0
0
0
0
0
x
0
x
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
?
0
?
?
?
?
x
x
x
?
?
0
x
?
0
0
0
0
?
0
0
?
?
0
?
?
0
0
0
?
?
0
?
x
x
0
x
0
0
0
0
0
0
0
0
x
?
0
x
0
0
0
0
0
?
x
0
x
0
0
0
0
0
?
x
?
0
0
0
0
0
0
x
0
0
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
0
x
0
0
0
x
x
0
x
0
x
0
x
0
x
x
x
x
x
0
x
0
0
0
x
x
x
0
x
x
0
x
x
x
x
x
0
x
0
0
0
x
x
0
x
0
x
0
x
0
x
x
x
x
x
0
x
0
x
x
0
x
0
x
0
x
x
0
x
x
x
0
x
x
x
0
0
0
x
x
x
x
0
x
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
0
0
?
?
?
?
?
?
0
?
?
?
x
?
?
x
?
?
x
?
x
?
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
?
?
?
x
?
0
0
?
?
?
?
?
?
?
?
?
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 朙棝✂ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\explorer::slowcontextmenuentries | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\content::cacheprefix | RegNtPreCreateKey | |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\cookies::cacheprefix | Cookie: | RegNtPreCreateKey |
| HKCU\software\microsoft\windows\currentversion\internet settings\5.0\cache\history::cacheprefix | Visited: | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
75 additional items are not displayed above. |
| Anti Debug |
|
| Process Terminate |
|
| Process Shell Execute |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
open Minecraft://
|
