PUP.GameHack.J

The detection of PUP.GameHack.J on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it to prevent further damage.

What Is PUP.GameHack.J?

PUP.GameHack.J is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as harmful as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally by users, usually through bundled software downloads or by clicking on malicious links.

How PUP.GameHack.J Operates

PUP.GameHack.J, like other PUPs, operates by installing itself on your system and then executing its payload. This can include a range of activities, such as displaying unwanted advertisements, collecting user data, and modifying system settings. PUPs can also install additional malware or create backdoors for remote access, allowing hackers to gain control of your system. The primary goal of PUP.GameHack.J is to generate revenue for its creators, often at the expense of the user's privacy and system security.

Symptoms of Infection

Identifying the symptoms of a PUP infection can be challenging, as they often mimic legitimate system behavior. However, some common indicators include slower system performance, increased pop-up advertisements, and unfamiliar programs or toolbars installed on your browser. You may also notice that your browser's homepage or search engine has been changed without your consent. If you suspect that your system is infected with PUP.GameHack.J, it is crucial to take action promptly to prevent further damage.

How to Remove PUP.GameHack.J

1. Boot your system in Safe Mode with Networking to prevent PUP.GameHack.J from loading and to allow for a clean removal process.
2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and identify all components related to PUP.GameHack.J.
3. Uninstall any suspicious programs or applications that were installed around the time of the infection. Be cautious and only remove programs that you are certain are malicious or unnecessary.
4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malicious extensions or settings changes made by PUP.GameHack.J.
5. Reboot your system and perform another full scan with your anti-malware tool to ensure that all components of PUP.GameHack.J have been removed.

Conclusion

Removing PUP.GameHack.J from your system requires careful attention to detail and a thorough understanding of the removal process. By following the steps outlined above and using reputable anti-malware tools, you can effectively remove this potentially unwanted program and restore your system to a safe and secure state. It is also essential to practice safe computing habits, such as avoiding suspicious downloads and links, to prevent future infections. Remember, prevention is key to maintaining system security and protecting your personal data.

Analysis Report

General information

Family Name:	PUP.GameHack.J
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: a205947ff2ae0b0d56bda66efa1abe3f SHA1: f5bc819b7827ac92b4ff2d8256b9784cf1b7c059 SHA256: C1356726002E02C276957AF9F4F3E6F01ACCC7847416A3A858C58B4E1BF0C52D File Size: 4.37 MB, 4374278 bytes

MD5: 9c0006f3bae04c79af21aea624f68c52 SHA1: c1a6ba9eb374431f8a5c3df7474f6b1b7a989f38 SHA256: 98489C0CA1C0E2AB2501CC015AF88B7CCA3463D5FEDB6859ED07A98061B5E121 File Size: 248.32 KB, 248320 bytes

MD5: 64aa21b27e88cf917c5591ed956370a1 SHA1: ee896b766b8cad6f027a9d6d44f4030ff1b7feda SHA256: 0EF220745585004E4C6C79890243A9C47D33EF0934A147830CAC865DE8D93DCE File Size: 66.05 KB, 66048 bytes

MD5: bc210a055b454096a997e93d854fd330 SHA1: bcee60dc3ce46ecaa20f35f526be35bb8c8dfae3 SHA256: 56321DD25C2EAC2607D9A07019B7B52FC9260645409D08BEB5026C03D602670D File Size: 117.25 KB, 117248 bytes

MD5: f712c17ed1634feae7a9c95e6372e9ca SHA1: 11e1389aa27445500804f2f8b74759c7f700847a SHA256: 5ECD1D74B750F01F0BB36AED9906F79E09C13A7CF1FA1F3F663D7207AF7261EE File Size: 8.48 MB, 8483305 bytes

Show More

MD5: 246e4b6026edd422396b10be7ead225f SHA1: 417472422fae3f34d3eb12fd467e9d28bceec409 SHA256: 3F4F802F42A48331848982685FB2061B38ACABC01F089AE76F12EAFF5DE156A5 File Size: 54.27 KB, 54272 bytes

