Gridinsoft Logo

Archive.zip__ccacaxs2tbz2t6ob3e.exe Trojan Downloader Analysis

Updated 2 days ago
Checked by Malaware Check
Archive.zip__ccacaxs2tbz2t6ob3e.exe

Technical Analysis

File Name Archive.zip__ccacaxs2tbz2t6ob3e.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.217.174
Database Version 2025-05-31 00:00:22 UTC
⚠

Trojan.Win32.Downloader.ko!s1

Malware family: Downloader

Downloader Trojans specialize in retrieving and installing additional malware payloads. Unlike comprehensive malware, they focus specifically on payload delivery rather than direct system damage.
N/A
Detection Rate
440,320
File Size (bytes)
2025-05-31
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
a3cab1a43ff58b41f61f8ea32319386b
SHA1
94689e1a9e1503f1082b23e6d5984d4587f3b9ec
SHA256
005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6
SHA512
8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d
ImpHash
ecc8b2d72205d5666936947a45fa8392

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x0042c6ee
Compilation Time 2020-04-19 10:23:23
Checksum 0x00000000 (Actual: 0x00076ecf)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 9 libraries
KERNEL32, USER32, ADVAPI32, SHELL32, ole32, OLEAUT32, WININET, urlmon, RPCRT4
Exports 0 functions
Resources 1 Resources
Sections 5 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 296,444 bytes 296,448 bytes 6.38 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 84F839FB7A6A3CA982A81179DB0FF4DC
.rdata 0x0004a000 124,168 bytes 124,416 bytes 4.68 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CD01B9CA4D782540A759E74951C76C83
.data 0x00069000 8,008 bytes 4,608 bytes 3.55 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BEDBF1E06883EAC972B3788C0398C4A4
.rsrc 0x0006b000 488 bytes 512 bytes 4.77 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D55283D566B511F9B2C33D03E843BF9C
.reloc 0x0006c000 13,004 bytes 13,312 bytes 6.50 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 635D2D9F7C9696149785B611424FAE16
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 1 (392 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 392 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Downloader.ko!s1 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Downloader.ko!s1 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware