PUP.MSIL.HackAgent.NA
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 22,404 |
| Threat Level: | 10 % (Normal) |
| Infected Computers: | 3 |
| First Seen: | January 14, 2023 |
| Last Seen: | September 25, 2026 |
| OS(es) Affected: | Windows |
PUP.MSIL.HackAgent.NA is a detection name used to identify a potentially unwanted program (PUP) that has been compiled using the Microsoft Intermediate Language (MSIL), which is typical of applications built on the .NET framework. As with most entries in the "potentially unwanted program" category, this detection does not necessarily indicate a destructive virus or a sophisticated piece of malware. Instead, it flags software that may have been installed without the user's full knowledge or consent, and that behaves in ways that are intrusive, unwanted, or potentially risky.
Table of Contents
What This Threat Does
Programs detected as PUP.MSIL.HackAgent.NA typically fall into a broad category of software that performs actions the average user would not knowingly authorize. While the exact functionality of any individual sample can vary, PUPs in this general classification commonly display behaviors such as altering browser settings, injecting advertisements, collecting information about the user's system or browsing habits, or bundling additional software components that install alongside the main program. Some PUPs are designed to run background processes that consume system resources, while others may attempt to maintain persistence on the infected device by creating scheduled tasks, startup entries, or additional files that make them difficult to remove through conventional means.
Because this detection name includes "HackAgent," it suggests the software may be associated with tools that have hacking-related functionality, such as programs that interact with system processes, modify other software, or are used for purposes that security vendors consider suspicious or potentially harmful, even if they are not outright malicious in every case.
How It Usually Gets Onto Computers
Potentially unwanted programs like this one typically spread through common distribution methods. These include bundling with free software downloaded from third-party websites, deceptive advertisements that prompt users to download and install unfamiliar tools, and fake update prompts that trick users into installing unwanted components. Users may also encounter such programs when downloading cracked software, keygens, or other unofficial tools, as these are common vectors for PUPs and more dangerous threats alike. In many cases, users unknowingly agree to install these programs by quickly clicking through installation wizards without carefully reading each step.
Risks for the User
Although PUPs are generally considered less severe than traditional malware, they can still pose real risks. These may include exposure to intrusive advertising, degraded system performance, unwanted changes to browser or system settings, and potential privacy concerns if the software collects and transmits user data without clear consent. In some cases, PUPs can also serve as a gateway for more harmful software, either by weakening system defenses or by bundling with other unwanted or malicious programs.
Signs of Infection
Common indicators that a PUP may be present on a system include unexpected pop-up ads, a new toolbar or browser extension that wasn't intentionally installed, changes to the default search engine or homepage, sluggish system performance, and unfamiliar processes running in the background. Users might also notice unfamiliar programs listed in their installed applications that they do not recall installing.
How to Stay Protected
To reduce the risk of encountering programs like PUP.MSIL.HackAgent.NA, users should download software only from official and trusted sources, carefully review each step of installation wizards, and avoid bundled offers by choosing custom or advanced installation options whenever available. Keeping the operating system and installed software up to date, along with using reputable security tools and reviewing browser extensions regularly, can also help minimize exposure to unwanted programs.
Analysis Report
General information
| Family Name: | PUP.MSIL.HackAgent.NA |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
0664850af3b56f1935c65ca9581050a4
SHA1:
ce044923d06cbdfff389e6dfabc8909c7b4265a4
SHA256:
C9061211278018870C43924A8F952B0C79B6762908664BA09FD172B5EFC7C530
File Size:
2.17 MB, 2167808 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have debug information
- File doesn't have exports table
- File doesn't have security information
- File is .NET application
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Assembly Version | 2.2.0.0 |
| File Description | LSFlatPM |
| File Version | 2.2.0.0 |
| Internal Name | LSFlatPM.exe |
| Legal Copyright | Copyright © 2019 |
| Original Filename | LSFlatPM.exe |
| Product Name | LSFlatPM |
| Product Version | 2.2.0.0 |
File Traits
- .NET
- HighEntropy
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,433 |
|---|---|
| Potentially Malicious Blocks: | 27 |
| Whitelisted Blocks: | 800 |
| Unknown Blocks: | 606 |
Visual Map
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| User Data Access |
|
