The amachoco3_gpt4.0.exe (Ethornell - BURIKO General Interpreter) File Analysis

Updated 2 days ago

Checked by Malware Check

amachoco3_gpt4.0.exe

Technical Analysis

File Name	amachoco3_gpt4.0.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	49152:+KMmRiUIlYAbPbuRczGGFwKYQEVCR939d/Moz:RMmRGlYAbPyRc52SjRV9d/
Scanner Version	1.0.222.174
Database Version	2025-08-08 07:00:26 UTC

⚠

Suspicious File Detected

Detected by 42 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

58%

Detection Rate

2,032,640

File Size (bytes)

42/72

Engines Detected

2025-08-08

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	8421275387ecf1f215143af4a76cda34
SHA1	78e2513dcbe6b22dadee37d9ac6c90174decb4bb
SHA256	1cf08929c38d74ada6f798642d90593e4d71a6ccf52601a14f881e297bffe1c3
SHA512	cf35ad87e4353e4e299337f69d35ca2d6ec5d554db1a34c56d357b4d1f7c125935c9505f64ad00870e42b695ad7ada7cab28bf84f94dc6918343aa2ddc5690fe
ImpHash	2f727a975c44a2925ace416e4a5ad2d8

Security Engines with Detections (42 of 72)

Bkav

W32.Common.CD4322A4 Malicious

Lionic

Trojan.Win32.Generic.4!c Malicious

Elastic

malicious (high confidence) Malicious

MicroWorld-eScan

Gen:Variant.Fragtor.553181 Malicious

FireEye

Generic.mg.8421275387ecf1f2 Malicious

Skyhigh

BehavesLike.Win32.Injector.th Malicious

ALYac

Gen:Variant.Fragtor.553181 Malicious

Cylance

Unsafe Malicious

Sangfor

Trojan.Win32.Fragtor.Vj0w Malicious

Alibaba

Trojan:Win32/Generic.60b62d8b Malicious

Cybereason

malicious.387ecf Malicious

Arcabit

Trojan.Fragtor.D870DD Malicious

Symantec

ML.Attribute.HighConfidence Malicious

APEX

Malicious Malicious

TrendMicro-HouseCall

Trojan.Win32.WACATAC.USBLKR23 Malicious

Paloalto

generic.ml Malicious

ClamAV

Win.Trojan.Trojanx-10003922-0 Malicious

BitDefender

Gen:Variant.Fragtor.553181 Malicious

Avast

Win32:Malware-gen Malicious

Emsisoft

Gen:Variant.Fragtor.553181 (B) Malicious

Google

Detected Malicious

VIPRE

Gen:Variant.Fragtor.553181 Malicious

TrendMicro

Trojan.Win32.WACATAC.USBLKR23 Malicious

McAfeeD

ti!1CF08929C38D Malicious

Trapmine

suspicious.low.ml.score Malicious

Sophos

Mal/Generic-S Malicious

SentinelOne

Static AI - Malicious PE Malicious

Antiy-AVL

Trojan/Win32.Sabsik Malicious

Gridinsoft

Trojan.Heur!.03052021 Malicious

Microsoft

PUA:Win32/Packunwan Malicious

GData

Gen:Variant.Fragtor.553181 Malicious

Cynet

Malicious (score: 100) Malicious

MAX

malware (ai score=84) Malicious

VBA32

TScope.Malware-Cryptor.SB Malicious

Malwarebytes

Generic.Malware.AI.DDS Malicious

Panda

Trj/Chgt.AD Malicious

Ikarus

Trojan.Win32.Enigma Malicious

MaxSecure

Trojan.Malware.220859293.susgen Malicious

Fortinet

W32/PossibleThreat Malicious

AVG

Win32:Malware-gen Malicious

DeepInstinct

MALICIOUS Malicious

alibabacloud

Trojan:Win/Jaik Malicious

30 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 3df5ff1a3355b2fee0749eb1f0838b9b Fuzzy: 3aedb9244c3bfb6dd3522ab469aec8e2 dHash: 9bc4dedbd3e2634b
Image Base	`0x00400000`
Entry Point	`0x00425285`
Compilation Time	2023-10-23 09:50:22
Checksum	0x00000000 (Actual: 0x001fe448)
OS Version	6.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	8 libraries kernel32, user32, advapi32, oleaut32, ole32, ntdll, SHFolder, shlwapi
Exports	2 functions
Resources	34 Resources
Sections	9 Sections

