The πš‚π™΄πšƒπš„π™Ώ exe (ExpressCenter) File Malware Analysis
Gridinsoft Logo
File Icon

The πš‚π™΄πšƒπš„π™Ώ.exe (ExpressCenter) File Analysis

Updated 7 months ago
Checked by Malware Check
πš‚π™΄πšƒπš„π™Ώ.exe

Technical Analysis

File Name πš‚π™΄πšƒπš„π™Ώ.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
98304:b+Y4yOsY1DUJNpmfWIMB8ks6XvjrNYPBnKSjAqJZP0h07aXcnwmIuS:b+Y4DGP8kNnmPBnKSjVZP0h08cnwmXS
Scanner Version 1.0.216.174
Database Version 2025-05-10 05:00:18 UTC
⚠

Suspicious File Detected

Detected by 10 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
14%
Detection Rate
8,748,172
File Size (bytes)
10/71
Engines Detected
2025-05-10
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
2231c70dc26cf6e38ed6633cadbca0da
SHA1
f63baab14e5901e1295b300f7b90fb1f6e97d128
SHA256
0d5e1c904bfc8d4060d2d36b838e2d711bc0a7ab32df7c9757ebe867618e6ee4
SHA512
7f4eea0e87df961aca2c874b9647580b3992fb5896d193523c342d649644b6b0229d90cd6f925dd0ef4a638a4d440a2bdb050df24bef767e3464caf02a01c3a2
ImpHash
05fff97ec2c4cb1ddc727302ede2bd30

Security Engines with Detections (10 of 71)

Elastic
malicious (high confidence) Malicious
CrowdStrike
win/malicious_confidence_60% (W) Malicious
VirIT
Trojan.Win32.GenHeur.B Malicious
Kaspersky
UDS:Trojan-PSW.Win32.Lumma.gen Malicious
Trapmine
malicious.high.ml.score Malicious
Microsoft
Program:Win32/Wacapew.C!ml Malicious
Cylance
Unsafe Malicious
Rising
Trojan.Injector!1.127AD (CLASSIC) Malicious
MaxSecure
Trojan.Malware.300983.susgen Malicious
DeepInstinct
MALICIOUS Malicious
61 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

β–Ό
Icon
Hash: 76e9159b43b391a32de5d670cfdb0c78
Fuzzy: 14cec401383dad6928eade775b9ce5bc
dHash: f0e8cc86a6ccf870
Image Base 0x00400000
Entry Point 0x00523349
Compilation Time 2018-07-04 09:14:22
Checksum 0x0339d456 (Actual: 0x008649e9)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 18 libraries
Exports 0 functions
Resources 109 Resources
Sections 5 Sections

Version Information

β–Ό
FileDescription ExpressCenter
FileVersion 1, 20, 0, 1
InternalName ExpressCenter
LegalCopyright Copyright (c) 2012 - 2014 by OpenCloner Inc.
OriginalFilename ExpressCenter.exe
ProductName OpenCloner Express Center
ProductVersion 1, 20, 0, 1
Translation 0x0000 0x04b0

PE Sections

β–Ό
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,362,652 bytes 1,362,944 bytes 6.55 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 45FDD5993A613FF7AF808F3EF14DB550
.rdata 0x0014e000 302,756 bytes 303,104 bytes 5.09 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F71A663F996A99CEFA717AD89DB6FBC9
.data 0x00198000 64,832 bytes 31,232 bytes 4.62 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 6EEAEAE67976089886F3C7A5C18A621A
.rsrc 0x001a8000 2,091,760 bytes 2,092,032 bytes 7.04 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E96C1C150F20AA552EC0FA91609D08F9
.reloc 0x003a7000 713,728 bytes 713,728 bytes 7.49 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 7CA9E57F07B19B1E6586A03750A52CB6
Entropy Analysis Alert

3 section(s) with elevated entropy (β‰₯6.5) - possible compression

Resource Analysis

β–Ό
Total Resources: 109 (2,086,109 bytes)
Resource Type Count Total Size Percentage
IMG 3 39,516 bytes
1.9%
TEXT 1 1,521 bytes
0.1%
ZIP 1 734,089 bytes
35.2%
RT_CURSOR 17 5,108 bytes
0.2%
RT_BITMAP 31 857,856 bytes
41.1%
RT_ICON 15 441,976 bytes
21.2%
RT_DIALOG 9 1,436 bytes
0.1%
RT_STRING 13 2,698 bytes
0.1%
RT_GROUP_CURSOR 16 334 bytes
0%
RT_GROUP_ICON 1 216 bytes
0%
RT_VERSION 1 752 bytes
0%
RT_MANIFEST 1 607 bytes
0%

Certificate Chain Analysis

β–Ό
Certificate Information
Product OpenCloner Express Center
Description ExpressCenter
File Version 1, 20, 0, 1
Original Name ExpressCenter.exe
Signing Date 04:25 PM 02/27/2025 (290 days ago)
Verification Status The digital signature of the object did not verify.
Signers Miray Software AG; Sectigo Public Code Signing CA R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
Counter Signers DigiCert Timestamp 2024; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Internal Name ExpressCenter
Copyright Copyright (c) 2012 - 2014 by OpenCloner Inc.
Certificate Chain Summary
Miray Software AG #1 Primary
Validity Period: 2023-04-05 00:00:00 β†’ 2026-07-04 23:59:59
Signature Algorithm: sha384RSA
Serial Number: A9 98 54 37 FA 60 5F AB 1B F3 47 BC B3 E9 C0 55
AAA Certificate Services #2 Chain
Validity Period: 2004-01-01 00:00:00 β†’ 2028-12-31 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 01
Sectigo Public Code Signing Root R46 #3 Chain
Validity Period: 2021-05-25 00:00:00 β†’ 2028-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16
Sectigo Public Code Signing CA R36 #4 Chain
Validity Period: 2021-03-22 00:00:00 β†’ 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 62 1D 6D 0C 52 01 9E 3B 90 79 15 20 89 21 1C 0A
Sectigo Public Time Stamping Root R46 #5 Chain
Validity Period: 2021-03-22 00:00:00 β†’ 2038-01-18 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 36 C2 B0 BD 7C 1B 3A E7 A3 B3 DD 36 CB C9 75 68
Sectigo Public Time Stamping CA R36 #6 Chain
Validity Period: 2021-03-22 00:00:00 β†’ 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 7A 23 AE DA 53 69 96 0F 91 C8 3E 5C F4 C7 E3 3F
Sectigo Public Time Stamping Signer R35 #7 Chain
Validity Period: 2024-01-15 00:00:00 β†’ 2035-04-14 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 3A 52 6A 2C 84 CE 55 E6 1D 65 FC CC 12 D8 E9 89
DigiCert Timestamp 2024 #8 Chain
Validity Period: 2024-09-26 00:00:00 β†’ 2035-11-25 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0B AE 66 BC 5A BA 7F 95 87 C6 F9 E9 04 E3 33 04
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #9 Chain
Validity Period: 2022-03-23 00:00:00 β†’ 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted Root G4 #10 Chain
Validity Period: 2022-08-01 00:00:00 β†’ 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A

βœ“ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
10 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just thatβ€”peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware