Gridinsoft Logo
File Icon

屏幕录像机.exe Trojan Agent Analysis

Updated 23 days ago
Checked by Malware Check
屏幕录像机.exe

Technical Analysis

File Name 屏幕录像机.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.219.174
Database Version 2025-07-06 16:00:40 UTC
⚠

Trojan.Win32.Agent.dg

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
12,106,961
File Size (bytes)
2025-07-06
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
44c07e9088662677c566d175c601e9cb
SHA1
92501e71923405ed2fa2363c92bea753eb5c9731
SHA256
10746301c01cef0fc0a2db2c5b0a36dde0e46d7b448b600438adf988cba4362c
SHA512
8a089a135d366cedb50c4e480b80891a81cbc05a9e020b65a372dabd89af5017fedb054b71c1644aa5e2a50ae1054a2854aafb9bf7a470d3eb7a72971c6b0525
ImpHash
de1fa96ad5bc81910ffb7ed552e29d0d

PE Analysis

Basic Information

▼
Icon
Hash: 4a47717ebb8048fd069c8989f28c6470
Fuzzy: 5e7da7387660bb4429decc39b7faea9f
dHash: c8c2aaa6a6a6a690
Image Base 0x00400000
Entry Point 0x0041a238
Compilation Time 1992-06-19 22:22:17
Checksum 0x00025419 (Actual: 0x00b8c5d5)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 6 libraries
kernel32, user32, advapi32, oleaut32, gdi32, shell32
Exports 0 functions
Resources 17 Resources
Sections 8 Sections

Version Information

▼
CompanyName oh!soft
FileDescription oCam
FileVersion 452.0.0.0
LegalCopyright oh!soft
ProductVersion 452.0
Translation 0x0804 0x03a8

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
CODE 0x00001000 107,440 bytes 107,520 bytes 6.50 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 971E54A4BB2DCC7C55E6EC5D07FE427F
DATA 0x0001c000 3,356 bytes 3,584 bytes 4.44 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 510D858BDA49BA7DDD3EDF901D269CAF
BSS 0x0001d000 10,495,365 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x00a20000 3,780 bytes 4,096 bytes 4.63 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 034463CB731314C182A6928C0AB6BC5B
.tls 0x00a21000 12 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x00a22000 37 bytes 512 bytes 0.44 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ D7EB5468F34B225E6D32305178A6ABE8
.reloc 0x00a23000 7,692 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.rsrc 0x00a25000 23,908 bytes 24,064 bytes 5.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ C1A4467653BB7FF7115D10CD776F4FC9
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 17 (22,850 bytes)
Resource Type Count Total Size Percentage
RT_ICON 4 17,472 bytes
76.5%
RT_STRING 7 4,116 bytes
18%
RT_RCDATA 3 308 bytes
1.3%
RT_GROUP_ICON 1 62 bytes
0.3%
RT_VERSION 1 472 bytes
2.1%
RT_MANIFEST 1 420 bytes
1.8%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Agent.dg Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.dg without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware