PUP.Gamehack.DBS

Your system has been detected with a potentially unwanted program (PUP) known as PUP.Gamehack.DBS. This detection indicates that your computer may be compromised with a program that could pose risks to your system's security and performance. It is essential to understand the nature of this threat and take appropriate steps to remove it to prevent potential harm.

What Is PUP.Gamehack.DBS?

PUP.Gamehack.DBS is categorized as a potentially unwanted program, which means it is not necessarily malware but can still cause issues with your system. PUPs are often installed alongside other software without the user's full knowledge or consent. They can range from annoying adware that displays unwanted advertisements to more serious threats that could compromise your system's security or privacy. The term "Gamehack" in the detection name suggests it might be related to gaming, possibly offering cheats or hacks, but this does not necessarily imply its primary function or the extent of its capabilities.

How PUP.Gamehack.DBS Operates

PUPs like PUP.Gamehack.DBS typically operate by integrating themselves into your system in a way that makes them difficult to detect and remove. They might modify system settings, add themselves to startup programs, or even install additional software. Their operation can lead to a range of issues, including but not limited to, slowing down your computer, displaying unwanted ads, or even collecting personal data without your consent. Understanding how PUPs operate is crucial for effective removal and prevention of future infections.

Symptoms of Infection

Symptoms of a PUP infection can vary widely depending on the specific program and its intentions. Common signs include unexpected pop-ups or advertisements, new toolbars or extensions in your browser that you did not install, changes in your browser's homepage or search engine, slow performance of your computer, or suspicious programs running in the background. If you have noticed any of these symptoms, it is likely that your system is infected with PUP.Gamehack.DBS or another form of malware.

How to Remove PUP.Gamehack.DBS

1. Enter Safe Mode with Networking to prevent the PUP from loading and to give you a clean environment to work in.
2. Perform a full scan of your system using a reputable anti-malware tool such as SpyHunter. This will help identify and remove all components of the PUP.
3. Uninstall suspicious programs that you do not recognize or no longer need. Be cautious and ensure you are removing the correct programs to avoid damaging your system.
4. Reset your browsers (Chrome, Firefox, Edge, etc.) to their default settings. This can help remove any unwanted extensions or settings changes made by the PUP.
5. Reboot your computer and then perform another scan with your anti-malware tool to ensure all threats have been removed.

Conclusion

Removing PUP.Gamehack.DBS from your system is crucial to maintaining its security and performance. By following the steps outlined above, you should be able to successfully remove this potentially unwanted program. It's also important to practice good computer hygiene to prevent future infections, such as being cautious with downloads, keeping your software up to date, and regularly scanning your system for threats. Remember, prevention is key, and staying informed about potential threats like PUP.Gamehack.DBS is the first step in protecting your digital world.

Analysis Report

General information

Family Name:	PUP.Gamehack.DBS
Signature status:	No Signature

Known Samples

i

Known Samples

This section lists other file samples believed to be associated with this family.

MD5: d7cf18648d826f0025cb40e26fa7d525 SHA1: 30faff52c4fff0ad6886e66f871deda41527eb1b SHA256: 0808ECBE49323D7BB321045422EC0E1A92E67BCFFE2B9BBFAA877453F216556D File Size: 2.00 MB, 1997091 bytes

MD5: 09a68c965ad741722cbf389c7aa01363 SHA1: 59c954cf6c1c4d11cd2fcbf2c9b85b413de394a7 SHA256: AEA182AC6E33797D6FDC6E26EA6E827A8B827D77D38DD28FC56EB4B36BF3D51C File Size: 2.69 MB, 2694627 bytes

Windows Portable Executable Attributes

i

Windows Portable Executable Attributes

This section lists file attributes found within family samples. These attributes are extracted from the files’ Windows PE (Portable Executable) specification and various system flags. Portable Executable Attributes give malware researchers insight into a file’s functionality, executable details, platform and runtime environment.

• File doesn't have "Rich" header
• File doesn't have debug information
• File doesn't have exports table
• File doesn't have relocations information
• File doesn't have security information
• File has exports table
• File is 32-bit executable
• File is either console or GUI application
• File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
• File is Native application (NOT .NET application)

Show More

• File is not packed
• IMAGE_FILE_DLL is not set inside PE header (Executable)
• IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Icons

i

File Icons

This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.

Windows PE Version Information

i

Windows PE Version Information

This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.

Name	Value
File Version	1.00
Internal Name	TJprojMain
Original Filename	TJprojMain.exe
Product Name	Project1
Product Version	1.00

File Traits

• No Version Info
• WriteProcessMemory
• x86

Files Modified

i

Files Modified

This section lists files that were created, modified, moved and/or deleted by samples in this family. File system activity can provide valuable insight into how malware functions on the operating system.

