PUP.Gametool.PDB
The detection of PUP.Gametool.PDB on your system indicates the presence of a potentially unwanted program (PUP) that may be causing issues with your computer's performance and security. It's essential to understand the nature of this threat and take immediate action to remove it to prevent further problems.
Table of Contents
What Is PUP.Gametool.PDB?
PUP.Gametool.PDB is a type of potentially unwanted program that may have been installed on your system without your knowledge or consent. PUPs are often bundled with other software or downloaded from untrusted sources, and they can cause a range of issues, including slowing down your computer, displaying unwanted ads, and potentially leading to more severe security threats. The name "PUP.Gametool.PDB" suggests that it may be related to gaming tools or software, but it's crucial to treat it as a potential threat and take steps to remove it.
How PUP.Gametool.PDB Operates
PUP.Gametool.PDB, like other PUPs, can operate in various ways, including running in the background, collecting user data, and displaying unwanted advertisements. It may also attempt to install additional software or modify system settings without your permission. In some cases, PUPs can be used as a conduit for more severe malware, making it essential to remove them as soon as possible. Understanding how PUP.Gametool.PDB operates can help you take effective steps to remove it and prevent future infections.
Symptoms of Infection
Systems infected with PUP.Gametool.PDB may exhibit a range of symptoms, including slow performance, unwanted pop-ups or ads, and changes to browser settings or homepage. You may also notice unfamiliar programs or icons on your desktop or system tray. In some cases, PUPs can cause system crashes or freezes, making it difficult to use your computer. If you've noticed any of these symptoms, it's likely that your system is infected with PUP.Gametool.PDB or another type of malware.
How to Remove PUP.Gametool.PDB
- Boot your computer in Safe Mode with Networking to prevent PUP.Gametool.PDB from running and interfering with the removal process.
- Use a reputable anti-malware tool, such as SpyHunter, to perform a full scan of your system and detect any malicious files or programs associated with PUP.Gametool.PDB.
- Uninstall any suspicious programs or software that may be related to PUP.Gametool.PDB. Be cautious when uninstalling programs, as some may be legitimate or required by your system.
- Reset your web browsers, including Chrome, Firefox, and Edge, to their default settings to remove any changes made by PUP.Gametool.PDB.
- Reboot your computer and perform another scan with your anti-malware tool to ensure that PUP.Gametool.PDB has been completely removed.
Conclusion
Removing PUP.Gametool.PDB from your system is crucial to preventing further problems and protecting your personal data. By following the steps outlined above, you can effectively remove this potentially unwanted program and restore your system to a safe and secure state. Remember to always be cautious when downloading software or clicking on links, and keep your anti-malware tools up to date to prevent future infections. Regularly scanning your system and staying informed about potential threats can help you stay safe online and protect your computer from harm.
Analysis Report
General information
| Family Name: | PUP.Gametool.PDB |
|---|---|
| Signature status: | No Signature |
Known Samples
Known Samples
This section lists other file samples believed to be associated with this family.|
MD5:
cf33495ffffa6478f3373db09aba4ffe
SHA1:
4242c68acdb2d3505fb475bb3f2b072b820e643f
SHA256:
84CC9C4C4FF3E285B82B090CB9150C96C687E3AA520A08AA08265849BD57072A
File Size:
488.45 KB, 488448 bytes
|
|
MD5:
3c45817d96a3efbc59f6a02a15fa8aea
SHA1:
9554eb874c9046de34ddf1ec82674f4cca0ff222
SHA256:
55C3D8AA5173B9F42EE02273B0F5D8493D5FBC3EF4873779BF63D461FD37759E
File Size:
491.52 KB, 491520 bytes
|
|
MD5:
6dd13eee7353dc1711b2b4ced8fba302
SHA1:
70d97e0c04e9649d0779956cf7f95cbe3258a1dd
SHA256:
D8748DF91CC7593BEC3793C2EE2E9413EFBB6A7CD8EF8C3322DCAC923C63F599
File Size:
504.83 KB, 504832 bytes
|
|
MD5:
9fc521534c842eccbbbb7abe6614dd16
SHA1:
44a0d4e32280d717b6e1872febe877782573afac
SHA256:
