PUP.MSIL.Gamehack.BBA
Table of Contents
Analysis Report
General information
| Family Name: | PUP.MSIL.Gamehack.BBA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
1741681c78a3908674a1cab823826cb5
SHA1:
59f776390b7ca40e6fae7266ee2d7ead2e9e51b3
SHA256:
326F3660304C5A9E523CA61232E41B99DDF1255DA1870B9A25EAD0C0CD791A3E
File Size:
157.22 KB, 157222 bytes
|
|
MD5:
a40dd5af0e1f54c5e0c4c81ea2e00edd
SHA1:
fde94e62921e4fa9c39e90870c061b6f6841f9c6
SHA256:
B6FBBB2A1A26F239D071ECA0671AE49AAA800E328FF9A3D03B6B6A564B8A7583
File Size:
1.01 MB, 1010688 bytes
|
|
MD5:
13dee2006b96be1d0e42d500a025e31f
SHA1:
ee5ad857808834778ea6e597e682ce4ece28cfe8
SHA256:
298F29CECA93F377B11B1BE44AB42B27DE3EDA37C374456FD4ABF03D51805966
File Size:
47.10 KB, 47104 bytes
|
|
MD5:
49e8f62771a5eeec479417162bb7c910
SHA1:
4f7c9d3ca9b174d857930c5f4a1a74def91cb020
SHA256:
787AD9473C3064245CFD424BBF8394326A3C08E3122B7169B51DFE25FAAC5896
File Size:
406.53 KB, 406528 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is not packed
Show More
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version |
|
| Comments |
|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name |
|
| Original Filename |
|
| Product Name |
|
| Product Version |
|
File Traits
- .NET
- dll
- HighEntropy
- ntdll
- WriteProcessMemory
- x64
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 576 |
|---|---|
| Potentially Malicious Blocks: | 180 |
| Whitelisted Blocks: | 308 |
| Unknown Blocks: | 88 |
Visual Map
0
0
0
0
x
x
x
x
x
0
x
x
x
0
x
x
x
0
x
x
x
x
x
x
x
?
x
x
?
x
?
x
x
x
x
?
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
x
?
x
x
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
x
x
x
x
0
x
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
0
x
x
0
0
x
0
x
x
0
x
0
x
x
0
0
x
x
x
0
x
x
0
0
x
0
0
0
0
0
0
0
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
x
0
0
0
0
0
x
0
0
0
x
x
x
x
x
0
x
x
x
x
x
x
0
0
x
x
x
x
0
x
x
0
x
x
0
x
x
x
x
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
x
x
x
x
x
x
x
x
0
x
x
x
0
0
0
0
0
0
0
0
x
0
x
x
x
0
0
0
0
0
0
x
x
x
x
x
0
0
x
0
x
x
x
x
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
?
0
x
0
x
?
0
0
?
?
0
0
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
?
?
?
?
0
0
0
0
0
0
?
?
?
?
?
0
?
0
?
?
?
?
?
?
?
?
?
?
?
?
0
?
?
0
?
?
?
0
?
x
?
?
?
?
?
?
?
x
?
?
?
?
x
?
?
0
0
?
?
?
?
?
?
0
?
0
0
0
?
x
0
?
?
x
0
0
?
0
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
x
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
3 additional items are not displayed above. |
| Process Manipulation Evasion |
|
| Process Shell Execute |
|
| Anti Debug |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\ee5ad857808834778ea6e597e682ce4ece28cfe8_0000047104.,LiQMAxHB
|
