Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.GDDI

PUP.Gamehack.GDDI

By CagedTech in Potentially Unwanted Programs

Analysis Report

General information

Family Name: PUP.Gamehack.GDDI
Signature status: No Signature

Known Samples

MD5: 2f25515e4afae9f5e4bf76c31df726d9
SHA1: 8ff2fef4dd497f35df0a907f45cf98cc68095653
SHA256: 9361C89F316260D1AB3A72B4AEBF18CDD8A70287ABA4D2F1003DE1618263539A
File Size: 3.60 MB, 3601408 bytes
MD5: 155e22413435b7a8d916bc3511dbc3f3
SHA1: ac620c7812f018d17868d10eba89b0149de20ebc
SHA256: A8DD28464F62F1E6A1C7AB047C60123670354AB1D56A81D09ABDC8C61CF36654
File Size: 7.43 MB, 7434752 bytes
MD5: 0e89d894ff753b6863fe5e6779b616d7
SHA1: 86be507ba0527062f349fe5b10721336909db231
SHA256: CE9906D0238F4A08F29A59258BB9DD7DD6E632158F295882FAD2D9136BB43C36
File Size: 3.71 MB, 3709952 bytes
MD5: 026264c263b79e810070a07d6b8f2ec8
SHA1: 0fbba8858165161fd32a14eb27b2b91a3bfc3f18
SHA256: 0B9727C6C93D64F085F076C4EA18EE0F11E14CC25992529C3C10B66A8F815A08
File Size: 3.40 MB, 3401216 bytes
MD5: 42fa8332e80b66c3d6c74ced64573fba
SHA1: bcfb7c857b4bdd2e5bed0d441230aa8f717d6f68
SHA256: 542C28CF8E0CF8A693C71A880B395002EC66BCB2123C787FF6EAFBF6B7EB993F
File Size: 1.44 MB, 1443328 bytes
Show More
MD5: 09576cdc69f18132219b091301946592
SHA1: 36cfa55e3c39812bf3018e45fd7d4ab8616f4d8e
SHA256: 729B75E6A65AC1799A687E0269FA3D7ABA79299D21D9725F46CF4F62E923E663
File Size: 4.71 MB, 4706304 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have security information
  • File has TLS information
  • File is 64-bit executable
  • File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • fptable
  • GetConsoleWindow
  • HighEntropy
  • imgui
  • No Version Info
  • ntdll
  • VirtualQueryEx
  • WriteProcessMemory
  • x64

Block Information

Total Blocks: 5,482
Potentially Malicious Blocks: 346
Whitelisted Blocks: 4,877
Unknown Blocks: 259

Visual Map

0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 1 ? 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 x 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? 0 ? ? 0 0 0 0 x 0 0 ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? ? ? ? ? ? ? ? 0 ? ? ? ? ? ? 0 ? ? ? ? ? ? ? ? ? 0 0 0 0 0 0 ? 0 0 0 0 ? ? ? ? 0 ? 0 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? ? ? 0 ? 0 0 ? 0 ? ? 0 0 0 0 0 0 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 ? ? ? 0 0 0 0 0 0 0 ? 0 ? ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 ? ? ? ? 0 0 ? ? ? ? 0 ? ? 0 0 0 0 0 x ? ? 0 0 0 ? 0 0 0 0 0 x ? 0 0 0 0 ? ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 ? ? ? 0 0 ? ? 0 ? ? x 0 ? 0 ? 0 ? ? 0 0 ? 0 0 0 0 0 0 ? 0 ? ? 0 0 0 x 0 0 0 0 0 0 ? ? x x x ? ? x 0 0 0 x x 0 0 0 0 x x 0 0 x 0 x 0 0 0 x 0 0 0 0 0 0 0 0 0 x 0 0 0 x 0 0 0 x 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 x x 0 x 0 0 0 0 0 x 0 0 x x x 0 0 0 0 0 0 x x 0 0 x x x 0 x x 0 0 0 x x 0 0 0 0 x x x 0 0 x 0 0 x x 0 x 0 0 x x 0 x x 0 0 x 0 0 0 0 0 0 0 0 x 0 0 x 0 0 0 0 0 x 0 x 0 0 0 0 x 0 0 0 0 0 0 0 x x x 0 0 0 0 0 0 x 0 0 x x 0 0 0 0 0 0 x x 0 0 x x x x 0 0 0 x 0 x 0 x x x x 0 x 0 x 0 0 x 0 0 0 0 0 0 0 0 x 0 0 0 x x 0 x x x x 0 x x x x x 0 x x x x x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 x x 0 x 0 x 0 0 0 0 0 x 0 x 0 0 x 0 0 0 0 x 0 0 0 0 x 0 x x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 1 x 0 0 0 0 0 0 x x 0 x x 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 0 0 x 0 0 x x x 0 0 x x x 0 x 0 0 x 0 x 0 x x x x x 0 x 0 0 0 0 1 0 x 0 0 0 x 0 x x 0 x 0 x 0 0 x x 0 x 0 0 x 0 x x 0 x x 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 1 0 0 0 0 0 0 0 1 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x x x x x x 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 x 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 x 0 0 1 0 0 1 0 0 x 0 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x x x 0 0 x 0 0 0 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 0 0 x x 0 0 x 0 0 0 0 0 0 0 0 0 x 0 0 0 x 0 x 0 x 0 0 0 0 0 x x x x x 0 x x x 0 0 0 0 x x x x 0 0 0 0 x x 0 0 0 0 0 0 0 x 0 0 1 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 x 0 0 0 0 0 x 0 0 0 0 0 x 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 x 0 x 0 0 ? ? 0 x x x 0 0 0 0 0 0 x 0 0 0 0 0 0 0 x x x 0 x x 0 0 0 ? x ? 0 ? ? ? ? ? 0 ? x 0 x 0 0 0 x x x x 0 x 0 0 0 0 0 0 0 0 x ? 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 ? x 0 ? 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 x 0 x 0 0 0 0 0 0 0 0 0 x x 0 0 ? ? 0 x ? ? ? x ? x 0 ? x ? 0 x x 0 0 0 x ? ? x 0 ? x ? 0 ? ? 0 x 0 0 0 0 0 0 0 x 0 0 x x 0 0 0 ? ? ? ? ? ? 0 x x x 0 0 x x 0 x x x x x x x 0 0 x x 0 x x x x x x x 0 0 x x 0 x x x x x x 0 x 0 0 x x 0 0 x x x x x x 0 0 x x x 0 x x 0 0 x x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 x ? 0 ? 0 ? 0 0 1 0 0 0 0 x 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 1 x ? 0 x ? ? ? ? ? ? ? 0 ? 0 ? 0 ? ? ? 0 ? ? ? ? ? ? ? ? ? ? 0 ? ? ? 0 ? ? ? x 0 x x 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 ? 0 ? ? 0 ? ? ? ? ? ? ? ? ? 0 ? 0 ? x ? 0 ? ? ? 0 ? ? ? ? ? x ? 0 ? ? ? ? ? ? ? 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
... Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Similar Families

