Gridinsoft Logo
File Icon

Netpass.exe Virtool NirSoft Analysis

Updated 1 year ago
Checked by Malaware Check
netpass.exe

Technical Analysis

File Name netpass.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.171.174
Database Version 2024-04-12 21:00:29 UTC
⚠

Virtool.Win64.NirSoft.dd!n

Malware family: NirSoft

N/A
Detection Rate
140,800
File Size (bytes)
2024-04-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
e736229e890a138ccf7810e00a6bb50d
SHA1
10955a02ef3fd3f80f20062c401bf7960ff6ce94
SHA256
17fb52476016677db5a93505c4a1c356984bc1f6a4456870f920ac90a7846180
SHA512
ed2ff8cb6c47f80e16c424278c6bcf457804a6372994a8f5b1ac50268dcb07af58554611cafbb8585b424c456bb3a9be6d8da28226a5e5f2709d725b581e3c0e
ImpHash
5be403fd609472b10f12730ad35f1c8c

PE Analysis

Basic Information

▼
Icon
Hash: 4c32c205e5b1e2c6802407b66ad9a0bc
Fuzzy: f8b148f27778a771acd3c5bff9ad3008
dHash: 68f0cae4c8d9989a
Image Base 0x140000000
Entry Point 0x140001140
Compilation Time 2024-01-16 11:30:08
Checksum 0x00026bea (Actual: 0x00026bea)
OS Version 4.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 9 libraries
msvcrt, COMCTL32, KERNEL32, USER32, GDI32, comdlg32, ADVAPI32, SHELL32, ole32
Exports 0 functions
Resources 36 Resources
Sections 5 Sections

Version Information

▼
CompanyName NirSoft
FileDescription Network Password Recovery
FileVersion 1.57
LegalCopyright Copyright © 2005 - 2024 Nir Sofer
ProductName Network Password Recovery
ProductVersion 1.57
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 91,956 bytes 92,160 bytes 6.01 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D6F101293663FC37E32882D7F7AF3733
.rdata 0x00018000 19,122 bytes 19,456 bytes 5.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 02249AAAE2F150F21A6AEEB9D74B09D3
.data 0x0001d000 49,680 bytes 3,584 bytes 3.08 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 76478F22CA5F24B4FDEFB1138E47BBB8
.pdata 0x0002a000 5,892 bytes 6,144 bytes 5.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 2587C3F8B65B58ADAA649F966F79E808
.rsrc 0x0002c000 17,924 bytes 18,432 bytes 4.39 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ ECC3242A3C3526ACCB7AF7B3681E5C8F

Resource Analysis

▼
Total Resources: 36 (15,892 bytes)
Resource Type Count Total Size Percentage
RT_CURSOR 1 308 bytes
1.9%
RT_BITMAP 3 1,432 bytes
9%
RT_ICON 5 4,936 bytes
31.1%
RT_MENU 2 1,642 bytes
10.3%
RT_DIALOG 5 3,412 bytes
21.5%
RT_STRING 14 2,766 bytes
17.4%
RT_ACCELERATOR 1 96 bytes
0.6%
RT_GROUP_CURSOR 1 20 bytes
0.1%
RT_GROUP_ICON 2 82 bytes
0.5%
RT_VERSION 1 652 bytes
4.1%
RT_MANIFEST 1 546 bytes
3.4%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Virtool.Win64.NirSoft.dd!n Removal

Gridinsoft has the capability to identify and eliminate Virtool.Win64.NirSoft.dd!n without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware