Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.GTA

PUP.Gamehack.GTA

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Gamehack.GTA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take prompt action to remove it and prevent future infections.

What Is PUP.Gamehack.GTA?

PUP.Gamehack.GTA is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems with your computer's performance, stability, and security. They often sneak onto your system through bundled software downloads, infected websites, or suspicious email attachments.

How PUP.Gamehack.GTA Operates

PUPs like PUP.Gamehack.GTA can operate in various ways, including displaying unwanted advertisements, collecting user data, and modifying system settings. They may also install additional software or plugins without your permission, which can further compromise your system's security. In some cases, PUPs can even create backdoors for more severe malware infections, making it essential to remove them as soon as possible.

Symptoms of Infection

The symptoms of a PUP.Gamehack.GTA infection can vary, but common signs include slower system performance, increased pop-up ads, and unfamiliar programs or toolbars installed on your browser. You may also notice that your system is more prone to crashes or freezes, or that your browser is being redirected to suspicious websites. If you suspect that your system is infected with PUP.Gamehack.GTA, it is crucial to take immediate action to remove the threat and prevent further damage.

How to Remove PUP.Gamehack.GTA

  1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow for a more straightforward removal process.
  2. Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all components of the PUP.
  3. Uninstall any suspicious programs or applications that may be related to the PUP, using the Add/Remove Programs feature in your system's Control Panel.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted plugins or extensions.
  5. Reboot your system and perform a follow-up scan to ensure that all components of the PUP have been removed and that your system is clean.

Conclusion

Removing PUP.Gamehack.GTA from your system requires a combination of technical knowledge and caution. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove this potentially unwanted program and prevent future infections. It is also essential to practice safe computing habits, such as avoiding suspicious downloads and email attachments, to minimize the risk of PUP infections. Remember to always keep your operating system, browser, and security software up to date to ensure the best possible protection against emerging threats.

Analysis Report

General information

Family Name: PUP.Gamehack.GTA
Signature status: No Signature

Known Samples

MD5: 9ac1b0efa125c09b76d6fbcf86bef1ae
SHA1: 4716a54dbea241588416662f2fb27f1a3c609de2
SHA256: C34BBDE07229E771118D483E46FF0112A12BF6FF7B49E77E3AB207ACBE3EC683
File Size: 439.81 KB, 439808 bytes
MD5: 42f61e3baf2512fb9ac635ba672939b9
SHA1: 47bf0b0799ea587d52d308db8975c98872d58259
SHA256: 1B599337E01F7D7E09815A657917AD8FAE988AB7DAFAAC699E73870E39D1A6C9
File Size: 436.74 KB, 436736 bytes
MD5: c8b09fbbd6a272afcc395f4523240162
SHA1: ff4d1fa28f01d01d47cae793457826b915cae540
SHA256: FDD9E1BB6E2BC386D06B39596AD1BD606C32D6B17A1296F010D76A34AC601873
File Size: 442.37 KB, 442368 bytes
MD5: 5b9d50320baf4c43a6a5f535556f70b5
SHA1: 5b002ca6436f04a9c3057c2a6733ca313c8d0fbb
SHA256: A8ED6BCE3028FFDA2DE07330E46178C0D278CF40CAF678B2859914E166B5E837
File Size: 432.13 KB, 432128 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have security information
  • File has exports table
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • HighEntropy
  • VirtualQueryEx
  • x86

Block Information

Total Blocks: 1,509
Potentially Malicious Blocks: 71
Whitelisted Blocks: 1,262
Unknown Blocks: 176

Visual Map

0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? x x ? x x x x x x 0 0 x 0 ? ? x 0 x x x x 0 0 x x ? ? ? ? 0 ? ? x ? ? x x ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? x ? ? ? x ? x ? ? ? ? ? ? ? ? ? ? x ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? 0 ? ? ? ? x x x x ? x x x ? ? ? x ? ? ? x x ? ? ? 0 ? x ? ? x 0 0 ? ? 0 x ? ? ? ? ? ? x ? ? x x ? 0 ? x x ? ? ? ? ? x ? ? 0 ? ? ? ? ? ? x ? ? ? x ? ? ? ? ? x ? ? ? ? ? ? x ? 0 ? ? ? 0 0 ? ? ? 0 ? ? x x ? ? ? ? 0 x x x x x ? ? ? ? ? ? ? ? ? ? 0 0 ? x ? ? x ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 x ? ? x x x 0 x x 0 ? x x x ? 0 2 0 1 1 0 0 0 0 0 1 2 3 1 1 0 1 0 0 2 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x ? 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 2 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 3 1 1 1 1 0 1 0 0 0 0 0 0 1 0 0 0 0 2 0 2 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 2 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 1 0 0 0 0 2 2 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 2 2 0 0 1 0 0 1 0 0 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtProtectVirtualMemory
Show More
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • win32u.dll!NtUserGetKeyboardLayout
  • win32u.dll!NtUserGetThreadState
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\4716a54dbea241588416662f2fb27f1a3c609de2_0000439808.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\47bf0b0799ea587d52d308db8975c98872d58259_0000436736.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ff4d1fa28f01d01d47cae793457826b915cae540_0000442368.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\5b002ca6436f04a9c3057c2a6733ca313c8d0fbb_0000432128.,LiQMAxHB

Related Posts

Trending

Most Viewed

Loading...