Bab ttsf exe Adware Babylon File Malware Analysis: 4c765e81020e1950ee60804b331653ae

Technical Analysis

File Name	bab_ttsf.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.223.174
Database Version	2025-08-17 10:00:23 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	4c765e81020e1950ee60804b331653ae
SHA1	5f240da0371b11c0944c290277cb3e0546ae13fb
SHA256	0c6e86459a13c388d2b670b8643cf184c8a1ea0373ee71e3da4f868f0edce070
SHA512	109b35a28a63d37cfd79d30771a140ad5b77118fece769b6d7466658997e40e6197aa223d45e0e55e6ee7a325dee6d1c499d0a6227a1f810e8235c82289af355
ImpHash	4c59c0b3420ca0877a0e6c8146bdb593

PE Analysis

Basic Information

▼

Icon	Hash: 22144405e8179650885a755372d708e3 Fuzzy: a5138b120239973d73b83848aea501d5 dHash: f9d83869ccccec78
Image Base	`0x00400000`
Entry Point	`0x00403f8f`
Compilation Time	2001-01-09 14:09:05
Checksum	0x003299ec (Actual: 0x003299ec)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	OK
Imports	3 libraries USER32, KERNEL32, GDI32
Exports	0 functions
Resources	3 Resources
Sections	5 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	21,638 bytes	22,016 bytes	6.46 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`E221BB9839316C17FE5D237CFC21C85A`
`.rdata`	`0x00007000`	3,026 bytes	3,072 bytes	5.08 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F08A945B329E91D2622A9FAAAD1E057D`
`.data`	`0x00008000`	5,941 bytes	3,584 bytes	6.88 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`61A1B6955DF6BA35BF9BF1C9F8B4021C`
`.rsrc`	`0x0000a000`	1,288 bytes	1,536 bytes	3.14 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`71D0FC6540CBD5FDCDF8032B6CFCE79D`
`_winzip_`	`0x0000b000`	3,231,744 bytes	3,230,208 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`BC8337EB73B1BA77B0BA8BFC62BF4475`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 3 (778 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	2	744 bytes	95.6%
RT_GROUP_ICON	1	34 bytes	4.4%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

OK

Bab_ttsf.exe Adware Babylon Analysis