  • Gamehack.GDDI
  • Gamehack.GSM

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAccessCheck
  • ntdll.dll!NtAddAtomEx
  • ntdll.dll!NtAlertThreadByThreadId
  • ntdll.dll!NtAllocateLocallyUniqueId
  • ntdll.dll!NtAllocateReserveObject
  • ntdll.dll!NtAlpcConnectPort
  • ntdll.dll!NtAlpcConnectPortEx
  • ntdll.dll!NtAlpcCreatePort
  • ntdll.dll!NtAlpcCreateSecurityContext
  • ntdll.dll!NtAlpcDeleteSecurityContext
Show More
  • ntdll.dll!NtAlpcQueryInformation
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtApphelpCacheControl
  • ntdll.dll!NtAssociateWaitCompletionPacket
  • ntdll.dll!NtClearEvent
  • ntdll.dll!NtClose
  • ntdll.dll!NtConnectPort
  • ntdll.dll!NtCreateEvent
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateIoCompletion
  • ntdll.dll!NtCreateMutant
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtCreateSemaphore
  • ntdll.dll!NtCreateTimer
  • ntdll.dll!NtCreateTimer2
  • ntdll.dll!NtCreateWaitCompletionPacket
  • ntdll.dll!NtCreateWorkerFactory
  • ntdll.dll!NtDeviceIoControlFile
  • ntdll.dll!NtDuplicateObject
  • ntdll.dll!NtDuplicateToken
  • ntdll.dll!NtEnumerateKey
  • ntdll.dll!NtEnumerateValueKey
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenEvent
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenKeyEx
  • ntdll.dll!NtOpenMutant
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtOpenProcessTokenEx
  • ntdll.dll!NtOpenSection
  • ntdll.dll!NtOpenSemaphore
  • ntdll.dll!NtOpenThreadToken
  • ntdll.dll!NtOpenThreadTokenEx
  • ntdll.dll!NtProtectVirtualMemory
  • ntdll.dll!NtQueryAttributesFile
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryFullAttributesFile
  • ntdll.dll!NtQueryInformationFile
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationThread
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQueryKey
  • ntdll.dll!NtQueryLicenseValue
  • ntdll.dll!NtQueryObject
  • ntdll.dll!NtQueryPerformanceCounter
  • ntdll.dll!NtQuerySecurityAttributesToken
  • ntdll.dll!NtQuerySecurityObject
  • ntdll.dll!NtQuerySystemInformation
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtQueryWnfStateData
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtReadRequestData
  • ntdll.dll!NtReadVirtualMemory
  • ntdll.dll!NtReleaseMutant
  • ntdll.dll!NtReleaseSemaphore
  • ntdll.dll!NtReleaseWorkerFactoryWorker
  • ntdll.dll!NtRemoveIoCompletionEx
  • ntdll.dll!NtRequestWaitReplyPort
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationKey
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationThread
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtSetIoCompletionEx
  • ntdll.dll!NtSetTimer2
  • ntdll.dll!NtSubscribeWnfStateChange
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWaitForAlertByThreadId
  • ntdll.dll!NtWaitForMultipleObjects
  • ntdll.dll!NtWaitForSingleObject
  • ntdll.dll!NtWaitForWorkViaWorkerFactory
  • ntdll.dll!NtWaitLowEventPair
  • ntdll.dll!NtWorkerFactoryWorkerReady
  • ntdll.dll!NtWriteFile
  • UNKNOWN
Anti Debug
  • IsDebuggerPresent
User Data Access
  • GetUserObjectInformation
Keyboard Access
  • GetAsyncKeyState

Trending

Most Viewed

Loading...