PUP.Gamehack.PSI
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 25,557 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 1 |
| First Seen: | March 17, 2026 |
| Last Seen: | September 12, 2026 |
| OS(es) Affected: | Windows |
PUP.Gamehack.PSI is a detection name used to identify a potentially unwanted program (PUP) associated with game-hacking or game-modification utilities on Windows systems. While its danger level is rated low, it falls into the broader category of software that many users would prefer not to have installed, either because it arrived without clear consent or because it behaves in ways that can affect system stability, privacy, or overall user experience.
Table of Contents
What PUP.Gamehack.PSI Does
As its name suggests, PUP.Gamehack.PSI is linked to tools that claim to modify, enhance, or "hack" video games, such as programs that alter in-game values, inject code into running game processes, or provide unauthorized advantages. Technical analysis of this detection shows it is a native 64-bit Windows executable that is not digitally signed and does not carry the security markers typically found in legitimate, trusted software. It uses low-level system calls to write files, manage memory, and handle system events, which is consistent with programs designed to interact closely with other running processes, such as game clients.
Like many PUPs, this program may not cause direct damage to files or steal data outright, but it can introduce unwanted changes to the system, consume resources, or create instability in games or other applications it interacts with. Because it lacks a digital signature and was not built using standard packing or protection methods, it may also be flagged by security tools as suspicious, since legitimate game modification tools are generally discouraged and often violate the terms of service of the games they target.
How It Usually Gets Onto Computers
PUPs like Gamehack.PSI typically reach computers through channels associated with unofficial or questionable software distribution. Common delivery methods include bundling with free downloads, third-party installers, cracked or pirated game modifications, cheat engines, or tools advertised on gaming forums and file-sharing sites. Users often install these programs intentionally, seeking a gaming advantage, but may not fully realize the risks involved or that the installer includes additional, unwanted components.
Risks for the User
Although classified as low danger, PUP.Gamehack.PSI and similar game-hacking utilities carry several risks. Game accounts used with such tools can be banned or suspended if detected by anti-cheat systems. The software may also act unpredictably since it manipulates memory and processes, potentially causing crashes or conflicts with other applications. Additionally, because these tools are distributed outside official channels and lack verification, there is an elevated risk that a seemingly simple hack tool could be bundled with more harmful or invasive components.
Signs of Infection
Typical signs that a PUP like this is present include unexpected new files or processes related to game modification, unusual system slowdowns while playing games, unexpected crashes, or security software repeatedly flagging a tool the user intentionally downloaded. Since PUPs are often installed with some level of user interaction, the presence of unfamiliar gaming utilities or cheat tools in installed programs lists can also be a telltale sign.
How to Stay Protected
To reduce the risk of encountering programs like PUP.Gamehack.PSI, users should avoid downloading game hacks, cheats, or modification tools from unofficial or unverified sources. Installing software only from trusted vendors, carefully reviewing installation prompts to decline bundled extras, and keeping security software up to date are all effective preventive measures. Regularly reviewing installed applications and removing anything unfamiliar or unnecessary can also help keep a system clean and reduce exposure to potentially unwanted programs.
Analysis Report
General information
| Family Name: | PUP.Gamehack.PSI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ce5ff3220528c5b3085aa70ad2f66bd3
SHA1:
31b39d4c739827741f5becdb9dab7e2e90903c10
SHA256:
36A0A01DBF904F4A63DE3FD39B25D97985529FDC8A6A11616894BE1F04CC2F0A
File Size:
1.06 MB, 1060864 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Traits
- dll
- imgui
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,363 |
|---|---|
| Potentially Malicious Blocks: | 162 |
| Whitelisted Blocks: | 1,964 |
| Unknown Blocks: | 237 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
