PUP.Gamehack.NFC
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 26,918 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 4 |
| First Seen: | September 29, 2026 |
| Last Seen: | October 11, 2026 |
| OS(es) Affected: | Windows |
PUP.Gamehack.NFC is a detection name used to identify a potentially unwanted program (PUP) that targets Windows computers. It belongs to a broader category of game-hacking tools that are often flagged because of the intrusive or risky way they operate on a system, rather than because they are outright destructive malware like ransomware or spyware. While its overall danger level is rated low, users who encounter this detection should still take it seriously and understand what it does and how it behaves.
As its name suggests, PUP.Gamehack.NFC is associated with so-called "game hack" tools, applications that are typically marketed as giving players an advantage in video games, such as unlocking features, modifying in-game values, or bypassing normal game restrictions. Technically, the detected file is a 64-bit Windows GUI application that is not digitally signed, meaning it has no verified publisher information. It also shows signs of high entropy, which often indicates that parts of the program have been obfuscated or compressed to make analysis more difficult. The file has been observed using the WriteProcessMemory function, a technique commonly used by game-hacking and memory-editing tools to directly alter the memory of another running process, such as a game, in order to change its behavior. It also makes use of an interface library sometimes seen in these types of tools, which is typically used to build the in-program menus and overlays that game hack tools display to users.
Like many PUPs, Gamehack.NFC-type programs commonly reach user systems through software bundling, where they are packaged alongside other downloads, often free utilities, cracked software, or third-party installers for game modifications and cheats. Users may also encounter such tools through websites and forums dedicated to game cheating, where downloads are offered with little transparency about what else may be installed. In many cases, people only partially consent to installation, clicking through setup screens quickly without noticing additional bundled components.
The risks associated with this type of PUP generally include unwanted changes to the system and exposure to further unwanted or risky software. Because the detected file directly manipulates the memory of other running processes, it could interfere with the stability of games or other software, potentially causing crashes or unexpected behavior. Programs in this category are also commonly associated with other PUP behaviors, such as bundled adware, unwanted browser changes, or the installation of additional unwanted applications without clear user consent.
Signs that a system may have this type of program installed can include the unexpected presence of unfamiliar game-hacking or cheat-related executables, unusual overlay menus appearing while playing games, unexplained changes in game or system performance, or the discovery of additional unknown programs that were not intentionally installed.
To stay protected, users should avoid downloading game hacks, cheats, or modification tools from unofficial or untrusted sources, and should pay close attention during software installation, declining any bundled offers that are not clearly needed. Keeping security software up to date and running regular system scans can help detect and remove PUPs like Gamehack.NFC before they cause further issues.
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.NFC |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0aca018b3f956c322a14e4a08c9dbce8
SHA1:
763ec07cb86daee474233fd63d8460aecd22212c
SHA256:
A8CFC3491983AA060260B0B62C7790C0550057C7BEA5B00964F7BA3D92713805
File Size:
8.10 MB, 8097792 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- HighEntropy
- imgui
- No Version Info
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 5,096 |
|---|---|
| Potentially Malicious Blocks: | 483 |
| Whitelisted Blocks: | 4,158 |
| Unknown Blocks: | 455 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- PUP.GameHack.Gen.FV
