PUP.Gamehack.MI
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 8,944 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 11 |
| First Seen: | June 6, 2026 |
| Last Seen: | October 15, 2026 |
| OS(es) Affected: | Windows |
PUP.Gamehack.MI is a detection name used to flag a potentially unwanted program (PUP) that targets Windows systems. While it carries a low danger rating, its presence on a computer is still a signal that unwanted or unauthorized software may be running in the background. Understanding what this detection means can help users decide whether to remove it and how to prevent similar programs from appearing in the future.
Table of Contents
What PUP.Gamehack.MI Does
PUP.Gamehack.MI is classified as a Potentially Unwanted Program, a category of software that users may have technically agreed to install, often without fully realizing what the program does or how it behaves. Programs in this category commonly engage in behavior such as installing browser toolbars, displaying unwanted advertisements, changing default browser settings, or running processes that consume system resources without providing clear value to the user.
In the case of PUP.Gamehack.MI, the file is a native 64-bit Windows application that does not carry a digital signature, meaning its publisher cannot be verified through standard trust mechanisms. The program has been observed writing to a log file on the system and making use of low-level system calls related to memory management and file writing. This type of activity is consistent with software that runs quietly in the background, collecting information about its own operation or interacting with system resources outside of normal user-facing applications. The file does not appear to be packed, and it lacks typical indicators such as an exports table or embedded security information, which is common among PUPs that are not necessarily malicious but are also not fully transparent about their purpose.
How It Usually Gets Onto Computers
Like most programs in the Potentially Unwanted Program category, PUP.Gamehack.MI likely reaches computers through software bundling. This is a distribution method where a PUP is packaged alongside a legitimate program, such as a free download, game modification tool, or utility. During installation, users may be presented with pre-checked boxes or quickly dismissed prompts that authorize the installation of additional software without the user fully reading the terms. Downloading programs from unofficial websites, peer-to-peer networks, or third-party download portals increases the likelihood of encountering bundled PUPs like this one.
Risks for the User
Although PUP.Gamehack.MI carries a low danger level, its presence can still create risks. Unwanted programs of this type can slow down system performance, generate unnecessary background processes, and modify system files or logs without clear user benefit. Because the file lacks a verified digital signature, there is reduced assurance about its true origin or intent. Even low-risk PUPs can sometimes act as a gateway for more intrusive advertising or tracking behavior.
Signs of Infection
Users may notice unexpected changes in system behavior, such as new log files appearing in system folders, unfamiliar background processes running, or changes to browser settings that were not intentionally made. In general, PUPs can also cause an increase in pop-up advertisements or sluggish system performance.
How to Stay Protected
To reduce the risk of encountering PUPs like PUP.Gamehack.MI, users should download software only from official or trusted sources, carefully review installation prompts, and opt out of bundled offers whenever possible. Keeping the operating system updated and regularly reviewing installed programs and browser extensions can also help catch unwanted software early.
Analysis Report
General information
| Family Name: | PUP.Gamehack.MI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
d8e7f3c41cd0f5be435292444307579f
SHA1:
4f615cdbae7875e3976b26d56157b3ac5e58935a
SHA256:
B00088FC5B4C8D78A0F05B328A123B7B5D53E666682B7D4F9D7B248765340E9A
File Size:
4.02 MB, 4023808 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- HighEntropy
- imgui
- ntdll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 6,732 |
|---|---|
| Potentially Malicious Blocks: | 1,452 |
| Whitelisted Blocks: | 4,271 |
| Unknown Blocks: | 1,009 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\windows\system32\magnesium_debug.log | Generic Write,Read Attributes |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
