Gridinsoft Logo
File Icon

ExAltered-0.7.5.exe Trojan Heuristic Analysis

Updated 1 year ago
Checked by Malware Check
ExAltered-0.7.5.exe

Technical Analysis

File Name ExAltered-0.7.5.exe
File Type
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Scanner Version 1.0.158.174
Database Version 2024-02-11 02:00:41 UTC
⚠

Trojan.Heur!.02252123

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
69,514,240
File Size (bytes)
2024-02-11
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
aca31bb487d532595ebe0276b9e6845e
SHA1
6f26008d3c8afec4840063cb95ea6f08d01549fb
SHA256
071417d07e13fba923b30f42d8b9a23931721dccc6e61e16fdb3e50913c58fcd
SHA512
399709a18e3a59edb2f8b34451ded36b2df231eadbbd6c3a7be198de5c0235504166967d5f81610b40c9f99558aaf6f01c62e392a7b14f8728e7e82b52978885
ImpHash
f8249d26a592433be7af944028ea9c84

PE Analysis

Basic Information

▼
Icon
Hash: 9e581704d16472bc90f57d0a9cf10908
Fuzzy: 96b251ec3f5a62a487fea920646f422b
dHash: 55e8e8ccd4cce815
Image Base 0x140000000
Entry Point 0x1400013d0
Compilation Time 1970-01-01 00:00:00
Checksum 0x04264ec2 (Actual: 0x042510e4)
OS Version 4.0
PEiD Signatures PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 21 libraries
Exports 18 functions
Resources 9 Resources
Sections 13 Sections

Version Information

▼
CompanyName Wrong Timeline
FileDescription ExAltered
FileVersion 1.0.0.0
ProductName ExAltered
Licence MIT
LegalCopyright Copyright (c) 2007-2023 Juan Linietsky, Ariel Manzur and contributors
Info https://godotengine.org
ProductVersion 1.0.0.0
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 56,168,408 bytes 56,168,448 bytes 6.31 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A1FEE1D47C5B352F64FF15C0CBF7D66C
.data 0x03592000 308,032 bytes 308,224 bytes 1.80 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 3FF79F5B5F87B856143F25F90FF37C23
.rdata 0x035de000 9,895,856 bytes 9,895,936 bytes 6.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0770AFC4FE6E8F13F4104181451B84CE
pck 0x03f4e000 8 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ BF619EAC0CDF3F68D496EA9344137E8B
.pdata 0x03f4f000 1,212,480 bytes 1,212,928 bytes 7.09 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F5228975F4396433DC53C33CF69D7B19
.xdata 0x04078000 1,536,716 bytes 1,537,024 bytes 4.93 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3F44A5737E4BD1B3CC56A31FDC6D2E36
.bss 0x041f0000 1,789,120 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.edata 0x043a5000 1,096 bytes 1,536 bytes 4.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ AB99A77DEC2C296C0707DDB2C2FA2BD8
.idata 0x043a6000 20,068 bytes 20,480 bytes 4.98 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4CA0F25C44249DC8576D625B63881B53
.CRT 0x043ab000 112 bytes 512 bytes 0.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 292BEC37B223E7A9B959D436EDE9C5AA
.tls 0x043ac000 16 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.rsrc 0x043ad000 45,292 bytes 45,568 bytes 7.93 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 933C85C9F7028DBFAD3EE3FB49B314EB
.reloc 0x043b9000 321,044 bytes 321,536 bytes 5.46 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ BC52CE5505D5DD477CC7C27C913858BF
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (44,730 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 43,770 bytes
97.9%
RT_GROUP_ICON 2 180 bytes
0.4%
RT_VERSION 1 780 bytes
1.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.02252123 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.02252123 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware