Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.MSIL.Gamehack.BOD

PUP.MSIL.Gamehack.BOD

By CagedTech in Potentially Unwanted Programs

Analysis Report

General information

Family Name: PUP.MSIL.Gamehack.BOD
Signature status: No Signature

Known Samples

MD5: 5f9f782f273c355ab40cabf29268a2f3
SHA1: c573f1326ddb33885b334b63512eef512c63fc0d
SHA256: 764534F1EC005FDE0337096602E9820EA505BCA6AA8D9B9F2EDFEFC0E62C8F71
File Size: 968.19 KB, 968192 bytes
MD5: 8e571f47f390a946eb7dc0c967ce5ccb
SHA1: 6735861de0d02ca06ec975b35afba25da41cfbab
SHA256: 9B24583A4EDA6FC748B994FF161AEA9DAC7377BEE5E060C25F61E952B5D0CC13
File Size: 2.41 MB, 2409984 bytes
MD5: 9b5e9fca608a5dabdc93e0645af713c6
SHA1: e5d0290f04d6e1bd5768934c3b1bad6c1aab73db
SHA256: 04DFD13A3F87A379345AA290CCA36950BBF04E8BECC69B242FB2DFDDEC3D9D70
File Size: 6.63 MB, 6633472 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have debug information
  • File doesn't have exports table
  • File doesn't have relocations information
  • File doesn't have security information
  • File is .NET application
  • File is 32-bit executable
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
Show More
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

Windows PE Version Information

Name Value
Assembly Version
  • 134.5.2021.14
  • 1.5.0.0
  • 1.2.50.0
Comments
  • Libreria de controles para C# y VB.net
  • Outlast 2 Trainer + 3rd person Mod v1.5
Company Name
  • MZ Design Software
  • Timm3D
File Description
  • Commission_Report_Generator
  • Deising UI Librery By: Manuel Zaragoza
  • Outlast 2 Trainer + 3rd person Mod v1.5
File Version
  • 1.5
  • 1.2.50.0
  • 1.0.0.0
Internal Name
  • Commission_Report_Generator.exe
  • Outlast 2 Trainer + 3rd person Mod v1.5.exe
  • UIDC.dll
Legal Copyright
  • Copyright © 2017 - 2090
  • Copyright © 2021
  • Copyright © Manuel Zaragoza 2020
Legal Trademarks
  • Manuel Zaragoza
  • Timm3D
Original Filename
  • Commission_Report_Generator.exe
  • Outlast 2 Trainer + 3rd person Mod v1.5.exe
  • UIDC.dll
Product Name
  • Commission_Report_Generator
  • Deising UI
  • Outlast 2 Trainer + 3rd person Mod v1.5
Product Version
  • 1.5
  • 1.2.50.0
  • 1.0.0.0

File Traits

  • .NET
  • dll
  • HighEntropy
  • NewLateBinding
  • Pastebin
  • WriteProcessMemory
  • x64
  • x86

Block Information

Total Blocks: 1,976
Potentially Malicious Blocks: 88
Whitelisted Blocks: 1,275
Unknown Blocks: 613

