PUP.GameTool.FG

The detection of PUP.GameTool.FG on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take immediate action to remove it and prevent further damage.

What Is PUP.GameTool.FG?

PUP.GameTool.FG is a type of malware that is classified as a potentially unwanted program. This means that while it may not be as harmful as other types of malware, such as viruses or Trojans, it can still cause problems with your system and compromise your personal data. PUPs are often installed unintentionally, and they can be difficult to remove without the right tools and expertise.

How PUP.GameTool.FG Operates

PUP.GameTool.FG, like other PUPs, operates by installing itself on your system and then executing its payload. This can happen through various means, such as when you download and install software from untrusted sources, click on malicious links, or open attachments from spam emails. Once installed, PUP.GameTool.FG can start to cause problems, such as displaying unwanted ads, collecting your personal data, and slowing down your system's performance.

Symptoms of Infection

If your system is infected with PUP.GameTool.FG, you may notice several symptoms. These can include unwanted ads and pop-ups, slow system performance, and unfamiliar programs or icons on your desktop. You may also notice that your browser's homepage or search engine has been changed, or that you are being redirected to unfamiliar websites. In some cases, PUP.GameTool.FG may also collect your personal data, such as your browsing history or login credentials, and transmit it to its creators.

• Unwanted ads and pop-ups
• Slow system performance
• Unfamiliar programs or icons on your desktop
• Changes to your browser's homepage or search engine
• Redirection to unfamiliar websites

How to Remove PUP.GameTool.FG

1. Boot your system in Safe Mode with Networking to prevent PUP.GameTool.FG from loading and to allow you to download and install removal tools.
2. Download and install a reputable anti-malware tool, such as SpyHunter, and perform a full scan of your system to detect and remove PUP.GameTool.FG and any other malware that may be present.
3. Uninstall any suspicious programs that you do not recognize or that you did not intentionally install.
4. Reset your browser settings to their default values, including Chrome, Firefox, and Edge, to remove any changes made by PUP.GameTool.FG.
5. Reboot your system and perform another scan with your anti-malware tool to ensure that PUP.GameTool.FG has been completely removed.

Conclusion

Removing PUP.GameTool.FG from your system requires careful attention to detail and the right tools. By following the steps outlined above, you can help to ensure that your system is free from this potentially unwanted program and that your personal data is protected. It is also essential to take steps to prevent future infections, such as being cautious when downloading software, avoiding suspicious links and attachments, and keeping your operating system and software up to date. By taking these precautions, you can help to keep your system safe and secure.

Analysis Report

General information

Family Name:	PUP.GameTool.FG
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: 05df8fd81113c4b594b85cbec379f917 SHA1: 67e5ff8765e2cdb4849f89e75ca9bd05e27dfc78 SHA256: BA93C6E23EB8FCF6969DFE6D3521BAFAD4042B8CFF1C82D73ED3A4296E6692C4 File Size: 864.26 KB, 864256 bytes

MD5: 9069ab774e43d02f632e6747b673a150 SHA1: 4b958151b191906321797c391eac40b71e121a08 SHA256: 1F2CC6C672403CD3BC24A44A8D67158413DB8B14189E99A962635584F397ABBF File Size: 7.83 MB, 7834624 bytes

MD5: a9cd390e86e3f162cf35f37a3e6d1671 SHA1: 81b908a072561f4f8d3af29b372ddda704c03e2e SHA256: 9AE9D2BCB4DF290C1F157EF7D2D3FF96D2B3F283A9D5A0D971E5DE4B4E163F8C File Size: 864.26 KB, 864256 bytes

MD5: 15c48b685937b82a71afb104d9e926f9 SHA1: b8a4c3deaaee443b89204b4e36353e765767ed88 SHA256: 0CD5E49CC5CF8E55EFA212FAACE400A34C20F00FDEE72BFBC16CCB8F4FACEECA File Size: 1.80 MB, 1795391 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has TLS information
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
Comments	This installation was built with Inno Setup: http://www.innosetup.com
Company Name	Jellypie Software Microsoft Corporation
File Description	Video Fun Box 1.09 Setup Win32 Cabinet Self-Extractor
File Version	5.00.2314.1000 0.0.0.0
Internal Name	Wextract
Legal Copyright	Copyright (C) Microsoft Corp. 1981-1999
Original Filename	WEXTRACT.EXE
Product Name	Microsoft(R) Windows (R) 2000 Operating System
Product Version	5.00.2314.1000

File Traits

• 00 section
• HighEntropy
• No Version Info
• x86

Block Information

i

Block Information

During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.

Similar Families

i

Similar Families

This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.

• GameTool.FG

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
\device\namedpipe\gmdasllogger	Generic Write,Read Attributes
c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_16.db	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\explorer\iconcache_idx.db	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.0.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.1.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\microsoft\windows\usrclass.dat{dba6b5ef-640a-11ed-9bcb-f677369d361c}.txr.2.regtrans-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-9n9qk.tmp\_shfoldr.dll	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\is-fbnbu.tmp\is-1uj8d.tmp	Generic Read,Write Data,Write Attributes,Write extended,Append data

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent
User Data Access	GetUserObjectInformation
Process Manipulation Evasion	NtUnmapViewOfSection
Process Shell Execute	CreateProcess

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

"C:\Users\Divsduve\AppData\Local\Temp\is-FBNBU.tmp\is-1UJ8D.tmp" /SL4 $F0384 c:\users\user\downloads\b8a4c3deaaee443b89204b4e36353e765767ed88_0001795391 1784317 69120