MD5: 3041dcf8c9f6e1662b04127f9180f84c SHA1: 9ebd36a40fb73f1d4f76a952749369c32a5907b4 SHA256: 962DC3CC9E1515D058F0C25E2EFDFB387D1E588EBA825A3D32CBA51A8D8B9827 File Size: 925.18 KB, 925184 bytes

MD5: 7feface2420ef57b2637b7383080bded SHA1: c6595266bf9699916354118a6fb09e15fafa10f5 SHA256: 533CD9368863075545BAF80EF58AED93EAEE7BD494D6C7BB715DEA261AA259E0 File Size: 711.44 KB, 711438 bytes

MD5: 74536a4938a452d5349cdef07b747630 SHA1: 74e8f264fab46947787eaf5b13dea219d64b2236 SHA256: 8497931F116720A90A639F2C5F950B27DE971A50B01997ACE0402EADAFB96954 File Size: 137.73 KB, 137729 bytes

MD5: 39fb04078b8e4e55d29c18a9ccbb8663 SHA1: 8cd8de22915986ec025ead882c6c481aee2e6d72 SHA256: 874E706BF308E31BB508E50E8B3A28DF6ABCBEFC3DAD1E9476F4342F3B327929 File Size: 98.30 KB, 98304 bytes

MD5: 2290e5091bfc57317d097cda42a7e85e SHA1: a85ed16fc65ed6fb9060aab73729cd8f4f9c8d55 SHA256: 8A3C605B95185B5EDEF2679C6762580E32E02EA1B381697157A83F5675537B57 File Size: 183.81 KB, 183808 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has been packed
• File has exports table
• File has TLS information
• File is 32-bit executable
• File is 64-bit executable

Show More

• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)
• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	(2x) HcH of TechKnow (2022)
Company Name	FiGHTiNG FoR FuN TechKnow Tukero[X]Team
File Description	Database Viewer elooo's KeyGen Keygen Application
File Version	1.00 1, 0, 0, 8 1, 0, 0, 1
Internal Name	Keygen pc_xxxxx.zip s2k21 TJprojMain
Legal Copyright	Copyright (C) 2009 Copyright © 2004 elooo [FFF] TechKnow 2022
Original Filename	Keygen.EXE s2k22.exe TJprojMain.exe
Product Name	KeyGen Keygen Application Project1 Serials 2022
Product Version	1.00 1, 0, 0, 8 1, 0, 0, 1

File Traits

• .UPX
• 2+ executable sections
• dll
• HighEntropy
• MPRESS
• MPRESS Win32
• Native MPRESS x86
• No Version Info
• packed
• PEC2

Show More

• PECompact v2.20
• UPX!
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Total Blocks:	186
Potentially Malicious Blocks:	6
Whitelisted Blocks:	172
Unknown Blocks:	8

Visual Map

? ? ? ? ? ? ? x x x x x 0 x ? 0 0 0 0 0 0 0 1 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• AutoHotkey.A
• Bitcoinminer.R
• Brute.PVE
• Injector.KZP
• Injector.XN

Show More

• Keygen.M
• MPRESS Packer
• PWS.Onlinegames.AS
• Strictor.A
• Trojan.Agent.Gen.ZW
• Webalta.A

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\ms276b9e\bass.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\generell.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\main.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\mainskin.ini	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\menu_back.jpg	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\menu_mask.bmp	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\rzrcbm5.xm	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\ms276b9e\xcrazor.dll	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\~dfc5c26be81e93342e.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\downloads\s2k22.cdkey.db	Generic Read,Write Data,Write Attributes,Write extended,Append data

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Syscall Use	ntdll.dll!NtAccessCheck ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClose ntdll.dll!NtConnectPort ntdll.dll!NtCreateEvent ntdll.dll!NtCreateSection ntdll.dll!NtCreateThreadEx ntdll.dll!NtDuplicateToken ntdll.dll!NtFreeVirtualMemory Show More ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenProcessTokenEx ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadTokenEx ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtReadRequestData ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtRequestWaitReplyPort ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtSetInformationWorkerFactory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWriteFile UNKNOWN
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Other Suspicious	SetWindowsHookEx
Keyboard Access	GetKeyState