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 x 0 0 0 ? 0 ? 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 x ? 0 0 x 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 ? 0 0 0 ? ? ? 0 0 0 0 ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 ? 0 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 0 0 0 0 0 0 x ? 0 0 0 0 ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 ? ? ? ? 0 ? 0 0 0 0 ? ? ? ? ? 0 ? 0 0 ? ? 0 0 0 0 0 0 ? ? 0 0 ? ? ? ? ? 0 0 ? ? x ? 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 ? 0 ? ? 0 ? ? 0 0 0 0 ? 0 ? 0 0 ? ? ? ? ? ? ? 0 0 0 0 ? 0 ? 0 0 0 ? ? ? ? ? ? ? ? 0 0 ? 0 0 ? 0 0 0 ? ? ? ? ? 0 0 0 0 0 ? ? x ? ? ? 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 ? x ? ? ? 0 ? 0 0 0 0 0 0 0 ? 0 0 ? ? 0 ? 0 ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? x x ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 ? 0 0 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 ? 0 ? 0 0 x 0 x 0 0 x 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 ? ? ? ? 0 0 ? 0 ? ? ? 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 ? ? ? ? ? ? ? 0 0 ? ? 0 ? ? ? ? ? ? 0 ? ? 0 0 0 0 ? 0 ? 0 0 0 0 x 0 0 x 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? ? 0 0 0 ? 0 ? ? x ? 0 0 0 0 0 0 0 x 0 0 0 x x ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? x ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? x 0 0 0 0 0 0 ? ? 0 0 0 0 0 ? 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? 0 0 ? 0 ? ? x x x x x x ? ? ? ? ? ? 0 0 0 0 0 ? ? ? 0 0 0 0 0 ? 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 0 ? ? ? ? ? 0 x ? ? ? ? x x 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 ? ? ? ? ? 0 0 x 0 x 0 0 ? ? ? x x x 0 0 ? 0 ? ? 0 0 x 0 x 0 0 ? ? ? x x x 0 0 ? 0 ? ? 0 0 0 0 0 0 0 x 0 0 0 x x x ? ? 0 0 0 0 0 0 x x x 0 0 0 0 ? ? 0 ? 0 0 0 ? 0 ? 0 0 0 ? ? ? ? ? ? x ? ? ? ? ? ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 ? 0 ? ? 0 ? x ? 0 0 0 0 0 ? ? 0 0 x 0 x 0 x 0 x 0 ? 0 0 ? ? ? x x x 0 0 0 ? ? 0 x x ? x 0 x 0 x 0 x x x 0 0 0 0 0 0 0 0 0 0 0 x x x x x x 0 0 0 0 ? ? 0 0 0 ? 0 0 x x x x 0 0 0 0 0 0 ? ? ? 0 ? 0 0 0 0 0 0 0 ? ? ? ? ? 0 0 0 0 0 0 ? ? ? ? 0 x ? 0 0 0 0 0 0 0 0 x x ? ? 0 ? 0 ? 0 ? 0 0 0 0 ? ? 0 x ? ? ? ? ? ? ? 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 ? ? 0 0 0 0 0 0 ? 0 0 ? ? ? ? ? 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 ? 0 0 0 ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 ? 0 0 0 ? 0 ? 0 0 0 0 0 ? ? ? 0 0 ? ? ? 0 ? 0 0 0 ? ? ? ? 0 0 0 ? 0 ? 0 ? 0 0 ? ? ? ? ? 0 ? x ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? x x ? ? ? ? ? ? ? ? ? ? ? ? x ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? 0 ? 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? ? ? ? ? ? ? ? ? 0 0 ? 0 0 0 0 0 0 ? 0 ? 0 ? 0 ? 0 0 0 0 ? ? 0 0 ? 0 ? 0 ? 0 ? 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 ? ?
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Files Modified

File Attributes
c:\users\user\vs_executions\c573f1326ddb33885b334b63512eef512c63fc0d_0000968192.html Generic Write,Read Attributes

Windows API Usage

Category API
User Data Access
  • GetComputerNameEx
  • GetUserDefaultLocaleName
  • GetUserObjectInformation
Other Suspicious
  • AdjustTokenPrivileges
Anti Debug
  • IsDebuggerPresent
  • NtQuerySystemInformation
Encryption Used
  • BCryptOpenAlgorithmProvider
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateMutant
Show More
  • ntdll.dll!NtCreatePrivateNamespace
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateThreadEx
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenDirectoryObject
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenProcess
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryDefaultLocale
  • ntdll.dll!NtQueryDirectoryFileEx
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationJobObject
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtResumeThread
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtUnmapViewOfSectionEx
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWriteFile
  • UNKNOWN

Trending

Most Viewed

Loading...