PUP.Gamehack.PA
The detection of PUP.Gamehack.PA on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.
Table of Contents
What Is PUP.Gamehack.PA?
PUP.Gamehack.PA is a type of malware that is classified as a potentially unwanted program. This means that it may not be as harmful as other types of malware, such as viruses or Trojans, but it can still cause problems with your system and compromise your personal data. PUPs are often installed on a system without the user's knowledge or consent, and they can be difficult to remove.
How PUP.Gamehack.PA Operates
PUP.Gamehack.PA, like other PUPs, operates by installing itself on a system and then performing various unwanted actions. These actions can include displaying advertisements, collecting personal data, and modifying system settings. PUPs can also install additional malware or unwanted software on a system, which can lead to further problems. In some cases, PUPs can be used to distribute other types of malware, such as viruses or ransomware.
Symptoms of Infection
The symptoms of a PUP.Gamehack.PA infection can vary, but common signs include slow system performance, unwanted advertisements, and unexpected changes to system settings. You may also notice that your browser is being redirected to unwanted websites or that your search results are being manipulated. In some cases, you may not notice any symptoms at all, which is why it is essential to regularly scan your system for malware.
- Slow system performance
- Unwanted advertisements
- Unexpected changes to system settings
- Browser redirection
- Manipulated search results
How to Remove PUP.Gamehack.PA
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow you to download and install removal tools.
- Perform a full scan of your system using a reputable malware removal tool, such as SpyHunter, to detect and remove all instances of the malware.
- Uninstall any suspicious programs that may be related to the malware, as these can be used to reinstall the malware or install additional malware.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any malware-related extensions or add-ons.
- Reboot your system and perform another scan to ensure that all instances of the malware have been removed.
Conclusion
Removing PUP.Gamehack.PA from your system requires careful attention to detail and a thorough understanding of the malware removal process. By following the steps outlined above, you can help to ensure that your system is free from this potentially unwanted program and that your personal data is protected. It is also essential to take steps to prevent future infections, such as installing anti-malware software, avoiding suspicious downloads, and being cautious when clicking on links or opening email attachments.
Analysis Report
General information
| Family Name: | PUP.Gamehack.PA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
9c325ab25f9ebe86d1fd7590cf647cca
SHA1:
b0c1a725acbf1c26349b68fae825c516f2d2f437
File Size:
1.39 MB, 1387008 bytes
|
|
MD5:
8f2b7a9995aa6d090e472fe0cba360bd
SHA1:
c5eccc02034b3eb04333b6118a460d95af6c86c1
SHA256:
6352AF13670638D603964D47226A1085C4037D97EF846051554886F5A05691FE
File Size:
1.66 MB, 1662144 bytes
|
|
MD5:
16b5d629ed3f630769080c0642eaddb6
SHA1:
dfd65c275d130f2c7b1548ed7e482049479adc98
SHA256:
DBF4E0BF3CEE9486DB482BFE6E38128F7E45EB1E48C6B9968C6DCC3FE5323F8A
File Size:
2.34 MB, 2335936 bytes
|
|
MD5:
f3c52c45aac32bfd6b815b2f5b381c5d
SHA1:
57e29c4f77aca7fc2a6c2d70d5272830da99bbbb
SHA256:
02A61FCFBEC9CEB62DD7C97F6C00E85584CCBACECD2EAA38638083ADB4326EC7
File Size:
1.38 MB, 1377792 bytes
|
|
MD5:
d303890ea6043bfb4fe9e548c056c59e
SHA1:
9868a2820730a6cdb20d2d5e60c8b84a43d182d8
SHA256:
C8C01EC570C9BD70E65D75ED3E6EFB3C9A5669EC0E23EC758FB70CD0282922E1
File Size:
688.13 KB, 688128 bytes
|
Show More
|
MD5:
7136da0c8f01903f58d65ad9e3b436e8
SHA1:
29a9862de7a9f836923c5a11108fcb9c0fb18dca
SHA256:
F08B56E96049ACB9BE3D22771044091257738B0DC2BA665F6A1D67758CA3617C
File Size:
1.02 MB, 1016832 bytes
|
|
MD5:
7bc9ef0a8c506db48365cb1227f10a4c
SHA1:
254d405bbd42ece3c466da9185945e43ab24a5eb
SHA256:
DBB2F26399B141205F1E4908739101A394E1ACBA449EA0EC721F07AC2A9C9178
File Size:
1.04 MB, 1035776 bytes
|
|
MD5:
71ad69f8d99192ea388e40627d7b2b54
SHA1:
990ef8fa231137658b8532b1c44cd7e7c543055f
SHA256:
3F44D7710C685DBE2F5BE6E4623D1B9C8F40EEAE191B2723C61E62BAF4212C95
File Size:
1.07 MB, 1070619 bytes
|
|
MD5:
f42debbadfcd2faa0b8cf7f788867a9a
SHA1:
2a270eb72553da61d2c6d0e5a6bc887fb613bca8
SHA256:
