PUP.Gamehack.GYF
Your system has been detected with PUP.Gamehack.GYF, a potentially unwanted program that may pose risks to your computer's security and performance. It is essential to understand the nature of this threat and take immediate action to remove it to prevent potential harm.
Table of Contents
What Is PUP.Gamehack.GYF?
PUP.Gamehack.GYF is a type of potentially unwanted program that may have been installed on your computer without your knowledge or consent. It is not a virus, but it can still cause problems by modifying system settings, displaying unwanted advertisements, or collecting user data. The name "Gamehack" suggests that it may be related to gaming, but its actual purpose and behavior can vary.
How PUP.Gamehack.GYF Operates
PUP.Gamehack.GYF operates by installing itself on your computer, often through bundled software or deceptive downloads. Once installed, it can start modifying system settings, registry entries, or browser configurations to achieve its goals. It may also communicate with remote servers to receive updates, send user data, or display targeted advertisements. The program's behavior can be unpredictable and may cause system instability, crashes, or performance issues.
Symptoms of Infection
The symptoms of PUP.Gamehack.GYF infection can vary, but common signs include unwanted advertisements, pop-ups, or browser redirects. You may also notice changes in your system settings, such as altered homepage or search engine settings. Additionally, your computer may become slower, or you may experience frequent crashes or errors. In some cases, you may not notice any symptoms at all, which is why regular system scans and monitoring are crucial.
- Unwanted advertisements or pop-ups
- Browser redirects or changed search engine settings
- System slowdowns or performance issues
- Frequent crashes or errors
- Changes in system settings or configurations
How to Remove PUP.Gamehack.GYF
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full system scan and detect any related threats.
- Uninstall any suspicious programs or software that may be related to PUP.Gamehack.GYF.
- Reset your web browsers, such as Chrome, Firefox, or Edge, to their default settings to remove any modified configurations.
- Reboot your computer and perform another full system scan to ensure that the threat has been completely removed.
Conclusion
Removing PUP.Gamehack.GYF requires careful attention to detail and a thorough approach. By following the steps outlined above, you can help ensure that your system is clean and free from this potentially unwanted program. Remember to always be cautious when downloading software, and never install programs from untrusted sources. Regular system scans and monitoring can help prevent future infections and keep your computer running smoothly and securely.
Analysis Report
General information
| Family Name: | PUP.Gamehack.GYF |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
1a7bf74d5753f36b15dca42064230b70
SHA1:
7da551013dde1517e7b0fe848b8c995357a9d74a
SHA256:
6FF4E98F459A7E7CDBF48E4444728100D3C9C49A8867206297CE8363F235F408
File Size:
5.05 MB, 5046272 bytes
|
|
MD5:
feec0d4e29c50b775d2810c7b4c0f121
SHA1:
cd48d9a21ee948d55b3de894af9478ad2d7be9a0
SHA256:
6F41FE0BB53169E9F16ECDEE45B5CBEA3CB904647C00D5034B184C3B447FE8A7
File Size:
7.39 MB, 7386112 bytes
|
|
MD5:
311b5af3f2d73e9d9594608215a85ca5
SHA1:
a902c2436ac7b1ebff67a8e955808880a3053999
SHA256:
72CB6CD162E5CB845C6EA2AECBF50C320C218BF0C5788698B06AF5C2E40E6F68
File Size:
3.93 MB, 3929600 bytes
|
|
MD5:
09be9dc55bff8887a9c85b6467879e5a
SHA1:
d2246f8302a8357ddb4b852ca503f6001cbb74fc
SHA256:
489AAF6D62CADD729B5F2888A0807426AF44C0373B8AD77D228EAE45CCEB46D5
File Size:
7.54 MB, 7541248 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have relocations information
- File doesn't have security information
- File has TLS information
- File is 64-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
File Traits
- 2+ executable sections
- fptable
- HighEntropy
- imgui
- No Version Info
- ntdll
- VirtualQueryEx
- WriteProcessMemory
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 4,430 |
|---|---|
| Potentially Malicious Blocks: | 178 |
| Whitelisted Blocks: | 3,948 |
| Unknown Blocks: | 304 |
Visual Map
0
0
x
0
?
0
0
0
0
0
0
0
?
?
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
?
0
?
0
0
0
0
1
0
0
?
?
?
?
?
?
?
0
0
?
?
?
0
0
0
0
x
0
?
?
0
0
0
0
0
0
0
x
x
x
?
x
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
?
?
?
?
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
x
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
0
0
0
?
?
0
1
?
?
?
?
?
0
0
?
?
?
?
?
0
?
?
?
?
?
0
0
?
?
0
0
?
0
?
0
?
?
?
0
?
0
?
0
?
0
?
?
0
0
0
0
?
?
?
?
0
?
0
?
?
?
0
?
0
0
?
?
?
?
x
0
0
?
?
?
?
0
0
?
?
?
?
0
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
0
?
?
?
0
?
?
?
?
0
?
?
?
?
0
?
?
?
0
0
?
?
?
?
?
?
?
x
0
0
?
?
?
0
0
?
?
?
?
0
?
?
?
?
?
0
?
?
0
0
0
x
?
?
0
0
x
x
0
0
0
?
0
0
?
0
0
0
0
0
0
?
0
0
x
0
?
0
0
?
?
?
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
?
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
1
?
0
0
x
x
0
0
0
?
0
x
?
0
x
?
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
1
1
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
x
0
0
x
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
x
x
0
x
x
0
0
?
?
?
?
0
?
?
?
?
1
?
?
?
?
?
?
0
?
?
?
?
?
?
?
?
?
?
?
0
0
?
x
0
?
?
?
?
?
?
?
?
?
?
0
?
0
?
0
?
?
?
0
?
?
?
0
?
0
0
0
?
0
0
x
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
?
?
0
0
0
0
1
0
?
?
?
0
0
0
1
0
?
?
?
?
?
?
0
0
0
0
0
0
0
0
?
?
?
?
?
?
?
?
?
0
0
0
?
?
?
?
?
?
?
0
?
x
0
0
0
x
1
x
0
?
0
0
0
0
x
?
0
0
x
?
?
?
?
?
?
0
?
?
?
?
0
?
?
?
0
0
0
0
?
0
0
0
0
0
0
0
0
0
1
1
?
?
0
0
0
0
0
0
?
0
?
?
?
?
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
?
?
0
0
?
?
?
?
?
?
?
?
?
?
0
?
?
?
0
?
?
?
?
0
?
?
0
?
0
?
?
?
?
?
0
0
0
0
0
0
?
0
0
?
?
0
0
?
?
0
0
?
0
0
0
0
1
0
0
?
0
1
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
x
x
x
0
x
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
0
0
0
x
0
0
x
0
0
0
0
0
0
0
x
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
x
0
1
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
x
x
0
0
0
x
x
x
0
0
0
0
0
0
x
0
x
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
x
x
x
x
0
0
0
x
0
0
x
x
x
0
x
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
1
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
x
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
1
0
0
1
x
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
x
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
0
0
0
x
?
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
x
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
x
0
0
0
0
?
?
0
0
x
0
x
0
0
0
x
x
x
x
0
x
0
0
?
?
?
0
x
0
x
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
x
0
x
0
0
x
0
0
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
0
x
x
?
?
0
?
0
0
0
0
?
0
0
0
0
?
0
0
?
0
0
x
x
0
x
x
x
0
x
0
0
0
0
0
0
0
0
x
x
x
x
0
x
x
0
x
0
x
x
x
0
x
0
0
x
0
x
x
x
x
x
0
0
0
0
x
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
0
...
Data truncated
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Agent.KFS
- Agent.LKFB
- Agent.TRG
- ClipBanker.TI
- CoinMiner.LFA
Show More
- Coinminer.GOA
- Coinminer.GP
- Downloader.Agent.BTO
- Downloader.Agent.BTP
- Gamehack.EH
- Gamehack.GACH
- Gamehack.GYF
- NetSupport.A
- ShellcodeRunner.G
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show More
|
| Encryption Used |
|
| Network Winsock2 |
|
| Network Winsock |
|
| Anti Debug |
|
| User Data Access |
|
