Gridinsoft Logo

Doesscalepoem.exe Trojan Heuristic Analysis

Updated 1 month ago
Checked by Malaware Check
doesscalepoem.exe

Technical Analysis

File Name doesscalepoem.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.215.174
Database Version 2025-04-23 14:00:19 UTC
⚠

Trojan.Heur!.03212023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
16,535,552
File Size (bytes)
2025-04-23
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
9da2a5902d12029da53d046015d40c1e
SHA1
080a4f214421342950af341eb99ea31c92bd54a2
SHA256
1d158e7be75e91f99bbaaac905835e7b8f6c478f76680ed61ef877231c11aca8
SHA512
e179004bcebbfafb0d20380ffc9c56f02bbc65c5537819caf777ffd5ff393cc2e376d45b9aae4bf6eb148b3dc76fe71e0e30668b6db24c34e29e05f8bb46f435
ImpHash
c194850dd4a34c3a68a36257f3967408

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x141b6f058
Compilation Time 2025-04-16 01:45:28
Checksum 0x00eca6de (Actual: 0x00fcb35c)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 17 libraries
Exports 0 functions
Resources 1 Resources
Sections 14 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 7,999,252 bytes 3,400,704 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 3006E180400C257DB5DBE45D39CC6273
.rdata 0x007a2000 4,252,160 bytes 1,913,856 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F8583761F8EE535F2E26A8C93BDBCADE
.data 0x00bb1000 1,393,788 bytes 752,128 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 58D7E1DB7C3C8B6CEADAF84A3A1C0473
.pdata 0x00d06000 286,224 bytes 166,912 bytes 7.68 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 59F2C875CD34AD5DB764E845B2DE24A3
.rsrc 0x00d4c000 48 bytes 512 bytes 4.20 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE DDB56DBD901921171E470AD54F2860DE
.reloc 0x00d4d000 488 bytes 512 bytes 6.15 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4DD03A2A49AF924A2099E50C75776F98
.reloc2 0x00d4e000 56,272 bytes 16,384 bytes 7.95 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ CF78638F31A1C510E39610478AD6FF6E
.idata 0x00d5c000 4,096 bytes 1,536 bytes 3.11 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE FDE319B80F6B282DBCE211F96979D720
.tls 0x00d5d000 4,096 bytes 512 bytes 0.36 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0189DFC60CA3FCAC5C9A9791F53A0AB5
.edata 0x00d5e000 4,096 bytes 512 bytes 4.77 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DD120F5937BCB5D07A042C9A29DD2B40
.xdata 0x00d5f000 14,745,600 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.sdata 0x01b6f000 9,223,168 bytes 9,223,168 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 23CD92E79D6D73DA94FA11CEE265D62C
.srdata 0x0243b000 4,096 bytes 16 bytes 2.77 (Normal) IMAGE_SCN_MEM_READ 2F3C5BAD07BA1A209A76C87B8F160883
.arch 0x0243c000 1,056,768 bytes 1,056,768 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F9DBEEF86F3E563CEBD958BA296E0AB7
Entropy Analysis Alert

7 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 1 (392 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 392 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.03212023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.03212023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware