MSIL/GameHack.AMS potentially unsafe (file analysis)

The MSIL/GameHack.AMS potentially unsafe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/GameHack.AMS potentially unsafe virus can do?

CAPE extracted potentially suspicious content
Authenticode signature is invalid
Binary compilation timestomping detected

How to determine MSIL/GameHack.AMS potentially unsafe?


File Info:
name: 6040A7D2C95B27B75134.mlw
path: /opt/CAPEv2/storage/binaries/081156a16c6e412d118d35094b74fd07c2d09a7f98169bfcaed567a005c2c0f5
crc32: B7534AFD
md5: 6040a7d2c95b27b75134746a7bfbbdf3
sha1: 9b6524d2baaf7b3d0cbd5e7e35ffa1c05db10cbe
sha256: 081156a16c6e412d118d35094b74fd07c2d09a7f98169bfcaed567a005c2c0f5
sha512: 38412250288fd520d10c8fe0c40e13978378a4a9c849eb0d65bdd964bbc73f76cb0cf331e9bf87ade3866ae39c6000e9cecfa8878edaacfe0769e7b1f2339ae7
ssdeep: 1536:csS0h8N3LVkw2X45oglJDuoIrdzo98sA6vPEBpBzxkJQCGrA:csS0h8NfkcRfDuoIS98sXPEBpBzxkJrV
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T14A633A0177B85A2BC2FE5AFC5861412507F0A96A1667E7CD2DC4B4CE1AE2BC017E5B83
sha3_384: 4289eba72972d5cd8a022b7b48e16d41956ab356b5c753e5bf57df7e8b93733e44c99c83c0a487f79bc343a42c62eb9b
ep_bytes: ff250020400004000000090000000a00
timestamp: 2055-04-15 07:05:28

Version Info:
Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: AnimeSoftware
FileVersion: 1.0.0.0
InternalName: AnimeSoftware.exe
LegalCopyright: Copyright ©  2019
LegalTrademarks: 
OriginalFilename: AnimeSoftware.exe
ProductName: AnimeSoftware
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/GameHack.AMS potentially unsafe also known as:

Bkav	W32.Common.2A7F0FBC
Lionic	Trojan.Win32.Presenoker.4!c
Elastic	malicious (moderate confidence)
Skyhigh	Artemis
McAfee	Artemis!6040A7D2C95B
Cylance	unsafe
Sangfor	PUP.Win32.Presenoker.Vfr0
CrowdStrike	win/malicious_confidence_60% (D)
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GameHack.AMS potentially unsafe
Avast	Win32:MalwareX-gen [Trj]
Sophos	Generic Reputation PUA (PUA)
Antiy-AVL	RiskWare/MSIL.Gamehack
Microsoft	Program:Win32/Wacapew.C!ml
ViRobot	Adware.GameHack.69120
AhnLab-V3	Malware/Win32.RL_Generic.C3975373
Malwarebytes	Generic.Malware/Suspicious
Rising	PUA.Presenoker!8.F608 (CLOUD)
AVG	Win32:MalwareX-gen [Trj]
DeepInstinct	MALICIOUS

How to remove MSIL/GameHack.AMS potentially unsafe?

MSIL/GameHack.AMS potentially unsafe removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X