PUP.GameHack.K
Table of Contents
Analysis Report
General information
| Family Name: | PUP.GameHack.K |
|---|---|
| Packers: | $Id: UPX |
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
10cdcf39a2285d574940a2e4a07d9d64
SHA1:
1c3e9e20d2b99777e4423f5cc05c3a7fac9b772f
File Size:
30.00 KB, 29998 bytes
|
|
MD5:
0c318fd68a0cea3859fd823423529330
SHA1:
75546d4496f1891d62f8882806b121c975cf54d6
File Size:
17.99 KB, 17993 bytes
|
|
MD5:
893eef12b62e69be1bb957f0e1397a26
SHA1:
1dbfa0f3fdd35c37faebe3df269cd9a26a251869
SHA256:
7B14591FB02D9FBC3204E2DF57E438AF7DF2211DDD84B81FCE2AA2BA3333D360
File Size:
18.03 KB, 18032 bytes
|
|
MD5:
8e6902919b63be6cc4f204b0d00acb76
SHA1:
71c9f2496c9def3efe93c4cd9568149791016d4c
SHA256:
F6070728FD5E128099E2D2248A4CFF389B928460100430F63E6C683331166E0B
File Size:
29.88 KB, 29878 bytes
|
|
MD5:
683425ebd178bfbf902fdc0ad7364b54
SHA1:
35568d401ce13942f84e1b3ea3563f4f25e76d62
SHA256:
6706D71D91AA64DB39FA9B3349EFF4FF9C2A4DC439BB21ED96765628333C16FF
File Size:
51.94 KB, 51937 bytes
|
Show More
|
MD5:
992145407f7ffcdc494384e196a8fde6
SHA1:
9ecad0219956c8ea88b1b7184774e7f92118d26e
SHA256:
81E1CFA5B6BC1CD046021A49C4BFFCA95ECE1A51EA9797475DAF8BD9EB7615F5
File Size:
30.46 KB, 30458 bytes
|
|
MD5:
6bcd12a048265c4d0e516031bd3a85dd
SHA1:
a169b53232f1ffa20a7d7e38a6fef49bcc4a76fe
SHA256:
74F4441B913FA8C9244CEF8FB16AB74E3FEFC2B1CCB3760A4E5A6A565C0E4018
File Size:
17.84 KB, 17839 bytes
|
|
MD5:
345dd9250cf1b8df8e2d8a794d57ad2a
SHA1:
237fdc68cf698092e1bb93f71ecd89e458a56af1
SHA256:
7FA5D6EF2474D11F302CD3C1464E12C8559EE53C9EC85DA7DE7F811CBBA6508C
File Size:
17.87 KB, 17871 bytes
|
|
MD5:
0f891a0e6c1015b2b95e1b7eed378e7e
SHA1:
b9c907aae4b25465b2d7cd78eeda189962d8655f
SHA256:
CEDD12D808C2522A8806570A03A8B549E66DA04E8C295A9B1C6DED3433661518
File Size:
35.87 KB, 35874 bytes
|
|
MD5:
ec1bc5412a96ab99f5324f77d6a9460a
SHA1:
8b493bce23f8959b37201e22666d494d27c75264
SHA256:
BB0957D8B7607D38ADD51E9075C4749E931F4455E201B6DDF893DBD1D8471F92
File Size:
17.81 KB, 17810 bytes
|
|
MD5:
24ee3fe9500d97be96a9be11e090ada1
SHA1:
13fed671394ead3cd314f89768e80e0780b1fe55
SHA256:
5F0AEA376E79C4961CAEF8B8A00CAC4E48C65FE38F0ADDB4D02DBB63D972E598
File Size:
963.52 KB, 963516 bytes
|
|
MD5:
6a1c90c6340f8a9ed6f9f9c5736b3d4c
SHA1:
e9cd118e22e3e5a3e701381f990627b52edbc015
SHA256:
52C4E77685AAF31AA7BB9781757C08BB3762094F8ED19455A418CDC1E3634570
File Size:
56.31 KB, 56310 bytes
|
|
MD5:
8fea3150ff65063826bf9328d61df765
SHA1:
db31f4911c46718a6753cdfc4d12d7329b9b634a
SHA256:
02086DA73547186058A3DFDB830CA34568057A3B5178CBD8514D80EC6E331EE2
File Size:
17.80 KB, 17798 bytes
|
|
MD5:
dcb53a174a149348d693413c6978000f
SHA1:
a8df6eed41d69a983c55d9eeb068ae6958e499a5