File	Attributes
c:\users\user\appdata\local\temp\rarsfx0\__tmp_rar_sfx_access_check_1771187	Generic Read,Write Data,Write Attributes,Write extended,Append data
c:\users\user\appdata\local\temp\rarsfx0\ezmapperinjector64.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\ezmapperinjector64.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\ezvacbypass.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\ezvacbypass.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\handycontrol.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\handycontrol.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\languages	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\languages	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\languages\strings.json	Generic Write,Read Attributes

Show More

c:\users\user\appdata\local\temp\rarsfx0\languages\strings.json	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\newtonsoft.json.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\newtonsoft.json.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\ninjacs.exe	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\ninjacs.exe	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.buffers.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.buffers.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.collections.immutable.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.collections.immutable.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.memory.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.memory.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.numerics.vectors.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.numerics.vectors.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.reflection.metadata.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.reflection.metadata.dll	Synchronize,Write Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.runtime.compilerservices.unsafe.dll	Generic Write,Read Attributes
c:\users\user\appdata\local\temp\rarsfx0\system.runtime.compilerservices.unsafe.dll	Synchronize,Write Attributes
c:\users\user\appdata\roaming\microsoft\windows\recent\automaticdestinations\f01b4d95cf55d32a.automaticdestinations-ms	Generic Read,Write Data,Write Attributes,Write extended,Append data

Registry Modifications

i

Registry Modifications

This section lists registry keys and values that were created, modified and/or deleted by samples in this family. Windows Registry activity can provide valuable insight into malware functionality. Additionally, malware often creates registry values to allow itself to automatically start and indefinitely persist after an initial infection has compromised the system.

Key::Value	Data	API Name
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::proxybypass		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::intranetname		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::uncasintranet		RegNtPreCreateKey
HKCU\software\microsoft\windows\currentversion\internet settings\zonemap::autodetect		RegNtPreCreateKey

Windows API Usage

i

Windows API Usage

This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.

Category	API
Anti Debug	IsDebuggerPresent NtQuerySystemInformation
User Data Access	GetComputerNameEx GetUserDefaultLocaleName GetUserObjectInformation
Keyboard Access	GetKeyState
Process Shell Execute	ShellExecuteEx
Syscall Use	ntdll.dll!NtAlertThreadByThreadId ntdll.dll!NtAlpcSendWaitReceivePort ntdll.dll!NtApphelpCacheControl ntdll.dll!NtClearEvent ntdll.dll!NtClose ntdll.dll!NtCreateEvent ntdll.dll!NtCreateFile ntdll.dll!NtCreateMutant ntdll.dll!NtCreatePrivateNamespace ntdll.dll!NtCreateSection Show More ntdll.dll!NtCreateSemaphore ntdll.dll!NtCreateThreadEx ntdll.dll!NtDeviceIoControlFile ntdll.dll!NtDuplicateObject ntdll.dll!NtEnumerateKey ntdll.dll!NtEnumerateValueKey ntdll.dll!NtFreeVirtualMemory ntdll.dll!NtMapViewOfSection ntdll.dll!NtOpenDirectoryObject ntdll.dll!NtOpenEvent ntdll.dll!NtOpenFile ntdll.dll!NtOpenKey ntdll.dll!NtOpenKeyEx ntdll.dll!NtOpenProcess ntdll.dll!NtOpenProcessToken ntdll.dll!NtOpenSection ntdll.dll!NtOpenThreadToken ntdll.dll!NtProtectVirtualMemory ntdll.dll!NtQueryAttributesFile ntdll.dll!NtQueryDefaultLocale ntdll.dll!NtQueryDirectoryFileEx ntdll.dll!NtQueryFullAttributesFile ntdll.dll!NtQueryInformationFile ntdll.dll!NtQueryInformationJobObject ntdll.dll!NtQueryInformationProcess ntdll.dll!NtQueryInformationThread ntdll.dll!NtQueryInformationToken ntdll.dll!NtQueryKey ntdll.dll!NtQueryLicenseValue ntdll.dll!NtQueryPerformanceCounter ntdll.dll!NtQuerySecurityAttributesToken ntdll.dll!NtQuerySecurityObject ntdll.dll!NtQuerySystemInformation ntdll.dll!NtQuerySystemInformationEx ntdll.dll!NtQueryValueKey ntdll.dll!NtQueryVirtualMemory ntdll.dll!NtQueryVolumeInformationFile ntdll.dll!NtReadFile ntdll.dll!NtReleaseMutant ntdll.dll!NtReleaseWorkerFactoryWorker ntdll.dll!NtResumeThread ntdll.dll!NtSetEvent ntdll.dll!NtSetInformationKey ntdll.dll!NtSetInformationProcess ntdll.dll!NtSetInformationThread ntdll.dll!NtSetInformationVirtualMemory ntdll.dll!NtTestAlert ntdll.dll!NtTraceControl ntdll.dll!NtUnmapViewOfSection ntdll.dll!NtUnmapViewOfSectionEx ntdll.dll!NtWaitForMultipleObjects ntdll.dll!NtWaitForSingleObject ntdll.dll!NtWaitForWorkViaWorkerFactory ntdll.dll!NtWaitLowEventPair ntdll.dll!NtWriteFile UNKNOWN
Encryption Used	BCryptOpenAlgorithmProvider
Other Suspicious	SetWindowsHookEx

Shell Command Execution

i

Shell Command Execution

This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.

(NULL) C:\Users\Fsgvilvq\AppData\Local\Temp\RarSFX0\NinjaCS.exe