Threat Database Potentially Unwanted Programs PUP.GameHack.QM

PUP.GameHack.QM

By CagedTech in Potentially Unwanted Programs
Published:
Translate To:

PUP.GameHack.QM is a detection name used to flag a potentially unwanted program that is typically associated with game hacking, cheating, or modification tools. Programs detected under this label are usually bundled with or disguised as game trainers, cheat engines, aim-bots, unlockers, or similar utilities that promise to give players an unfair advantage or unlock paid content for free. While the name suggests it is tied to gaming software, detections like this are generally treated as a security and privacy risk rather than a legitimate gaming tool.

What PUP.GameHack.QM Does

Programs flagged as PUP.GameHack.QM typically install additional components onto a system beyond the advertised "game hack" functionality. This can include browser extensions, adware modules, or background processes that were not clearly disclosed to the user during installation. Such programs often run silently in the background, consume system resources, display unwanted advertisements, or redirect browser activity. In many cases, software in this category is also used as a delivery mechanism for other potentially unwanted programs, meaning a single installation can lead to several additional unwanted applications appearing on the device.

Because cheat tools and game hacks require altering how a game or its memory behaves, they often need elevated system permissions to function. This is typical behavior for this type of software and is one of the reasons such tools are frequently flagged — the same permissions that allow a program to modify game memory could also be misused to interfere with other software, monitor activity, or make unauthorized changes to system settings.

How It Usually Gets Onto Computers

PUPs in the game-hacking category typically spread through unofficial channels rather than legitimate software distribution platforms. Common delivery methods include:

  • Downloads from third-party websites offering free game cheats, trainers, or mods
  • Bundled installers that package the hack tool alongside other optional software
  • File-sharing networks, forums, or video descriptions promoting "free" game hacks
  • Cracked or pirated game modification tools shared outside official sources

Users often install these programs voluntarily, believing they are getting a useful gaming tool, without realizing that additional unwanted components may be included in the package.

Risks for the User

Installing a program associated with PUP.GameHack.QM can expose a user to several risks typical of this software category, including unwanted advertising, reduced system performance, unauthorized changes to browser or system settings, and exposure to additional bundled PUPs or adware. Because the software often needs deep access to system processes to alter games, there is also an increased risk of instability or conflicts with other installed security software. Additionally, downloading cheat tools from unofficial sources carries the general risk of exposure to more harmful malware disguised as a game hack.

Signs of Infection

Typical warning signs associated with this type of potentially unwanted program include unexpected pop-up ads, new browser toolbars or extensions that were not intentionally installed, changes to browser homepage or search settings, unfamiliar processes running in the background, and a noticeable slowdown in system or game performance.

How to Stay Protected

To reduce the risk of encountering programs like PUP.GameHack.QM, avoid downloading game hacks, trainers, or cheat tools from unofficial or unverified websites. Pay close attention during software installation and decline any additional offered programs or toolbars. Keep operating systems and security tools updated, and regularly review installed programs and browser extensions to remove anything unfamiliar or unused. Using caution with free downloads promising shortcuts in games is one of the most effective ways to avoid this category of potentially unwanted software.

Analysis Report

General information

Family Name: PUP.GameHack.QM
Signature status: No Signature

Known Samples

MD5: 9b927408ffa05fabf024d4603fc40ec4
SHA1: 38c3f5da53679f3f16a764bbf3727b131c41fc34
SHA256: 8C3EF2F6AF66697B4C7ED46943997BE0855474AB29DB3B07574AEC7E7F551F28
File Size: 771.07 KB, 771072 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have resources
  • File doesn't have security information
  • File has exports table
  • File has TLS information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • HighEntropy
  • x86

Block Information

Total Blocks: 2,201
Potentially Malicious Blocks: 570
Whitelisted Blocks: 1,206
Unknown Blocks: 425

