Gridinsoft Logo
File Icon

风海mini.exe Trojan Agent Analysis

Updated 3 months ago
Checked by Malaware Check
风海mini.exe

Technical Analysis

File Name 风海mini.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.209.174
Database Version 2025-03-02 09:00:33 UTC
⚠

Trojan.Win32.Agent.sa

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
2,784,013
File Size (bytes)
2025-03-02
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
00a353a5bad43a8644c771486d9dfae6
SHA1
fa594a570e870b2029d648f9deee51ebbf096e81
SHA256
1ce99f60292aa8808687010e53feff56ab3af5af3d725d8a9008dd4a1cf252cb
SHA512
0b7ee0cea03672c67a7f874fe296df033c9f81326a0249e0431684064fb43aaff5d62eb3e198b546ff3afbb3e74f2d4da3a42a2a9bc28f8119f8ac2429b3b682
ImpHash
fcf1390e9ce472c7270447fc5c61a0c1

PE Analysis

Basic Information

▼
Icon
Hash: a6a891113325ca2215f2c1ba51cb2449
Fuzzy: 2e387d103bf466940c601e1ff24eca04
dHash: 24b4694d1696cda2
Image Base 0x00400000
Entry Point 0x0041ec40
Compilation Time 2020-12-01 18:00:55
Checksum 0x00000000 (Actual: 0x002afd53)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Digital Signature No valid SignedData structure was found.
Imports 2 libraries
KERNEL32, gdiplus
Exports 0 functions
Resources 21 Resources
Sections 6 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 200,938 bytes 201,216 bytes 6.71 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C5BF61BBEDB6AD471E9DC6266398E965
.rdata 0x00033000 42,514 bytes 43,008 bytes 5.22 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7980B588D5B28128A2F3C36CABE2CE98
.data 0x0003e000 145,192 bytes 4,096 bytes 3.71 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 201530C9E56F172ADF2473053298D48F
.didat 0x00062000 392 bytes 512 bytes 3.30 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C5D41D8F254F69E567595AB94266CFDC
.rsrc 0x00063000 255,336 bytes 255,488 bytes 5.40 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E849E9ED43B5A8F8D2AECF536494DD15
.reloc 0x000a2000 8,808 bytes 9,216 bytes 6.55 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ C7A942B723CB29D9C02F7C611B544B50
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 21 (253,991 bytes)
Resource Type Count Total Size Percentage
PNG 2 8,430 bytes
3.3%
RT_ICON 1 236,584 bytes
93.1%
RT_DIALOG 6 2,916 bytes
1.1%
RT_STRING 10 4,166 bytes
1.6%
RT_GROUP_ICON 1 20 bytes
0%
RT_MANIFEST 1 1,875 bytes
0.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Agent.sa Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware