Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.FO

PUP.Gamehack.FO

By CagedTech in Potentially Unwanted Programs

Your system has been detected with a potentially unwanted program (PUP) known as PUP.Gamehack.FO. This detection indicates that your computer may be at risk due to the presence of this unwanted software. It is essential to understand the nature of this threat and take immediate action to remove it and protect your system from potential harm.

What Is PUP.Gamehack.FO?

PUP.Gamehack.FO is a type of potentially unwanted program that may have been installed on your computer without your knowledge or consent. PUPs are software applications that may not be malicious in nature but can still cause problems for your system, such as slowing it down, displaying unwanted advertisements, or collecting your personal data. The ".Gamehack" part of the name suggests that this PUP might be related to gaming, possibly offering cheats, hacks, or other unauthorized modifications to games.

How PUP.Gamehack.FO Operates

PUPs like PUP.Gamehack.FO often operate by installing themselves on your system through bundled software downloads, infected websites, or by exploiting vulnerabilities in your operating system or applications. Once installed, they can run in the background, consuming system resources, and potentially communicating with their command and control servers to download additional components or receive instructions. They may also display unwanted advertisements, modify your browser settings, or collect your browsing history and other personal data.

Symptoms of Infection

If your system is infected with PUP.Gamehack.FO, you may notice several symptoms, including slow system performance, unwanted pop-ups or advertisements, unexpected changes to your browser settings or homepage, and suspicious programs running in the background. You may also notice that your gaming experience is affected, with cheats or hacks being offered or applied without your consent. Additionally, you might see unfamiliar icons on your desktop or unexpected entries in your system's startup menu.

How to Remove PUP.Gamehack.FO

  1. Boot your computer in Safe Mode with Networking to prevent the PUP from loading and to allow for a more straightforward removal process.
  2. Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system. This will help detect and remove all components of PUP.Gamehack.FO.
  3. Uninstall any suspicious programs that you do not recognize or that were installed around the time the PUP was detected.
  4. Reset your web browsers (Chrome, Firefox, Edge) to their default settings to remove any unwanted changes made by the PUP.
  5. Reboot your computer and perform another scan with your anti-malware tool to ensure that all components of the PUP have been removed.

Conclusion

Removing PUP.Gamehack.FO from your system is crucial to prevent potential harm and protect your personal data. By following the steps outlined above, you can effectively remove this unwanted program and restore your system to a safe and secure state. It is also essential to practice safe computing habits, such as regularly updating your operating system and applications, using strong antivirus software, and being cautious when downloading software or clicking on links from unknown sources. By taking these precautions, you can significantly reduce the risk of your system being infected with PUPs like PUP.Gamehack.FO in the future.

Analysis Report

General information

Family Name: PUP.Gamehack.FO
Signature status: No Signature

Known Samples

MD5: 7bd3758400ff3f0ee1f1276be31a8169
SHA1: 314e3f97ba8ada87d8adffeb7f2f26e4796d10d0
SHA256: 3AD71981436184E669408B751E2B3170E856119DE6CD68C4035193A6364F20EE
File Size: 302.08 KB, 302080 bytes
MD5: d0dedc41ba2173d7c76742cd2d719499
SHA1: 435a24552f88be837938a3c3aaf8e6d5bc408b49
SHA256: 36F2C8467F1B131E01635B87B4BFA9DB1965A72F511197322A0E4539845168B3
File Size: 300.03 KB, 300032 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
Show More
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • HighEntropy
  • WriteProcessMemory
  • x86

Block Information

Total Blocks: 925
Potentially Malicious Blocks: 84
Whitelisted Blocks: 805
Unknown Blocks: 36

Visual Map

x ? 0 0 0 0 0 0 0 x 0 ? x x x ? x x 0 0 0 x x 0 0 0 0 0 0 0 x ? ? x x ? x x ? ? ? ? x x x x x x ? ? ? 0 0 x 0 x 0 0 x 0 x x ? ? x 0 x x x ? ? 0 ? ? 0 x x x x x x x x x x ? ? ? ? ? 0 ? x ? ? ? x x x x x x x ? ? 0 x x x x x x x ? ? ? ? 0 0 0 0 0 x 0 0 0 0 0 0 x x x x 0 x 0 x x x x x 0 x x 0 x x x x x x x x x x x x x 0 0 0 ? x 0 x 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 2 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 2 2 0 3 1 1 1 1 0 0 1 0 1 1 0 0 2 0 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtProtectVirtualMemory
Show More
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWriteFile
  • ntdll.dll!NtWriteVirtualMemory
  • win32u.dll!NtUserGetKeyboardLayout
  • win32u.dll!NtUserGetThreadState
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation
Process Manipulation Evasion
  • NtUnmapViewOfSection

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\314e3f97ba8ada87d8adffeb7f2f26e4796d10d0_0000302080.,LiQMAxHB
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\435a24552f88be837938a3c3aaf8e6d5bc408b49_0000300032.,LiQMAxHB

Related Posts

Trending

Most Viewed

Loading...