PUA:Win32/GameHack (file analysis)

The PUA:Win32/GameHack is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PUA:Win32/GameHack virus can do?

Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine PUA:Win32/GameHack?


File Info:
crc32: CCB9B4DD
md5: 61259dc1ab8a6973c236717bf8e17c48
name: Bioshock-Infinite-v1.1.25.5165-Plus-15-Trainer.exe
sha1: 33f9826d06cbe842b88cdc4b62ab7f7007530462
sha256: 4aed63db45d25cc61acc94369f60c841c9f4252b86f88b4760b259f1ab552474
sha512: 91d530eb73a428dfc1aa1ecf53eef93b5c5bea7e1abbdfb59c18939ebcf3c5239cb915e6936c7cd40a131882f885432aeca514d6f9ff6d1c3fb1ab4f1119e0dc
ssdeep: 24576:8hYYkuR9utM2DSjxb2O45iMVnn+4KFJqsCBh56+mdG:7uRHVxD6PVQS5HqG
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x98cex7075x6708x5f71 (FLiNG@3DMGAME) Copyright (C) 2016
InternalName: Bioshock Infinite v1.1.25.5165 Plus 15 Trainer
FileVersion: 1.0.0.1
CompanyName: 3DMGAME
ProductName: Bioshock Infinite v1.1.25.5165 Plus 15 Trainer
ProductVersion: 1.0.432.0
FileDescription: FLiNG@3DMGAME Presents - Bioshock Infinite v1.1.25.5165 Plus 15 Trainer
OriginalFilename: Bioshock Infinite v1.1.25.5165 Plus 15 Trainer.exe
Translation: 0x0000 0x04b0

PUA:Win32/GameHack also known as:

CAT-QuickHeal	Trojan.IGENERIC
McAfee	GenericRXAA-AA!61259DC1AB8A
Malwarebytes	RiskWare.GameHack.Generic
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Unwanted-Program ( 004fdd5f1 )
K7GW	Unwanted-Program ( 004fdd5f1 )
Invincea	heuristic
ESET-NOD32	a variant of Win32/GameHack.AUM potentially unsafe
Paloalto	generic.ml
Alibaba	HackTool:Win32/Generic.3497c952
Rising	Trojan.Wacatac!8.10C01 (CLOUD)
Comodo	ApplicUnwnt@#21pnp4dh6y1rh
Zillya	Trojan.GameHack.Win32.1706
McAfee-GW-Edition	BehavesLike.Win32.Injector.tc
Fortinet	W32/GameHack.AUM
Trapmine	malicious.moderate.ml.score
Sophos	Generic PUA DD (PUA)
SentinelOne	DFI – Suspicious PE
Webroot	Pua.Gen
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.BTSGeneric
Endgame	malicious (high confidence)
Microsoft	PUA:Win32/GameHack
Cylance	Unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CJL19
Yandex	Riskware.Agent!
Ikarus	Trojan.Win32.Agent
eGambit	Generic.Malware
GData	Win32.Trojan.Agent.BSROAZ
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)
Qihoo-360	HEUR/QVM41.2.DB55.Malware.Gen

How to remove PUA:Win32/GameHack?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

PUA:Win32/GameHack (file analysis)