Gridinsoft Logo
File Icon

Fusion.exe Trojan Wacatac Analysis

Updated 2 months ago
Checked by Malware Check
Fusion.exe

Technical Analysis

File Name Fusion.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.228.174
Database Version 2025-10-26 12:00:16 UTC
⚠

Trojan.Win64.Wacatac.sa

Malware family: Wacatac

Wacatac malware demonstrates multiple malicious capabilities including data theft, system compromise, and secondary payload deployment. It can download additional malware components including ransomware to extend attack impact.
N/A
Detection Rate
3,632,128
File Size (bytes)
2025-10-26
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
d6c5ad88466628daa1977611c8b08791
SHA1
67af55803afd817f950d9fb131dc5f011bc55350
SHA256
06389921006878d7b032069d47be1fa02143c66a80f96218a246825cf9c9b8f0
SHA512
7e0ce8f68cd1387e6affe5664df9bd6d6f699c98f290e7152daa98d57e361e0265b50e263a361decb94d4e181c3acaee3f982780add0b1c4e8d93ae39006e10d
ImpHash
e59f0cdb1cd19d7dd7ebcee9e02c5d28

PE Analysis

Basic Information

▼
Icon
Hash: e25d1cc545b98ad40308a83cea4fb32f
Fuzzy: bd5380067a97f53cc55454c9a7389ef9
dHash: f0dc3e9787b6d4f0
Image Base 0x140000000
Entry Point 0x14018b028
Compilation Time 2025-10-18 18:22:27
Checksum 0x00000000 (Actual: 0x00384253)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path C:\Users\DEV\source\repos\Fusion\build\Fusion.pdb
Digital Signature No valid SignedData structure was found.
Imports 12 libraries
Exports 0 functions
Resources 9 Resources
Sections 11 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,837,462 bytes 1,837,568 bytes 6.79 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ F42D6EB771C10068EBE3018A682E9690
.rdata 0x001c2000 291,992 bytes 292,352 bytes 5.93 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F640A695925C638361246913E927CAAF
.data 0x0020a000 525,548 bytes 467,456 bytes 6.90 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 9A2BB6650E30A7C15BFB2867D8035586
.pdata 0x0028b000 53,508 bytes 53,760 bytes 6.01 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 35C5B718E4A98760E84F0B0F9512647F
.00cfg 0x00299000 56 bytes 512 bytes 0.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9805F5FB0B79259A49B8D3354DED813F
.gxfg 0x0029a000 11,568 bytes 11,776 bytes 5.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 2AA629FFEAF2DC6B58AAF2B352EE0552
.retplne 0x0029d000 156 bytes 512 bytes 1.19 (Normal) 0x00000000 8B9AE47FB3104884F126FE65091065BF
.tls 0x0029e000 9 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1F354D76203061BFDD5A53DAE48D5435
_RDATA 0x0029f000 500 bytes 512 bytes 4.24 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DA7601C8CDA26304285A68E7F00BA649
.rsrc 0x002a0000 926,528 bytes 926,720 bytes 5.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6F7BC84E209E0145B5FDFFF9DE971D56
.reloc 0x00383000 39,420 bytes 39,424 bytes 5.44 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 8441063D264DED861D6FC4B22A360929
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (925,911 bytes)
Resource Type Count Total Size Percentage
TEXTFILE 1 882,572 bytes
95.3%
RT_ICON 6 42,663 bytes
4.6%
RT_GROUP_ICON 1 90 bytes
0%
RT_MANIFEST 1 586 bytes
0.1%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Wacatac.sa Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Wacatac.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware