PUP.Gamehack.LQ
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Popularity Rank: | 25,437 |
| Threat Level: | 10 % (Normal) |
| First Seen: | March 28, 2026 |
| Last Seen: | September 5, 2026 |
| OS(es) Affected: | Windows |
PUP.Gamehack.LQ is a detection name used to identify a potentially unwanted program (PUP) that targets Windows computers. While it is not classified as a highly dangerous threat, its presence on a system is generally unwelcome, as it can introduce unwanted changes, display intrusive content, or make unauthorized modifications to a user's browsing and computing experience. This article explains what this detection means, how such programs typically spread, and what steps users can take to protect themselves.
Table of Contents
What PUP.Gamehack.LQ Does
PUP.Gamehack.LQ is identified as a 64-bit Windows GUI application that does not carry a digital signature, meaning its publisher cannot be verified through standard trust mechanisms. The program's internal file description references "Informaal Software," though this label should not be mistaken for a reliable indicator of legitimacy, as PUPs often use generic or misleading descriptors.
Based on its behavior profile, this program interacts with low-level Windows system functions, including calls related to memory management, file writing, and registry key access. It also contains code capable of detecting whether it is being monitored or analyzed through debugging tools, a technique sometimes used by unwanted or suspicious software to evade detection or analysis. Additionally, it includes basic networking capability, suggesting it may attempt to communicate over the internet, which is typical for programs that fetch advertisements, additional components, or configuration data from remote servers.
As is typical for programs in the Gamehack PUP family, this type of application may attempt to alter browser settings, install additional toolbars or extensions, display unwanted advertisements, or bundle further software onto the affected machine without the user's clear understanding or consent.
How It Typically Gets Onto Computers
PUPs like this one commonly spread through software bundling, where they are packaged alongside free downloads, game modification tools, cracked software, or utilities from unofficial or third-party sources. Users often install these programs unintentionally by rushing through installation wizards and failing to notice pre-checked boxes authorizing the installation of extra software. In other cases, deceptive advertisements or misleading download buttons on file-sharing and gaming-related websites can lead users to install such programs without realizing it.
Risks for the User
Although classified with a low danger level, PUP.Gamehack.LQ can still create problems. Users may experience a degraded browsing experience due to unwanted advertisements, altered browser settings, or reduced system performance. Because the program lacks a verified digital signature and includes anti-debugging techniques, there is also a possibility it could be used to deliver further unwanted software or expose the system to additional risks if left unaddressed.
Signs of Infection
Users affected by this type of PUP may notice unexpected changes to their browser homepage or search engine, an increase in pop-up ads or sponsored content, unfamiliar toolbars or extensions appearing in web browsers, and new or unrecognized programs listed in their installed applications. A general slowdown in system performance may also occur.
How to Stay Protected
To avoid PUPs like this one, users should download software only from official and reputable sources, carefully read each step of installation wizards, and decline any bundled offers that are not explicitly desired. Keeping security software up to date and performing regular system scans can help detect and remove unwanted programs before they cause further issues. Reviewing installed programs and browser extensions periodically is also a good practice for maintaining a clean and secure system.
Analysis Report
General information
| Family Name: | PUP.Gamehack.LQ |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
ab8209e0c8bda776e59f5d1368af02ba
SHA1:
6be63e7494dba128ae908b85192bd9390128c801
SHA256:
1BEADBBF6E114C11CF4814355AADEFC5DF4816A52F23B466E0E328B55A6304A4
File Size:
883.71 KB, 883712 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File is 64-bit executable
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| File Description | Informaal Software |
| File Version | 1.0.0.1 |
File Traits
- ntdll
- x64
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 2,435 |
|---|---|
| Potentially Malicious Blocks: | 110 |
| Whitelisted Blocks: | 2,325 |
| Unknown Blocks: | 0 |
Visual Map
... Data truncated? - Unknown Block
x - Potentially Malicious Block
Similar Families
Similar Families
This section lists other families that share similarities with this family, based on EnigmaSoft’s analysis. Many malware families are created from the same malware toolkits and use the same packing and encryption techniques but uniquely extend functionality. Similar families may also share source code, attributes, icons, subcomponents, compromised and/or invalid digital signatures, and network characteristics. Researchers leverage these similarities to rapidly and effectively triage file samples and extend malware detection rules.- Gamehack.GSA
- Gamehack.LQ
- Trojan.Agent.Gen.EWD
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Syscall Use |
Show 22 more
|
| Anti Debug |
|
| Network Winsock2 |
|