Version Information

▼

Comments	BURIKO General Interpreter uses the OggVorbis libraries. The OggVorbis libraries are Copyright (C) 1994-2002 by the Xiph.Org Foundation. < http://www.xiph.org/ >
CompanyName	BURIKO Co.,Ltd.
FileDescription	Ethornell - BURIKO General Interpreter
FileVersion	Version : 1.678 - Compatibility : 1.72
InternalName	Ethornell
LegalCopyright	Copyright (C) 2007-2023 BURIKO Co.,Ltd.
LegalTrademarks	BURIKO General Interpreter
OriginalFilename	BGI.exe
ProductVersion	1.0.0.0
Translation	0x0411 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,094,132 bytes	1,094,144 bytes	6.57 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`14EEFB879CC72724F89A336317F8BC38`
`.rdata`	`0x0010d000`	235,874 bytes	236,032 bytes	5.78 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E2915DBEEAC2F9B33DC630173BDE3227`
`.data`	`0x00147000`	425,392 bytes	13,824 bytes	3.65 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`968EFC2FB369F427EB928DD213F20FCA`
`_RDATA`	`0x001af000`	1,504 bytes	1,536 bytes	4.68 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3572694B6B2205862BDE5F60EAE95671`
`.rsrc`	`0x001b0000`	192,448 bytes	192,512 bytes	7.85 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BFD451C4DE3B6E464118DD6BFA96A74D`
`.reloc`	`0x001df000`	47,816 bytes	48,128 bytes	6.64 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`0D52E0B1A26BE3B7EF6BE654813FD8AF`
`.detour`	`0x001eb000`	11,048 bytes	11,264 bytes	5.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`ACD9A5F83D4F20A0823585F7B0473A0E`
`.enigma1`	`0x001ee000`	4,096 bytes	126,976 bytes	7.92 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FD6BC7C76CC1602695241FC936C115AF`
`.enigma2`	`0x001ef000`	307,200 bytes	307,200 bytes	5.96 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4E2F06DC3745C4CF1D53C925C2F26596`

Entropy Analysis Alert

2 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 34 (190,357 bytes)

Resource Type	Count	Total Size	Percentage
AFX_DIALOG_LAYOUT	3	6 bytes	0%
SHADER	1	2,174 bytes	1.1%
TEXT	1	1,489 bytes	0.8%
RT_CURSOR	1	2,220 bytes	1.2%
RT_ICON	6	173,746 bytes	91.3%
RT_DIALOG	17	7,160 bytes	3.8%
RT_GROUP_CURSOR	1	20 bytes	0%
RT_GROUP_ICON	1	90 bytes	0%
RT_VERSION	1	1,236 bytes	0.6%
RT_MANIFEST	1	1,759 bytes	0.9%
None	1	457 bytes	0.2%

Certificate Chain Analysis

▼

Certificate Information

Description	Ethornell - BURIKO General Interpreter
File Version	Version : 1.678 - Compatibility : 1.72
Original Name	BGI.exe
Internal Name	Ethornell
Copyright	Copyright (C) 2007-2023 BURIKO Co.,Ltd.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

42 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1

The amachoco3_gpt4.0.exe (Ethornell - BURIKO General Interpreter) File Analysis

Technical Analysis

Suspicious File Detected

Scan Another File

File Identification

Security Engines with Detections (42 of 72)

PE Analysis

Basic Information

Version Information

PE Sections

Entropy Analysis Alert

Resource Analysis

Certificate Chain Analysis

Certificate Information

Certificate Verification Status

Remember: This is Result of Online Virus Scanner

Keep Your System Protected

Leave a Comment

Gridinsoft Anti-Malware