PUP.Gamehack.HDJ
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.HDJ |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
5e55d9bfbbcc88b1f28aef105f12db71
SHA1:
8dac4aef0475c4ab3e73df57adb0343c6b32b444
SHA256:
DF218F83A3F99C72D2C6CD94120D8BB521483404B12B7BA75B49152B81062808
File Size:
294.40 KB, 294400 bytes
|
|
MD5:
8db30ba98f899b8fd3667bb391a54c65
SHA1:
c1ef48161552afa76eefd550d721eacb460b93ce
SHA256:
443A7787EF39DE0E7AB6C1DDBFDB63C1D1EDFC3613E5D1B1EB54C675EF7A447A
File Size:
826.37 KB, 826368 bytes
|
|
MD5:
8cc7f594e6c0a646150987790e8655e5
SHA1:
312837c08ee46edd46185f7da54ea81cf94178e7
SHA256:
DCB6EB101693C5101C7382D90223DE2D66B2B484D977842848A73CC2F2577340
File Size:
325.63 KB, 325632 bytes
|
|
MD5:
3675de5539bde2257285652e6608ce21
SHA1:
455cc5fb2dffd4311d83aafed820f3c7ae72ac47
SHA256:
91F5A0DF66AAEFA43AEAB11ADA63FD785E232B48EED6DCBAE4C121CD3CCAEBEF
File Size:
299.01 KB, 299008 bytes
|
|
MD5:
5fd813e60c899c7b667d9e7ac12e9058
SHA1:
cc44879569ebf11610c0dedae4c6bc9ac2dee2da
SHA256:
AB15B34B0CE8E93C34A55C157650BD9968DE13DF5D45F8D18C1306AFE6EDDA34
File Size:
433.66 KB, 433664 bytes
|
Show More
|
MD5:
a108bff692c480773948ed76c2bf2417
SHA1:
2ea5b0d9f92921bf2d967c939d8df4c384ecb654
SHA256:
9FC38DFB2E0A95DA2B9C3AD72DEE6B526958A9E2589F28093DAD4644AE8EFDFC
File Size:
534.02 KB, 534016 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- dll
- HighEntropy
- imgui
- No Version Info
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 787 |
|---|---|
| Potentially Malicious Blocks: | 200 |
| Whitelisted Blocks: | 500 |
| Unknown Blocks: | 87 |
Visual Map
x
0
x
0
0
0
0
0
0
0
?
x
x
0
0
?
0
0
0
x
0
x
0
0
0
0
0
0
0
0
x
x
x
x
x
?
x
0
x
?
0
0
0
?
0
x
x
x
0
0
x
0
x
x
0
0
x
0
0
0
0
0
x
0
?
?
x
?
0
0
?
x
?
x
x
x
?
x
x
?
0
x
x
x
x
?
?
0
0
x
x
0
x
x
x
?
x
0
0
0
0
x
x
x
0
x
x
x
x
?
x
0
0
0
0
?
x
?
x
?
?
x
0
0
x
0
x
x
x
x
0
x
x
?
x
0
x
x
?
x
x
x
x
?
?
?
x
x
x
0
x
x
x
?
x
x
0
x
x
x
0
0
0
0
0
x
0
?
x
?
?
x
x
?
x
0
x
x
x
0
x
0
x
0
?
x
?
x
?
x
x
x
0
0
?
x
0
x
0
0
0
0
x
x
x
0
x
x
x
0
x
x
0
0
x
0
0
0
0
0
x
x
x
0
0
0
x
x
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
x
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
x
x
0
0
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
0
0
0
x
0
x
0
x
0
x
0
0
0
x
0
0
0
0
?
x
x
0
x
x
x
0
0
x
0
x
?
x
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
x
0
0
0
0
0
0
0
0
x
x
x
0
0
x
0
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
?
x
x
0
x
0
0
x
0
x
x
x
0
x
0
0
x
x
x
?
0
?
0
0
x
0
x
?
0
0
x
?
0
0
0
?
0
0
0
0
x
0
0
x
x
0
0
0
x
x
x
x
?
x
0
?
?
0
?
x
0
0
0
?
?
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
?
?
?
x
0
x
x
x
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
0
0
x
0
0
x
?
0
?
?
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
x
0
?
0
?
?
0
0
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
2
0
0
0
0
0
1
0
0
0
0
0
0
0
1
1
0
1
1
0
0
1
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\downloads\imgui.ini | Generic Write,Read Attributes |
| c:\windows\syswow64\tygerframework.ini | Generic Write,Read Attributes |
| c:\windows\syswow64\tygerframeworklog.txt | Generic Write,Read Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 䛬囖ǜ | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\conhost.exe | 搥瑭큎ǜ | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
| Keyboard Access |
|
| Syscall Use |
Show More
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c1ef48161552afa76eefd550d721eacb460b93ce_0000826368.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\312837c08ee46edd46185f7da54ea81cf94178e7_0000325632.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\2ea5b0d9f92921bf2d967c939d8df4c384ecb654_0000534016.,LiQMAxHB
|
