Gridinsoft Logo
File Icon

AutoF04.exe Trojan Wacatac Analysis

Updated 1 year ago
Checked by Malware Check
AutoF04.exe

Technical Analysis

File Name AutoF04.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.172.174
Database Version 2024-04-19 13:00:22 UTC
⚠

Ransom.Win32.Wacatac.sa

Malware family: Wacatac

Wacatac malware demonstrates multiple malicious capabilities including data theft, system compromise, and secondary payload deployment. It can download additional malware components including ransomware to extend attack impact.
N/A
Detection Rate
1,573,144
File Size (bytes)
2024-04-19
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
3cde5e7e50dd137c581036b8615d9e85
SHA1
48d16e3320c64be0bcab3892533a80b274493df6
SHA256
10213ca620ce720614c96c2e5d1b15fd7b99ab95b447740d408051680171f57d
SHA512
fdf560f9026a6ee0c5e394283b97253f3b9f998ac4dd1ca1f561f20655560098a0969c01c5decd0d1e2a40245b9d783d5abb28c54871b73d917671bf9373327e
ImpHash
bbac62fd99326ea68ec5a33b36925dd1

PE Analysis

Basic Information

▼
Icon
Hash: 8449aed3eaa21e7004a63668b0bde627
Fuzzy: 353e3986dbe2118bcc5f58ee90b7d5e0
dHash: 09845b39b39b6413
Image Base 0x00400000
Entry Point 0x00427654
Compilation Time 2024-04-04 15:38:53
Checksum 0x001848ec (Actual: 0x001848ec)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 18 libraries
Exports 0 functions
Resources 20 Resources
Sections 5 Sections

Version Information

▼
FileVersion 0.0.1.4
ProductVersion 1.0.1.0
OriginalFilename AutoF04.exe
InternalName AutoF04.exe
FileDescription
CompanyName ThuongUIT
LegalCopyright
ProductName AutoF04
Translation 0x0809 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 576,285 bytes 576,512 bytes 6.68 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 71CEF5C3933F887A397493E0EFDDD06B
.rdata 0x0008e000 182,162 bytes 182,272 bytes 5.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CAFE163A4606460132CF64181C840603
.data 0x000bb000 40,756 bytes 25,088 bytes 2.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 20FE1A758168536B32C2BCFFA42F356F
.rsrc 0x000c5000 746,161 bytes 746,496 bytes 7.12 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F48B6A918BECB020E905A9198D6B154F
.reloc 0x0017c000 41,262 bytes 41,472 bytes 5.20 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 39AEF1957523DF127EC0C77BE9B9DC1D
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 20 (744,969 bytes)
Resource Type Count Total Size Percentage
RT_ICON 4 271,264 bytes
36.4%
RT_MENU 1 80 bytes
0%
RT_DIALOG 1 252 bytes
0%
RT_STRING 7 8,900 bytes
1.2%
RT_RCDATA 1 462,824 bytes
62.1%
RT_GROUP_ICON 4 80 bytes
0%
RT_VERSION 1 616 bytes
0.1%
RT_MANIFEST 1 953 bytes
0.1%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win32.Wacatac.sa Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win32.Wacatac.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware