The CHEAT Loader.exe (Malwarebytes) File Analysis

Updated 2 years ago

Checked by Malware Check

CHEAT Loader.exe

Technical Analysis

File Name	CHEAT Loader.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	98304:NW5cnbCzw/TRQi1t11OdbRrPejUjnMP+seiZfmNqyoapIRCDmqj9VixwvA2FBqhq:NWzwZ12T/LMPrPZf3yLKRaPUCDqU
Scanner Version	1.0.170.174
Database Version	2024-03-30 14:00:29 UTC

⚠

Suspicious File Detected

Detected by 31 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

44%

Detection Rate

4,904,944

File Size (bytes)

31/71

Engines Detected

2024-03-30

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	3b016683daab3b3cbd2aec267abf4fe4
SHA1	62c983c0ba81a6295abd66ce7a55ea1f1b56a7da
SHA256	0fe8ef270e08fe0c38513e0f847167ce34a2ce062f6927d1a7b677bfffd4d635
SHA512	5fe17990f09a5075933a3fc4ecb98704d0606f6872b6aeffdd32d60a2f1d995b70e1c0d8bce3e8e425de44a1da191e8f33c7424093246c32aee79aaf21c651f4
ImpHash	f6baa5eaa8231d4fe8e922a2e6d240ea

Security Engines with Detections (31 of 71)

Bkav

W32.AIDetectMalware Malicious

Lionic

Trojan.Win32.Stealer.tsi1 Malicious

Elastic

malicious (high confidence) Malicious

Skyhigh

Artemis!Trojan Malicious

McAfee

Artemis!3B016683DAAB Malicious

Malwarebytes

Generic.Malware/Suspicious Malicious

Sangfor

Trojan.Win32.Sfx.V1o0 Malicious

K7AntiVirus

Trojan ( 005a24931 ) Malicious

K7GW

Trojan ( 005a24931 ) Malicious

Symantec

Trojan.Gen.MBT Malicious

ESET-NOD32

Win32/Packed.7Zip.AI Malicious

Avast

FileRepMalware [Misc] Malicious

ClamAV

Win.Keylogger.Gencbl-9969771-0 Malicious

Kaspersky

Trojan.Win32.SFX.om Malicious

Tencent

Win32.Trojan.FalseSign.Edhl Malicious

Sophos

Mal/Generic-S Malicious

F-Secure

Trojan.TR/Redcap.xxxax Malicious

Ikarus

Trojan.Win32.7zip Malicious

Avira

TR/Redcap.xxxax Malicious

Microsoft

Trojan:Win32/Sabsik.FL.B!ml Malicious

ZoneAlarm

Trojan.Win32.SFX.om Malicious

GData

Win32.Backdoor.Rozena.06A8BX Malicious

Cynet

Malicious (score: 99) Malicious

AhnLab-V3

Malware/Win.Generic.C4518703 Malicious

Cylance

unsafe Malicious

Panda

Trj/Chgt.AD Malicious

Rising

Stealer.Agent/SFX!1.F3AF (CLASSIC) Malicious

Fortinet

W32/PossibleThreat Malicious

AVG

FileRepMalware [Misc] Malicious

DeepInstinct

MALICIOUS Malicious

CrowdStrike

win/malicious_confidence_60% (W) Malicious

40 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 35254fe6022f271cac5ec91d6637329f Fuzzy: 6a946b8de3a6cac6e2b022bbb603f929 dHash: 00b28e8e8e86b800
Image Base	`0x00400000`
Entry Point	`0x0041945f`
Compilation Time	2012-05-28 09:05:18
Checksum	0x004b1fe1 (Actual: 0x004b1fe1)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	Chain verification from CN=ZennoInc, EMAIL=ZennoInc, O=ZennoInc, L=ZennoInc, C=UK (serial:3597384518965702805, sha1:f0f30f7fff6072ab7e2ce8e0921ccbe6283d1181) failed: The X.509 certificate provided is self-signed - "Common Name: ZennoInc, Email Address: ZennoInc, Organization: ZennoInc, Locality: ZennoInc, Country: UK"
Imports	9 libraries COMCTL32, SHELL32, GDI32, ADVAPI32, USER32, ole32, OLEAUT32, KERNEL32, MSVCRT
Exports	0 functions
Resources	7 Resources
Sections	4 Sections

Version Information

▼

CompanyName	Malwarebytes
LegalCopyright	© Malwarebytes 2024. All rights reserved.
OriginalFilename	Malwarebytes.dll
FileVersion	5.0.0.735
ProductName	Malwarebytes
ProductVersion	5.0.0.735
InternalName	Malwarebytes.dll
FileDescription	Malwarebytes
Created	7z SFX Constructor v4.6.0.0 (http://usbtor.ru/viewtopic.php?t=798)
Builder	ahileeeeeess 19:33:34 28/03/2024
Translation	0x0000 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	101,902 bytes	102,400 bytes	6.66 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D3957DDD0307E58133C3F807DFC6F779`
`.rdata`	`0x0001a000`	15,322 bytes	15,360 bytes	5.73 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D084871ADC0CD9263E4A1811B8FC40FA`
`.data`	`0x0001e000`	19,948 bytes	2,560 bytes	4.44 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8C42B68006A121B1B9EBD199E2E59CA5`
`.rsrc`	`0x00023000`	20,224 bytes	20,480 bytes	3.93 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`197037149DB03D59796C3E0D2F5E05AB`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 7 (19,772 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	4	17,840 bytes	90.2%
RT_GROUP_ICON	1	62 bytes	0.3%
RT_VERSION	1	1,032 bytes	5.2%
RT_MANIFEST	1	838 bytes	4.2%

Certificate Chain Analysis

▼

Certificate Information

Product	Malwarebytes
Description	Malwarebytes
File Version	5.0.0.735
Original Name	Malwarebytes.dll
Signing Date	06:32 PM 03/28/2024 (808 days ago)
Verification Status	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Signers	ZennoInc
Internal Name	Malwarebytes.dll
Copyright	© Malwarebytes 2024. All rights reserved.

Certificate Chain Summary

ZennoInc #1 Primary

Validity Period: 2024-02-27 00:00:00 → 2026-02-27 00:00:00

Signature Algorithm: sha256RSA

Serial Number: 31 EC 7A 29 05 70 B0 95

Sectigo RSA Time Stamping CA #2 Chain

Validity Period: 2019-05-02 00:00:00 → 2038-01-18 23:59:59

Signature Algorithm: sha384RSA

Serial Number: 30 0F 6F AC DD 66 98 74 7C A9 46 36 A7 78 2D B9

Sectigo RSA Time Stamping Signer #4 #3 Chain

Validity Period: 2023-05-03 00:00:00 → 2034-08-02 23:59:59

Signature Algorithm: sha384RSA

Serial Number: 39 4C 25 E1 7C A0 6D 27 A8 65 E2 3B D9 1D 22 D4

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Chain verification from CN=ZennoInc, EMAIL=ZennoInc, O=ZennoInc, L=ZennoInc, C=UK (serial:3597384518965702805, sha1:f0f30f7fff6072ab7e2ce8e0921ccbe6283d1181) failed: The X.509 certificate provided is self-signed - "Common Name: ZennoInc, Email Address: ZennoInc, Organization: ZennoInc, Locality: ZennoInc, Country: UK"

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

1
Weekly Quick Scans: Set a reminder to run a scan every Sunday. Most infections are caught within the first week, so regular checks give you peace of mind.
2
Update Everything: Those annoying update popups exist for a reason — they patch security holes. Windows, browsers, Adobe, Java — keep them all current.
3
Download Smart: Stick to official websites and app stores. If a "free" version of paid software sounds too good to be true, it probably comes with unwanted extras.
4
Think Before You Click: Malware loves email attachments and "urgent" links. Even if an email looks like it's from your bank or a friend, verify suspicious requests through a different channel.

Proactive Protection

31 security engines flagged this file. Could be a real threat, or could be a false alarm — common with keygens, game trainers, and legitimate system utilities. Check if the file has a valid digital signature and whether it came from the official source.

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Signed in via Gridinsoft Portal · View profile

Your Score for

5 4 3 2 1

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now