SHA256:
7A57D804E818DE8BA33DABF56740F26674DE2EB7AD655016684BA8E84E6B7A29
File Size:
17.85 KB, 17847 bytes
|
|
MD5:
f57631719a5753b52ca1c28993500794
SHA1:
b4acf84aa5a1a61e8297f2e8144b3f2d3edf2cc8
SHA256:
D06DCAC718B4453D409BA3D2976E8C380C02CA9CD2E65A4FE3C094E4A4400C90
File Size:
17.96 KB, 17956 bytes
|
|
MD5:
499db8feb04aec0ce693fe2e536aa73a
SHA1:
3497a3bdede59a385e33ec56abcd71979cd8285f
SHA256:
5A01255F4005BFA4F746B06E89A23436565EA201A293E288221CFEE2702EB7CD
File Size:
18.08 KB, 18082 bytes
|
|
MD5:
b063a048179e341f6806f3b94ef19054
SHA1:
fa7154a20f8e6438a67cc2f459ff0a6bac31dba1
SHA256:
816FEEE1CFD0238E259F926BE07C74EDECA8D2B6631162A637AF074497FDEB11
File Size:
18.22 KB, 18216 bytes
|
|
MD5:
e9b6985c30ef822130332ef614295707
SHA1:
b4bb235db9c473c1132867f10cf65ddaaebbb3d7
SHA256:
DD3EAB1C0E6697032A3D96F4B307D82500BA0F591580FD7F424DBD5B774051F4
File Size:
20.99 KB, 20988 bytes
|
|
MD5:
3bf8895d0c37323ae52fd86fa944658f
SHA1:
b8205b0ced043f770fc73af548098415aa8d2f4d
SHA256:
6AA95F7EF1439B1AD4A2B44B0EF5D6C2D4F385F504EAAD717B381D7E954E9A3E
File Size:
29.84 KB, 29844 bytes
|
|
MD5:
02414098b80ba7e5dc1a594f36bdafed
SHA1:
1cc400282f4ac9c4de9bb98f5fcbcf369927bf09
SHA256:
49AD3C45D35B521502AFAE78A55ED7DC9D51714B9CE5946F1F7857D7633DD794
File Size:
43.21 KB, 43208 bytes
|
|
MD5:
1fb9b26109e384e1e6f1814dbe12e2ed
SHA1:
ec186e951859270cbe38455cd17ff7fa65cf5678
SHA256:
C13B1496CE5A07908BEDEB1ECEB33040035F6489A4FCB1318E79F7AFE4A02566
File Size:
40.87 KB, 40873 bytes
|
|
MD5:
2d8e9d32782e349aa782cdfc3f64d9fe
SHA1:
487f7eb008145a3909a2d2c5b0752e07d02561f0
SHA256:
D38D974CF22490FA6867C9FC2DF2A68E5ADA1467B5E9B81B0D90D7D9AFC3A38C
File Size:
17.71 KB, 17710 bytes
|
|
MD5:
57bf9c0c820016c6b704e837f268b9f2
SHA1:
721bf5815dd1dde23b12da8ac04ae2e9e4f51031
SHA256:
89D9B250E68DA3F3764FEDFB83341947CC99C1555E63E842052394EE2D40B838
File Size:
17.71 KB, 17713 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has been packed
- File has TLS information
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
Show More
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- $Id: UPX
- .adata
- .aspack
- 2+ executable sections
- ASPack v2.12
- HighEntropy
- No Version Info
- packed
- upx
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 135 |
|---|---|
| Potentially Malicious Blocks: | 32 |
| Whitelisted Blocks: | 103 |
| Unknown Blocks: | 0 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
x
x
x
0
x
x
x
x
x
x
0
x
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
x
x
x
x
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- GameHack.K
- MSIL.Agent.NJA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Anti Debug |
|
| User Data Access |
|
