PUP.MSIL.Gamehack.CJI
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 22,943 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 46 |
| First Seen: | October 27, 2023 |
| Last Seen: | October 18, 2026 |
| OS(es) Affected: | Windows |
PUP.MSIL.Gamehack.CJI is a detection name used to flag a potentially unwanted program (PUP) that targets Windows systems. While it is not classified as a severe threat, with a danger level of 1 out of 10, its presence on a computer is still considered undesirable because of the unpredictable and sometimes intrusive behavior associated with this type of software. This detection has been observed on Windows machines, with the threat remaining active in the field over an extended period of time, indicating it continues to circulate.
Table of Contents
What PUP.MSIL.Gamehack.CJI Does
As its name suggests, this detection is associated with "game hacking" style utilities — tools often marketed as cheats, trainers, or modification programs for video games. It is built as a .NET application and packaged as a 32-bit file. Internally, the file identifies itself with names like "MalachiTemp" and references a "Project Malachi" template, suggesting it may have been created using a generic development framework rather than being a unique, purpose-built application.
Like many programs in the Possibly Unwanted Program category, this software may not be inherently destructive, but it can still engage in behavior that users did not explicitly agree to or fully understand at the time of installation. This can include altering system settings, running background processes, injecting code into other applications (a common technique for game-hacking tools), or performing actions that interfere with normal system operation. Because the file lacks a digital signature, there is no verified assurance of its publisher or integrity, which adds an extra layer of uncertainty about its true purpose and safety.
How It Usually Gets Onto Computers
PUPs like this one typically make their way onto computers through software bundling, where they are included as optional add-ons during the installation of other free programs, game modifications, or third-party downloaders. Users often encounter these tools while searching for game cheats, trainers, or hacks from unofficial websites, forums, or file-sharing platforms. In many cases, the unwanted program is installed alongside the intended download, sometimes with little clear disclosure, relying on users quickly clicking through installation prompts without carefully reviewing each step.
Risks for the User
Although classified as low danger, this type of detection can still pose several risks. Game-hacking tools of this nature are frequently flagged by anti-cheat systems, potentially resulting in game account bans or suspensions. Additionally, since the file is unsigned and sourced from informal or unofficial channels, there is an increased risk that it could be bundled with more harmful components, exhibit unwanted background activity, or consume system resources without the user's full awareness or consent.
Signs of Infection
Users may notice unfamiliar processes running in the background, unexpected changes to system or game behavior, reduced system performance, or the appearance of files and folders they do not recognize. In some cases, security software may flag or quarantine the file during a routine scan, which is often how users first become aware of its presence.
How to Stay Protected
To reduce the risk of encountering PUPs like this one, users should avoid downloading game cheats, trainers, or modification tools from unofficial or unverified sources. Always choose custom installation options when installing new software so that bundled extras can be reviewed and deselected. Keeping security software up to date and performing regular system scans can also help detect and remove unwanted programs before they cause further issues.
Analysis Report
General information
| Family Name: | PUP.MSIL.Gamehack.CJI |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
bb5f9243737f209aca3d56e8f33659fa
SHA1:
dfde3c67a6e76771012e66372c58eaf880b6cf68
SHA256:
C4D70B0D5AB7579C2422D3F4FCA47FF3F626CBD24775D8E78CD1903D0D069BBB
File Size:
103.42 KB, 103424 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 1.0.0.0 |
| Comments | A Perfect Template Made By Malachi |
| Company Name | Project Malachi |
| File Description | MalachiTemp |
| File Version | 1.0.0.0 |
| Internal Name | MalachiTemp.dll |
| Legal Copyright | Copyright Project Malachi© 2024 |
| Original Filename | MalachiTemp.dll |
| Product Name | MalachiTemp |
| Product Version | 1.0.0.0 |
File Traits
- .NET
- dll
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 112 |
|---|---|
| Potentially Malicious Blocks: | 21 |
| Whitelisted Blocks: | 15 |
| Unknown Blocks: | 76 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