D4BC87FE89F797BC124B7A7959911DCB905CDA549C577E67E4DF7A9572E5CEF2
File Size:
2.01 MB, 2005184 bytes
|
|
MD5:
f8cd1fd32deb2b0789b36561ebc0c7b0
SHA1:
e2a4b15f8e7739daf023cfa4ba2d561982bf4bfa
SHA256:
8EA8F4E29A8C315D3F0AA2365341D3CFB64324E1784F7710314BFF3689A70055
File Size:
1.93 MB, 1930432 bytes
|
|
MD5:
db0fe63e4dc7b8a4d7e81181e58243f1
SHA1:
920876b36e0f0442ee063b2987997d0f613bdb29
SHA256:
E453D7B73B71D686BAA50994440A4361A8BF4306D666421937BCEEB92685E445
File Size:
2.34 MB, 2335936 bytes
|
|
MD5:
3ac226f9fba447040b48cadea87665bb
SHA1:
b6cfffbbd147a9f16e7d9c37013e607eeb9a5c5e
SHA256:
D50C11542ECE5534D04CE4F1C80CFC10C471C61B2FE3249890B31A0D1D5C864E
File Size:
1.06 MB, 1061376 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name | Cheathappens |
| File Version |
|
| Internal Name |
|
| Product Name |
|
| Product Version |
|
File Traits
- 2+ executable sections
- HighEntropy
- No Version Info
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 589 |
|---|---|
| Potentially Malicious Blocks: | 86 |
| Whitelisted Blocks: | 502 |
| Unknown Blocks: | 1 |
Visual Map
?
x
x
x
0
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
0
x
x
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
x
0
1
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
x
x
x
x
x
0
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
1
x
x
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
x
x
x
x
x
x
0
0
0
0
0
0
x
x
0
x
x
x
x
x
x
x
0
0
x
x
0
x
0
x
0
x
x
0
0
0
0
x
x
0
0
0
x
0
0
x
x
0
x
0
0
0
0
0
x
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
1
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.PA
- HackKMS.C
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| c:\users\user\cheathappens\debug\.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\debug\metal gear survive.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\debug\star wars battlefront.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\debug\warhammer 40000 inquisitor martyr.debug | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\ch.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\cheathappens.net | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\help.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\inetcheck.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\inetcheck.dat | Synchronize,Write Attributes |
| c:\users\user\cheathappens\work\runtime\cheathappens.net | Synchronize,Write Attributes |
Show More
| c:\users\user\cheathappens\work\runtime\inetcheck.dat | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\cheathappens\work\runtime\inetcheck.dat | Synchronize,Write Attributes |
| c:\users\user\downloads\0.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\1.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\3.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\4.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\5.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\6.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\7.ogg | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\ch.dll | Generic Read,Write Data,Write Attributes,Write extended,Append data |
| c:\users\user\downloads\help.txt | Generic Read,Write Data,Write Attributes,Write extended,Append data |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\notepad.exe | 툃瑉ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | (k � 8��8tXa��B�8 �� �6 �v 5� �Z xy �� T�B� ������ � ���� �5����ee��Bx �< �!wz "Wc#�#��$kF$�� %"�%:� %�&� &�x(�(X�)�`*J*9*�"*�^*�h+�[,��/9� /��0P%1`1�1HO 1�D5�0 | RegNtPreCreateKey |
| HKLM\system\controlset001\services\bam\state\usersettings\s-1-5-21-3119368278-1123331430-659265220-1001::\device\harddiskvolume2\windows\system32\notepad.exe | ࢥ倥蒻ǜ | RegNtPreCreateKey |
| HKLM\software\microsoft\windows nt\currentversion\notifications\data::418a073aa3bc1c75 | l � a�jg�8 �v �Z xy �� T��������5����Bx !wz #�#��%:� &� (�(X�)�`*J+�[,��-!R/9� /��1`1�1HO 1�D5�09ߔ<.:>3� @V� D�G�IH[uH�pI��J�� K��N$R20U_*V � X�`b.`�2b"hc�zg �g�Xh�ri�� | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
95 additional items are not displayed above. |
| Anti Debug |
|
| User Data Access |
|
| Network Winsock2 |
|
| Other Suspicious |
|
| Network Winsock |
Show More
|
| Keyboard Access |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Process Terminate |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
"notepad.exe" C:\Users\user\Cheathappens\Debug\STAR WARS Battlefront.debug
|
"notepad.exe" C:\Users\user\Cheathappens\Debug\Civilization 6.debug
|
