PUP.Gametool.J
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 23 |
| First Seen: | November 14, 2022 |
| Last Seen: | October 11, 2026 |
| OS(es) Affected: | Windows |
PUP.Gametool.J is a Potentially Unwanted Program (PUP) that targets Windows computers. It is most often associated with game-related launcher or auto-update tools, and while it is not classified as highly dangerous, its presence can still be disruptive and unwanted on a user's system. Security researchers have tracked this detection name since late 2022, and it continues to appear in scans on a regular basis, indicating it is still actively circulating.
Table of Contents
What PUP.Gametool.J Does
PUP.Gametool.J presents itself as a legitimate utility, typically packaged as an auto-update or launcher component tied to a game client. Once installed, it may run quietly in the background, performing update or maintenance-style tasks without always making clear what it is doing or why. Like many programs in the Potentially Unwanted Program category, it may be bundled with additional software components that the user never explicitly agreed to install, and it can exhibit behaviors typical of this category, such as running automatically at startup, communicating over the network, or launching additional processes without clear user interaction. It is not uncommon for such tools to use system functions associated with process handling, which can sometimes make them harder for an average user to identify or remove manually.
How It Gets Onto Computers
As is typical for PUPs, PUP.Gametool.J usually does not arrive through a direct, deliberate download of malware. Instead, it tends to be bundled with other software installers, particularly those related to gaming tools, launchers, or auto-update utilities. Users may encounter it after downloading software from unofficial or third-party websites, peer-to-peer networks, or bundled installer packages that include extra, pre-checked components. Because installation screens for bundled software often bury optional add-ons in "custom" or "advanced" setup options, many users end up installing such programs without fully realizing it.
Risks for the User
With a danger level rated low on a typical risk scale, PUP.Gametool.J is not considered a severe threat compared to high-risk malware such as ransomware or spyware. However, PUPs in general can still pose real concerns. These may include unwanted background processes consuming system resources, unexpected network activity, changes to system behavior without clear user consent, and the installation of further unwanted components. Because this file lacks a digital signature, verifying its legitimacy is more difficult, which adds a layer of uncertainty regarding its origin and intended purpose.
Signs of Infection
Users may notice a program running in the background that they do not recall installing, often tied to game-update or launcher functionality. Other signs typical of this category include unexpected processes appearing in Task Manager, unfamiliar entries in startup programs, increased background network activity, or the appearance of related files and traces in system folders without a clear explanation.
How to Stay Protected
To reduce the risk of encountering programs like PUP.Gametool.J, download software only from official or trusted sources, and avoid third-party download portals that repackage installers. Always choose "custom" or "advanced" installation options so you can review and deselect any bundled components before installing. Keep your operating system and security software up to date, and periodically review installed programs and startup items to catch anything unfamiliar. Running regular system scans with reputable security software can also help detect and remove unwanted programs before they cause further issues.
Analysis Report
General information
| Family Name: | PUP.Gametool.J |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
fa7bbfa1ff157a0bf9b27058c83e0bb8
SHA1:
a7be2076fd77ee3bbe83c625a850729eab7e14b6
SHA256:
D8CE8634D4F8467F25F4E4D4DE58CA828AE4A979A7A3D1D5C030E6A2C3A5E400
File Size:
1.88 MB, 1877504 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments | Võ Lâm Truyền Kỳ - Auto Update Launcher |
| Company Name | JX Tinh Thien Ha |
| File Description | Autoupdate |
| File Version | 1.0.0.0 |
| Internal Name | Autoupdate.exe |
| Legal Copyright | Copyright © 2021 |
| Original Filename | Autoupdate.exe |
| Product Name | Autoupdate |
| Product Version | 1.0.0.0 |
File Traits
- .NET
- HighEntropy
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 166 |
|---|---|
| Potentially Malicious Blocks: | 19 |
| Whitelisted Blocks: | 106 |
| Unknown Blocks: | 41 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Files Modified
Files Modified
This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.| File | Attributes |
|---|---|
| \device\namedpipe\gmdasllogger | Generic Write,Read Attributes |
| c:\windows\appcompat\programs\amcache.hve | Read Data,Read Control,Write Data |
| c:\windows\appcompat\programs\amcache.hve | Write Attributes |
Registry Modifications
Registry Modifications
This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.| Key::Value | Data | API Name |
|---|---|---|
| HKLM\system\software\microsoft\tip\aggregateresults::data | 隞̃蘁耀꧌ - | RegNtPreCreateKey |
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
| Anti Debug |
|
| Other Suspicious |
|
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Encryption Used |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\\dw20.exe dw20.exe -x -s 896
|
