Win32/GameHack.BOK potentially unsafe (file analysis)

The Win32/GameHack.BOK potentially unsafe is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/GameHack.BOK potentially unsafe virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect
Authenticode signature is invalid

How to determine Win32/GameHack.BOK potentially unsafe?


File Info:
name: D5E9D596F1AD294B39E9.mlw
path: /opt/CAPEv2/storage/binaries/22d7a0e1b97a26d5bb22f76a3a06984de7b6e4e7151dc60f07f70610d397f096
crc32: 8EB273BD
md5: d5e9d596f1ad294b39e910fa88ee9dab
sha1: 954e78852e7ed29a19b950c9881c66d1ac7786bd
sha256: 22d7a0e1b97a26d5bb22f76a3a06984de7b6e4e7151dc60f07f70610d397f096
sha512: 5342f6767b5598e46c44ffd6c4fd44a4051d043871e0b2cca04b506bdbf533f675aff55e0c8ef4fb690a27d5e58f26f20c34ad7b0a64ffb03c288713e3c626f3
ssdeep: 12288:kdpAkqFkIDl4PjkwKjOklpulWHYLiq6zn3cGgy/8MSNCmthx8wUogR:YphR/j5klpu996zMGl/GCmthKzogR
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T191E43353C90DDEF5F202CB78EEB48C7D733055264D9E994BE6C4A0F6A6133A1B82921D
sha3_384: 543e9b234ca6322ae7a5ce599064ef9629bf7c21368ff28074f17f7e6bff9fb42cdb2edd3d535315472fec619713f3f9
ep_bytes: 9cc704245be4c963e8a8adffff859edb
timestamp: 2017-07-23 16:00:13

Version Info:
0: [No Data]

Win32/GameHack.BOK potentially unsafe also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.5691800
FireEye	Generic.mg.d5e9d596f1ad294b
McAfee	Artemis!D5E9D596F1AD
Cylance	Unsafe
Sangfor	Trojan.Win32.Heuristic.rg
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.6f1ad2
BitDefenderTheta	Gen:NN.ZexaF.34294.OKW@aOwO1Uai
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GameHack.BOK potentially unsafe
Paloalto	generic.ml
BitDefender	Trojan.GenericKD.5691800
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.5691800
Sophos	Mal/Generic-R + Mal/VMProtBad-A
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
Emsisoft	Trojan.GenericKD.5691800 (B)
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.Kryptik.HK@susp
MaxSecure	Trojan.Malware.300983.susgen
Avira	HEUR/AGEN.1105689
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Arcabit	Trojan.Generic.D56D998
Microsoft	Trojan:Win32/Occamy.C22
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C2559762
Acronis	suspicious
ALYac	Trojan.GenericKD.5691800
APEX	Malicious
Rising	Trojan.Generic@ML.98 (RDMK:/BvrXgvdCySfhISF0fDkTw)
Yandex	Trojan.Agent!1JcAAhw6OnU
Ikarus	Trojan.Agent
eGambit	Trojan.Generic
Fortinet	W32/VMProtBad.A!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_80% (D)

How to remove Win32/GameHack.BOK potentially unsafe?

Win32/GameHack.BOK potentially unsafe removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X