PUP.Gamehack.PA
Table of Contents
Analysis Report
General information
| Family Name: | PUP.Gamehack.PA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
9c325ab25f9ebe86d1fd7590cf647cca
SHA1:
b0c1a725acbf1c26349b68fae825c516f2d2f437
File Size:
1.39 MB, 1387008 bytes
|
|
MD5:
8f2b7a9995aa6d090e472fe0cba360bd
SHA1:
c5eccc02034b3eb04333b6118a460d95af6c86c1
SHA256:
6352AF13670638D603964D47226A1085C4037D97EF846051554886F5A05691FE
File Size:
1.66 MB, 1662144 bytes
|
|
MD5:
16b5d629ed3f630769080c0642eaddb6
SHA1:
dfd65c275d130f2c7b1548ed7e482049479adc98
SHA256:
DBF4E0BF3CEE9486DB482BFE6E38128F7E45EB1E48C6B9968C6DCC3FE5323F8A
File Size:
2.34 MB, 2335936 bytes
|
|
MD5:
f3c52c45aac32bfd6b815b2f5b381c5d
SHA1:
57e29c4f77aca7fc2a6c2d70d5272830da99bbbb
SHA256:
02A61FCFBEC9CEB62DD7C97F6C00E85584CCBACECD2EAA38638083ADB4326EC7
File Size:
1.38 MB, 1377792 bytes
|
|
MD5:
d303890ea6043bfb4fe9e548c056c59e
SHA1:
9868a2820730a6cdb20d2d5e60c8b84a43d182d8
SHA256:
C8C01EC570C9BD70E65D75ED3E6EFB3C9A5669EC0E23EC758FB70CD0282922E1
File Size:
688.13 KB, 688128 bytes
|
Show More
|
MD5:
7136da0c8f01903f58d65ad9e3b436e8
SHA1:
29a9862de7a9f836923c5a11108fcb9c0fb18dca
SHA256:
F08B56E96049ACB9BE3D22771044091257738B0DC2BA665F6A1D67758CA3617C
File Size:
1.02 MB, 1016832 bytes
|
|
MD5:
7bc9ef0a8c506db48365cb1227f10a4c
SHA1:
254d405bbd42ece3c466da9185945e43ab24a5eb
SHA256:
DBB2F26399B141205F1E4908739101A394E1ACBA449EA0EC721F07AC2A9C9178
File Size:
1.04 MB, 1035776 bytes
|
|
MD5:
71ad69f8d99192ea388e40627d7b2b54
SHA1:
990ef8fa231137658b8532b1c44cd7e7c543055f
SHA256:
3F44D7710C685DBE2F5BE6E4623D1B9C8F40EEAE191B2723C61E62BAF4212C95
File Size:
1.07 MB, 1070619 bytes
|
|
MD5:
f42debbadfcd2faa0b8cf7f788867a9a
SHA1:
2a270eb72553da61d2c6d0e5a6bc887fb613bca8
SHA256:
D4BC87FE89F797BC124B7A7959911DCB905CDA549C577E67E4DF7A9572E5CEF2
File Size:
2.01 MB, 2005184 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Cheathappens |
| File Version |
|
| Internal Name |
|
| Product Name |
|
| Product Version |
|
File Traits
- 2+ executable sections
- HighEntropy
- No Version Info
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 634 |
|---|---|
| Potentially Malicious Blocks: | 1 |
| Whitelisted Blocks: | 624 |
| Unknown Blocks: | 9 |
Visual Map
?
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.PA
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\cheathappens\debug\.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\debug\metal gear survive.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\debug\star wars battlefront.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\debug\warhammer 40000 inquisitor martyr.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\ch.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\cheathappens.net | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\help.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\inetcheck.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\inetcheck.dat | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\runtime\cheathappens.net | Synchronize,Write Attributes |
Show More
| c:\users\user\cheathappens\work\runtime\inetcheck.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\runtime\inetcheck.dat | Synchronize,Write Attributes |
| c:\users\user\downloads\0.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\1.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\3.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\4.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\5.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\6.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\7.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\ch.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\help.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\notepad.exe | 툃瑉ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey | |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\notepad.exe | ࢥ倥蒻ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
95 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Network Winsock2 |
|
| Other Suspicious |
|
| Network Winsock |
Show More
|
| Keyboard Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"notepad.exe" C:\Users\user\Cheathappens\Debug\STAR WARS Battlefront.debug
|
"notepad.exe" C:\Users\user\Cheathappens\Debug\Civilization 6.debug
|