Visual Map

? x x x x x x 0 x 0 x ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? x ? x ? ? 0 0 0 0 0 x x x 0 0 0 x x x x x x 0 0 ? x 0 0 x ? ? 0 ? 0 ? 0 0 x 0 x x x x 0 x x x x x ? ? x x x x x ? x ? ? 0 ? x x 0 ? ? 0 ? ? ? ? ? ? 0 0 0 ? ? 0 ? 0 ? 0 ? ? 0 0 0 x x x 0 ? ? x 0 x 0 x x ? x x x x x 0 0 x x x x ? x ? ? x ? ? x 0 x 0 x x ? x x x x x 0 0 x x x x ? x 0 x x x 0 x ? ? x x 0 0 0 x ? x x x 0 x x 0 0 x x x x x x x 0 0 ? x x 0 0 0 x x x x x x 0 0 ? ? 0 x x 0 ? 0 ? 0 ? x x 0 ? ? 0 ? ? ? ? ? ? 0 0 0 ? ? 0 ? 0 ? 0 ? ? 0 0 x 0 0 x x 0 0 ? x x 0 0 x x x x x x 0 x x 0 0 ? 0 x x x x x x x 0 ? ? 0 0 x x ? ? ? ? 0 x x x ? x ? ? ? 0 0 0 x x ? 0 x x 0 x x ? x x ? x x 0 x x 0 0 x x x 0 0 x x x ? 0 x x ? x 0 x ? ? ? 0 x x ? ? x x x 0 x 0 0 x ? ? x x x x 0 0 ? ? 0 x 0 0 0 0 0 x x ? x 0 x x x x ? ? 0 ? ? 0 0 x x 0 x 0 0 0 x 0 x ? x x 0 0 x ? ? x x x ? ? ? ? ? x x ? 0 ? x ? x ? x ? ? ? 0 x ? 0 x ? x ? x x x x x x x 0 x x x 0 ? 0 ? ? 0 ? 0 x x x x x x ? x x ? 0 x 0 ? 0 x x x x 0 x x x x x x x x ? x x x ? ? ? x ? ? x x x x x ? x x x x x x x 0 0 x x x x x ? x x x x x ? ? ? 0 0 0 ? ? ? x x ? x x x x x 0 ? x x 0 ? ? x 0 ? x x ? x ? 0 x ? x x x ? ? ? ? x x 0 x x 0 0 x 0 0 x x x x x x ? 0 x ? 0 ? x x x x x ? ? 0 ? ? ? ? ? ? x x x x ? x x ? ? 0 x 0 ? x ? ? x 0 x 0 0 ? ? ? ? ? ? x ? x x ? ? ? x x x x x 0 ? ? ? ? 0 0 ? x 0 x 0 ? 0 x x ? ? 0 ? x ? ? ? ? x x ? ? x ? ? ? ? ? 0 ? 0 0 0 x 0 x x ? x x ? x ? ? ? x x x x x x x 0 0 x 0 x 0 x 0 x 0 0 0 0 0 0 0 0 0 x ? ? x ? ? 0 x x 0 ? x x x ? x x x x ? 0 0 0 0 0 0 0 0 0 0 ? x x x ? ? ? x x ? x ? ? ? x x x ? 0 x x 0 x x x x x x x x 0 ? ? x 0 ? ? x 0 ? 0 x 0 x ? ? x ? ? 0 ? x ? ? 0 x x 0 x x x ? x x x x x x 0 0 x x 0 0 0 ? 0 x x x x ? ? 0 ? ? x x x x x x x ? x x 0 0 ? ? x x x ? ? x x x x 0 0 x 0 x ? 0 ? x x x x 0 x x ? ? ? x x x ? x x ? 0 ? x ? ? 0 ? 0 ? 0 0 ? 0 0 x x x 0 0 ? ? 0 0 0 0 0 0 ? x ? ? ? x ? 0 ? ? ? 0 ? x x x ? x 0 0 ? ? 0 ? ? ? 0 ? ? ? 0 x 0 0 0 0 0 x x x ? ? ? ? 0 0 0 ? ? 0 0 ? 0 x ? x ? 0 ? ? x ? x 0 0 ? 0 0 0 ? ? x x 0 0 0 x 0 0 x 0 ? x x x ? ? ? ? 0 ? ? ? ? 0 0 0 ? ? x ? 0 ? 0 ? x x ? x x x x x x ? x ? x x x x ? x x x 0 0 0 x x 0 x x ? 0 ? x x x x x x x ? ? ? x x x x x 0 x x ? x 0 0 x 0 ? ? ? ? 0 x x ? 0 x x ? 0 ? ? ? x 0 ? x x x ? ? x x x x 0 ? ? 0 0 0 0 ? 0 x x x x x x ? ? ? ? ? ? 0 ? 0 ? ? ? ? ? 0 ? ? 0 ? x x ? ? ? ? ? ? 0 ? x x x ? x ? ? ? ? 0 ? x 0 0 x 0 x ? x x 0 ? ? x ? ? 0 ? ? 0 x x x x x ? 0 0 ? ? 0 ? ? 0 x x x ? 0 0 0 ? ? 0 x 0 ? x x x 0 0 x x x 0 ? ? 0 ? 0 ? 0 ? x ? ? x x 0 x 0 ? 0 x x x 0 ? x x ? ? x x 0 ? x ? ? ? x 0 ? x ? ? ? 0 x x 0 0 x x ? 0 0 0 x 0 x x ? ? 0 0 0 x 0 0 ? ? ? x 0 x ? 0 0 0 0 x ? 0 0 x x x 0 x 0 0 x 0 x 0 x x x 0 x x x x x x x x 0 x 0 0 0 x x ? ? ? 0 ? ? x ? ? 0 x x x x 0 ? ? x x x x x x 0 x ? 0 0 x ? ? x 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 1 0 0 1 1 1 0 0 0 0 0 1 0 0 1 0 0 0 0 1 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\38c3f5da53679f3f16a764bbf3727b131c41fc34_0000771072.,LiQMAxHB