86B1EC9A73D03AB97CE1BFCDE6D1006967DC2888323213B8847D44BBA7821D8F
File Size:
622.08 KB, 622080 bytes
|
|
MD5:
fcd314671419d105d9b4679a0fe57fd2
SHA1:
c650080425db259fb522e20660dfee81c3565d0c
SHA256:
47C6FAB2AA36943CE46CA54345DB0B4EB8A5B276E6D0667AA0CFE47B6824392B
File Size:
1.07 MB, 1069056 bytes
|
Show More
|
MD5:
df59dc450b1b234be508e08f58055b2e
SHA1:
d7699c8995910610d86f215232fa13c19fd9f5ed
SHA256:
4C947A844FE9CE04ED59E1289751F7AC16A4AFAD419ADA37CC25A00759CF090B
File Size:
566.78 KB, 566784 bytes
|
|
MD5:
709ee6aa96f90f9bfbf2f8b8c9489900
SHA1:
1c86629ff38a730c2205d19a632c19954c0d4d21
SHA256:
A8A4D862571CED9F5D790B1BC1EF9D2B48CD3C58D45C33EFFF826870CDEE61E0
File Size:
1.07 MB, 1070592 bytes
|
|
MD5:
489af6150c0bfa174cad1e6d1fd05398
SHA1:
aee852a114a3842a4cae21c49fb7caa926837427
SHA256:
1B4319F2C74DD8C2050BBDAF27BA12219F1819B8B9DBFFE7FDF9D5BD5BDFD422
File Size:
823.81 KB, 823808 bytes
|
|
MD5:
2cc86416a622d113e1e8a67030c5ae13
SHA1:
fbc4a390171ab36ecfceb87aa2c8d46182a74eac
SHA256:
0C63B8C584C6EAAFB8F0C97CC4AC29EE8FE37A962A590148AC7F26B829E5E7A0
File Size:
1.10 MB, 1101824 bytes
|
|
MD5:
5e0def9bd9ac1eace40a69ab5a841102
SHA1:
3425bc14509c7bf631453339af7330734a3dc0ff
SHA256:
0540051C6A9CA8F96C429673D94DB23EAC3EC319906917393A1F4F1E46A3D0F2
File Size:
690.69 KB, 690688 bytes
|
|
MD5:
b1127db578c45c5af8eb4a121f766bb3
SHA1:
0aa4348db0ea8df46b71977a2644f84a1af7ca31
SHA256:
DAE0786B42D2060AA804F963520B84F24950B176B67567DBBEFA2A2A0FDB7095
File Size:
490.50 KB, 490496 bytes
|
Windows Portable Executable Attributes
- File doesn't have "Rich" header
- File doesn't have exports table
- File doesn't have security information
- File has exports table
- File has TLS information
- File is 32-bit executable
- File is console application (IMAGE_SUBSYSTEM_WINDOWS_CUI)
- File is either console or GUI application
- File is GUI application (IMAGE_SUBSYSTEM_WINDOWS_GUI)
- File is Native application (NOT .NET application)
Show More
- File is not packed
- IMAGE_FILE_DLL is not set inside PE header (Executable)
- IMAGE_FILE_EXECUTABLE_IMAGE is set inside PE header (Executable Image)
File Icons
File Icons
This section displays icon resources found within family samples. Malware often replicates icons commonly associated with legitimate software to mislead users into believing the malware is safe.
Windows PE Version Information
Windows PE Version Information
This section displays values and attributes that have been set in the Windows file version information data structure for samples within this family. To mislead users, malware actors often add fake version information mimicking legitimate software.| Name | Value |
|---|---|
| Company Name |
|
| File Description |
|
| File Version |
|
| Internal Name | MinHookD |
| Legal Copyright |
|
| Legal Trademarks | Tsuda Kageyu |
| Original Filename | d3d8.dll |
| Product Name |
|
| Product Version |
|
File Traits
- dll
- fptable
- HighEntropy
- imgui
- No Version Info
- WriteProcessMemory
- x86
Block Information
Block Information
During analysis, EnigmaSoft breaks file samples into logical blocks for classification and comparison with other samples. Blocks can be used to generate malware detection rules and to group file samples into families based on shared source code, functionality and other distinguishing attributes and characteristics. This section lists a summary of this block data, as well as its classification by EnigmaSoft. A visual representation of the block data is also displayed, where available.| Total Blocks: | 1,021 |
|---|---|
| Potentially Malicious Blocks: | 248 |
| Whitelisted Blocks: | 569 |
| Unknown Blocks: | 204 |
Visual Map
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
?
x
x
0
?
0
0
0
0
0
0
0
0
?
0
?
0
0
0
0
0
0
?
?
0
0
?
0
?
?
?
0
?
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
0
0
0
0
0
?
0
0
0
0
0
x
0
?
0
0
?
0
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
?
0
0
0
0
0
0
?
?
x
x
0
0
0
0
0
0
0
0
?
0
0
0
?
0
0
0
0
0
0
?
0
0
0
0
?
?
?
?
x
?
0
0
0
0
0
0
0
0
0
0
0
0
?
0
0
0
0
0
0
?
0
x
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
x
0
x
0
0
0
0
0
0
0
?
?
?
?
0
0
0
0
?
0
0
0
0
0
?
?
?
0
0
0
x
0
0
0
0
?
0
?
0
0
0
?
?
?
?
?
?
?
0
0
0
?
0
0
0
?
0
0
?
x
0
?
0
0
?
0
?
0
0
0
0
?
?
?
0
0
?
?
?
?
?
?
0
?
x
?
0
x
?
?
