Gridinsoft Logo

Mscorsvw.exe Trojan CoinMiner Analysis

Updated 1 year ago
Checked by Malware Check
mscorsvw.exe

Technical Analysis

File Name mscorsvw.exe
File Type
PE32+ executable (console) x86-64, for MS Windows
Scanner Version 1.0.143.174
Database Version 2023-10-14 19:03:19 UTC
⚠

Trojan.Win64.CoinMiner.vb

Malware family: CoinMiner

CoinMiner malware utilizes system resources including CPU and RAM for unauthorized cryptocurrency mining. It establishes persistence through startup integration and may use resource management techniques to avoid detection while mining currencies like Monero or Zcash.
N/A
Detection Rate
23,990,693
File Size (bytes)
2023-10-14
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c6bbc0f697836b93dafe13c27b53e732
SHA1
8f9e03fb9b75f6376a76c98c1ab70b91c09e915a
SHA256
14eb912f5fbad3ed025f38a197465593874a8d0d3288e790bfd4740ca4fb52e4
SHA512
47b2b1347be520f6825d447a59368493418203754c57583afc463e1305dcc67d17596664e66e643f08a1ab37ac233e274984c19041eaced1209db0a899179668
ImpHash
4b1a4a9cdcfa5764a67e65a516bdbe36

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x004014f0
Compilation Time 2022-01-02 19:28:22
Checksum 0x016ed827 (Actual: 0x016ed827)
OS Version 4.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 6 libraries
ADVAPI32, bcrypt, KERNEL32, msvcrt, USERENV, WS2_32
Exports 0 functions
Resources 0 Resources
Sections 21 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 8,549,176 bytes 8,549,376 bytes 6.24 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES EAA754FDE69925F72C64BC1F8B8391BD
.data 0x00829000 24,336 bytes 26,112 bytes 2.88 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 856B6278AAC5B83940475B30424A7864
.rdata 0x0082f000 2,377,616 bytes 2,379,776 bytes 5.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4096BYTES 56E6233C0B964C5F706661DE60CC8D40
.pdata 0x00a74000 255,564 bytes 256,000 bytes 6.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES DCA464B123CB70B8BB4506BB8E511F3F
.xdata 0x00ab3000 298,104 bytes 298,496 bytes 4.65 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES 4ABD5988C17815C0A78B52A18B1AB0B2
.bss 0x00afc000 6,928 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES D41D8CD98F00B204E9800998ECF8427E
.idata 0x00afe000 9,716 bytes 9,728 bytes 4.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES E341CC96A599014673520057835D9F37
.CRT 0x00b01000 176 bytes 512 bytes 0.73 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES FA95EEB292F5ECF703B861F7B0AE9BDA
.tls 0x00b02000 16 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES BF619EAC0CDF3F68D496EA9344137E8B
.reloc 0x00b03000 86,404 bytes 86,528 bytes 5.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 62D6F3AF32D43BF3D37E8D5B4A709D31
/4 0x00b19000 5,088 bytes 5,120 bytes 2.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 30CC66874A40F049CCE36281AD6063D9
/19 0x00b1b000 380,141 bytes 380,416 bytes 5.17 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES B3412213A3936CEA4C6222A4FAF421DC
/35 0x00b78000 216 bytes 512 bytes 1.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 27DE83A9B0FD45A66C5BA8EB6FE452D3
/51 0x00b79000 1,416,633 bytes 1,416,704 bytes 5.83 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES E14D16DCC0D3E3F0BAE03061F543BB2E
/63 0x00cd3000 38,693 bytes 38,912 bytes 4.82 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES C56B3446485595E056C8F9222D669411
/77 0x00cdd000 553,950 bytes 553,984 bytes 5.86 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 5F4FE6C93E8629FB94A483745C790769
/89 0x00d65000 22,568 bytes 23,040 bytes 4.71 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES 68240053723A83900FE85A23D6929589
/102 0x00d6b000 1,052,985 bytes 1,053,184 bytes 5.41 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 1592E86D704397F6126E97AF1DDC2A93
/113 0x00e6d000 748,271 bytes 748,544 bytes 4.26 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 87C30960729B10D5A77FE1E92AEA5FFE
/124 0x00f24000 344,331 bytes 344,576 bytes 5.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES C9A358114ADAB40A3D4A6E4E3FC9AEDB
/137 0x00f79000 660,176 bytes 660,480 bytes 2.67 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 163171E7D8C0EA32C09655213E3C35C9

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.CoinMiner.vb Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.CoinMiner.vb without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware