Multi-License Discount Quote

Change Region

English
Threat Database Potentially Unwanted Programs PUP.Gamehack.GGD

PUP.Gamehack.GGD

By CagedTech in Potentially Unwanted Programs

The detection of PUP.Gamehack.GGD on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It is essential to understand the nature of this threat and take appropriate steps to remove it and prevent future infections.

What Is PUP.Gamehack.GGD?

PUP.Gamehack.GGD is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are often bundled with other software or downloaded from untrusted sources, and they can cause a range of problems, including slowing down your computer, displaying unwanted advertisements, and potentially compromising your personal data.

How PUP.Gamehack.GGD Operates

Once installed, PUP.Gamehack.GGD may operate in the background, collecting data about your browsing habits, searching for vulnerabilities in your system, or attempting to download additional malicious software. It may also modify your system settings, such as changing your default search engine or homepage, or installing unwanted toolbars or extensions. In some cases, PUPs like PUP.Gamehack.GGD may be used to distribute more severe malware, such as Trojans or ransomware.

Symptoms of Infection

If your system is infected with PUP.Gamehack.GGD, you may notice a range of symptoms, including poor system performance, unwanted pop-ups or advertisements, and unexpected changes to your browser settings. You may also experience issues with your internet connection, such as slow speeds or frequent disconnections. In some cases, you may notice that your system is running more slowly than usual, or that your browser is crashing frequently.

  • Unwanted advertisements or pop-ups
  • Changes to your browser settings or homepage
  • Poor system performance or slow speeds
  • Unexpected crashes or errors
  • Unexplained changes to your system settings

How to Remove PUP.Gamehack.GGD

  1. Boot your system in Safe Mode with Networking to prevent the PUP from loading and to allow you to download and install removal tools.
  2. Download and install a reputable anti-malware tool, such as SpyHunter, and run a full scan of your system to detect and remove PUP.Gamehack.GGD and any other malware that may be present.
  3. Uninstall any suspicious programs or software that you do not recognize or that you did not intentionally install.
  4. Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any unwanted extensions or toolbars.
  5. Reboot your system and run a follow-up scan with your anti-malware tool to ensure that the PUP has been completely removed.

Conclusion

Removing PUP.Gamehack.GGD from your system requires careful attention to detail and a thorough understanding of the steps involved. By following the guidance outlined above, you can help to ensure that your system is free from this potentially unwanted program and that you are protected against future infections. Remember to always be cautious when downloading software or clicking on links, and to keep your anti-malware tools up to date to stay protected against the latest threats.

Analysis Report

General information

Family Name: PUP.Gamehack.GGD
Signature status: No Signature

Known Samples

MD5: 510019674d3ef36b7427bb5f4cb94e7f
SHA1: d166e1b9ae29a03f3a6602d3d2ba02ed7912203a
SHA256: F0BBFF6F642EEF6C5C566C32A2FCE88557CE6725E221185FFFCCE2A3EA6B8D19
File Size: 1.01 MB, 1009152 bytes

Windows Portable Executable Attributes

  • File doesn't have "Rich" header
  • File doesn't have exports table
  • File doesn't have resources
  • File doesn't have security information
  • File has TLS information
  • File is 32-bit executable
  • File is either console or GUI application
  • File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
  • File is Native application (NOT .NET application)
  • File is not packed
Show More
  • IMAGE_FILE_DLL is not set inside PE header (Executable)
  • IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)

File Traits

  • dll
  • fptable
  • HighEntropy
  • WriteProcessMemory
  • x86

Block Information

Total Blocks: 1,713
Potentially Malicious Blocks: 187
Whitelisted Blocks: 1,404
Unknown Blocks: 122