?
x
0
x
x
x
0
0
x
0
x
0
0
0
0
0
0
0
x
?
x
0
0
0
0
x
0
0
x
x
x
x
x
0
x
0
x
x
0
0
0
0
0
0
0
0
0
x
?
x
?
x
x
?
?
0
0
?
x
x
?
?
x
x
0
0
x
x
x
?
x
x
x
x
0
0
x
x
0
?
?
0
0
x
0
?
x
x
x
x
?
?
?
?
?
0
0
0
x
x
x
x
?
x
x
?
?
x
0
?
?
x
?
x
0
0
0
0
0
x
?
?
0
?
x
x
x
0
0
0
0
?
x
x
x
x
x
x
0
0
?
x
x
x
x
x
x
x
?
x
x
0
0
x
0
0
0
0
?
x
x
x
x
0
0
0
?
?
x
0
0
0
0
x
x
0
x
?
x
x
x
0
?
0
0
x
?
x
0
?
?
0
?
x
x
x
?
0
?
0
x
x
?
x
?
x
?
x
0
0
?
x
x
0
0
0
0
x
x
x
x
x
x
0
x
x
0
0
x
0
0
x
0
0
0
x
x
x
0
0
0
x
x
0
x
x
0
x
0
x
?
x
x
x
x
x
x
0
x
0
x
x
x
x
x
x
x
x
0
0
0
0
0
0
0
0
x
0
0
0
0
x
x
0
x
0
x
0
0
0
0
0
0
0
0
0
x
x
x
0
x
x
0
0
x
x
0
0
0
x
x
x
0
0
0
0
0
0
0
0
?
0
x
x
x
?
x
x
x
?
x
0
0
0
0
0
x
x
x
0
x
0
x
0
0
0
x
0
0
0
0
0
?
0
x
?
?
x
?
?
?
?
?
0
0
?
?
?
x
x
?
?
?
0
?
?
?
x
0
x
?
?
x
x
?
?
?
?
x
0
0
0
?
?
x
0
?
?
?
?
?
?
?
?
?
?
x
?
x
0
0
?
0
?
x
?
x
0
?
x
x
0
0
x
0
x
x
x
0
x
?
?
x
0
0
0
0
0
0
0
0
?
?
?
?
x
x
?
x
x
0
0
0
0
0
?
?
?
x
0
0
x
0
x
?
?
?
?
0
x
x
?
0
0
?
?
x
0
x
x
0
0
0
x
0
x
0
x
0
?
0
0
x
x
?
?
0
0
?
0
x
x
1
x
0
0
?
0
x
x
0
x
x
?
0
x
0
x
?
x
x
0
0
?
0
x
x
0
0
x
0
0
0
0
x
?
?
0
0
?
?
?
x
x
x
?
?
?
?
0
x
x
0
x
?
0
?
x
x
?
0
x
?
?
?
?
0
?
x
x
?
?
x
?
0
0
x
0
x
0
x
x
x
x
0
?
0
0
x
0
0
0
0
x
?
?
x
0
x
0
0
0
x
0
0
x
x
0
x
?
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
2
0
0
0
0
0
0
0
0
0
1
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
1
0
0
1
0
0
0
0
0
0
0
0
0
0
2
0
0
1
0
0
0
0
1
0
1
0
0
0
0 - Probable Safe Block
? - Unknown Block
x - Potentially Malicious Block
? - Unknown Block
x - Potentially Malicious Block
Windows API Usage
Windows API Usage
This section lists Windows API calls that are used by the samples in this family. Windows API usage analysis is a valuable tool that can help identify malicious activity, such as keylogging, security privilege escalation, data encryption, data exfiltration, interference with antivirus software, and network request manipulation.| Category | API |
|---|---|
| Other Suspicious |
|
| Anti Debug |
|
| Syscall Use |
Show More
|
| Process Shell Execute |
|
| Process Manipulation Evasion |
|
Shell Command Execution
Shell Command Execution
This section lists Windows shell commands that are run by the samples in this family. Windows Shell commands are often leveraged by malware for nefarious purposes and can be used to elevate security privileges, download and launch other malware, exploit vulnerabilities, collect and exfiltrate data, and hide malicious activity.
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\9554eb874c9046de34ddf1ec82674f4cca0ff222_0000491520.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\44a0d4e32280d717b6e1872febe877782573afac_0000622080.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\c650080425db259fb522e20660dfee81c3565d0c_0001069056.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\1c86629ff38a730c2205d19a632c19954c0d4d21_0001070592.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\aee852a114a3842a4cae21c49fb7caa926837427_0000823808.,LiQMAxHB
|
Show More
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\fbc4a390171ab36ecfceb87aa2c8d46182a74eac_0001101824.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\3425bc14509c7bf631453339af7330734a3dc0ff_0000690688.,LiQMAxHB
|
C:\WINDOWS\SysWOW64\rundll32.exe C:\WINDOWS\system32\rundll32.exe c:\users\user\downloads\0aa4348db0ea8df46b71977a2644f84a1af7ca31_0000490496.,LiQMAxHB
|