Visual Map

? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x ? 0 0 0 0 ? ? ? ? ? 0 x ? 0 0 0 0 0 0 0 0 0 0 0 0 x x ? 0 ? 0 0 0 ? 0 0 ? x 0 ? 0 0 x x 0 0 0 0 0 0 x 0 ? ? 0 0 x ? 0 0 0 0 0 ? ? 0 ? ? ? ? x 0 ? 0 0 ? 0 x 0 0 0 ? ? x x 0 ? 0 x 0 0 ? 0 x ? 0 0 0 x 0 0 0 ? x ? ? ? ? 0 ? x ? 0 0 ? ? 0 ? 0 0 0 0 0 ? ? 0 0 0 0 ? 0 0 0 0 0 ? ? ? ? 0 0 0 0 0 0 ? 0 x 0 0 0 ? 0 0 0 0 0 0 ? x 0 0 x 0 ? x x ? ? x 0 0 0 0 0 0 0 ? ? ? 0 0 0 0 0 0 0 0 0 ? 0 0 x 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ? ? ? 0 0 ? 0 ? ? ? ? ? 0 ? ? ? ? 0 ? 0 ? 0 0 0 ? ? 0 ? 0 0 x 0 x 0 x 0 ? x 0 0 0 0 ? 0 0 0 0 0 x x 0 x 0 0 x x ? 1 x ? ? ? 0 0 0 0 0 0 ? 0 0 x 0 ? 0 x 0 ? ? 0 0 0 0 0 0 0 0 0 0 0 x 0 ? 0 0 0 0 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 ? 0 x 0 0 0 0 ? 0 x 0 0 0 0 ? 0 x 0 0 0 0 ? ? 0 x 0 ? ? ? x ? 0 ? ? 0 ? ? 0 x 0 x 0 0 0 0 0 0 x 0 0 x ? ? 0 0 0 0 0 0 ? 0 0 1 1 0 1 0 1 0 1 1 0 0 0 0 0 x 0 0 x 0 1 0 0 1 x 1 x 0 0 x 1 1 1 x 0 0 1 1 x 1 1 1 1 0 0 0 0 0 0 0 0 ? x 0 0 0 0 0 0 0 x x x x x 0 ? ? x x ? x x x x x ? ? ? x ? x x 0 x ? ? ? x ? x ? ? x x 0 x 0 x ? x 0 ? ? x x 0 x ? x x x x 0 0 0 0 x 0 0 x x 0 x 0 0 0 0 x 0 0 0 x 0 x 0 x x x 0 0 0 0 x x x 0 0 x x 0 x 0 0 0 0 x 0 0 0 0 0 x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 x x 0 x x x 0 0 0 0 0 0 0 x 0 0 x 0 0 0 x x x 0 0 0 0 0 x x 0 0 x x x ? x x x x 0 0 x x x x ? x x 0 x x x x 0 x x x x x 0 x 0 0 0 x x 0 x 0 0 x 0 0 0 x 0 x x 0 0 0 x x 0 x x x x 0 0 0 0 0 x x x 0 x x 0 0 0 x 0 0 0 0 0 0 0 0 0 0 x 0 x x 0 0 x 0 x x 0 0 0 x 0 x 0 0 x 0 x 0 x x x 0 0 x 0 0 0 0 x 0 x x 0 0 x x 0 0 0 x 0 0 0 0 0 0 0 0 0 x x 0 0 0 0 0 0 0 x 0 0 0 x x 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 1 0 1 0 1 3 1 1 0 0 0 0 2 0 0 0 0 1 0 0 0 2 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 1 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 2 2 0 1 0 0 0 0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block

Windows API Usage

Category API
Syscall Use
  • ntdll.dll!NtAlpcSendWaitReceivePort
  • ntdll.dll!NtClose
  • ntdll.dll!NtCreateFile
  • ntdll.dll!NtCreateSection
  • ntdll.dll!NtFreeVirtualMemory
  • ntdll.dll!NtMapViewOfSection
  • ntdll.dll!NtOpenFile
  • ntdll.dll!NtOpenKey
  • ntdll.dll!NtOpenProcessToken
  • ntdll.dll!NtQueryAttributesFile
Show More
  • ntdll.dll!NtQueryDebugFilterState
  • ntdll.dll!NtQueryInformationProcess
  • ntdll.dll!NtQueryInformationToken
  • ntdll.dll!NtQuerySystemInformationEx
  • ntdll.dll!NtQueryValueKey
  • ntdll.dll!NtQueryVirtualMemory
  • ntdll.dll!NtQueryVolumeInformationFile
  • ntdll.dll!NtReadFile
  • ntdll.dll!NtSetEvent
  • ntdll.dll!NtSetInformationFile
  • ntdll.dll!NtSetInformationProcess
  • ntdll.dll!NtSetInformationVirtualMemory
  • ntdll.dll!NtSetInformationWorkerFactory
  • ntdll.dll!NtTestAlert
  • ntdll.dll!NtTraceControl
  • ntdll.dll!NtUnmapViewOfSection
  • ntdll.dll!NtWriteFile
Process Manipulation Evasion
  • NtUnmapViewOfSection
Process Shell Execute
  • CreateProcess
Anti Debug
  • NtQuerySystemInformation

Shell Command Execution

C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\d166e1b9ae29a03f3a6602d3d2ba02ed7912203a_0001009152.,LiQMAxHB

Related Posts

Trending

Most Viewed

Loading...