Gridinsoft Logo
File Icon

The ViewHelper.dll File Analysis

Updated 3 months ago
Checked by Malware Check
ViewHelper.dll

Technical Analysis

File Name ViewHelper.dll
File Type
Win32 DLL
Magic Bytes PE32+ executable (DLL) (GUI) x86-64, for MS Windows
SSDEEP Hash
24576:K7iP2UYqvnUi/vO16Qw/l8xs9uEMHGupUkqIHV4i8tqFOav:KwVpam8xUxs
Scanner Version 1.0.225.174
Database Version 2025-09-25 18:00:34 UTC
⚠

Suspicious File Detected

Detected by 32 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
44%
Detection Rate
3,044,448
File Size (bytes)
32/72
Engines Detected
2025-09-25
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
28f64aaebb2f204fede7ae09eb1cb11d
SHA1
b993ea3652f19aaccabdb3761ec5aaef7faee371
SHA256
1d53405981bbec6592e7242a6ee3743c624a49d90beddf53eb903681cf96d314
SHA512
877dd84d9f3a76b43140a73df30ffb82602c22088ac1494d4333c55a2c112dca0b05c2fe9a106258d138f7a080964386afba4a9bb53e2dca2c5dd9bd857fa532
ImpHash
c8de1229c0a643052186a1f8540717d7

Security Engines with Detections (32 of 72)

Bkav
W32.Common.9F264797 Malicious
Lionic
Trojan.Win32.Agentb.X!c Malicious
MicroWorld-eScan
Trojan.GenericKD.76913492 Malicious
CAT-QuickHeal
Trojan.Win64 Malicious
ALYac
Trojan.GenericKD.76913492 Malicious
Malwarebytes
Neshta.Virus.FileInfector.DDS Malicious
Zillya
Trojan.Agent.Win64.95922 Malicious
Alibaba
Trojan:Win64/Genric.35b2ff08 Malicious
CrowdStrike
win/malicious_confidence_100% (W) Malicious
Symantec
ML.Attribute.HighConfidence Malicious
TrendMicro-HouseCall
Trojan.Win64.LOADER.C Malicious
Paloalto
generic.ml Malicious
Kaspersky
Trojan.Win64.Agentb.lcwc Malicious
BitDefender
Trojan.GenericKD.76913492 Malicious
Avast
Win64:Malware-gen Malicious
Rising
[email protected] (CERT:vCOwHl4fu+DL8kAl6w1Xdg) Malicious
Emsisoft
Trojan.GenericKD.76913492 (B) Malicious
VIPRE
Trojan.GenericKD.76913492 Malicious
TrendMicro
Trojan.Win64.LOADER.C Malicious
McAfeeD
ti!1D53405981BB Malicious
CTX
dll.trojan.agentb Malicious
Sophos
Mal/Generic-S Malicious
GData
Trojan.GenericKD.76913492 Malicious
Jiangmin
Trojan.Agentb.rax Malicious
Google
Detected Malicious
Varist
W64/ABTrojan.KDHP-7788 Malicious
Arcabit
Trojan.Generic.D4959B54 Malicious
Cylance
Unsafe Malicious
huorong
Backdoor/Kantu.b Malicious
MaxSecure
Trojan.Malware.406489613.susgen Malicious
AVG
Win64:Malware-gen Malicious
DeepInstinct
MALICIOUS Malicious
40 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 23eeeb0395497433da4270d0ca35cc31
Fuzzy: 91c3d32022ba5ceefd8739bc92fbcb48
dHash: c08f1b3f0c5b59d8
Image Base 0x180000000
Entry Point 0x18001fd54
Compilation Time 2025-03-31 10:02:02
Checksum 0x002f67ca (Actual: 0x002f67ca)
OS Version 6.0
PEiD Signatures PE32+ executable (DLL) (GUI) x86-64, for MS Windows
PDB Path E:\Shanghai_Work\365kantu_client\bin\x64\Release\DeskRight_x64.pdb
Digital Signature OK
Imports 10 libraries
KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, ole32, OLEAUT32, SHLWAPI, WINHTTP, WININET
Exports 5 functions
Resources 9 Resources
Sections 8 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 344,040 bytes 344,064 bytes 6.44 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 019F6CC99DAE7471F08702E6ED62EE44
.rdata 0x00055000 141,678 bytes 141,824 bytes 4.75 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 77A7A46AA26EFC8BC73113F1B0597A30
.data 0x00078000 23,716 bytes 12,800 bytes 4.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B6FB299E5DB77B66D6C408CDF4987EAA
.pdata 0x0007e000 19,860 bytes 19,968 bytes 5.73 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DB36B62D28B09D68A81D30B5AF137EA4
g_commun 0x00083000 2 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5B71E4C27591CCB21954D71D656B28FB
g_commun 0x00084000 8 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.rsrc 0x00085000 2,506,080 bytes 2,506,240 bytes 6.56 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 56877C7018491E8185B8D6E054419777
.reloc 0x002e9000 4,660 bytes 5,120 bytes 5.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 683077DD6523E0A961A3C5A8DC66DE07
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (2,505,329 bytes)
Resource Type Count Total Size Percentage
AFX_DIALOG_LAYOUT 1 2 bytes
0%
REGISTRY 1 1,711 bytes
0.1%
TYPELIB 1 2,572 bytes
0.1%
RT_BITMAP 1 2,483,360 bytes
99.1%
RT_ICON 1 16,936 bytes
0.7%
RT_DIALOG 1 280 bytes
0%
RT_STRING 1 56 bytes
0%
RT_GROUP_ICON 1 20 bytes
0%
RT_MANIFEST 1 392 bytes
0%

Certificate Chain Analysis

▼
Certificate Information
Signing Date 10:20 AM 03/31/2025 (284 days ago)
Verification Status Signed
Signers Shanghai Yuesong Information Technology Co., Ltd.; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
Counter Signers DigiCert Timestamp 2024; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Certificate Chain Summary
AAA Certificate Services #1 Primary
Validity Period: 2004-01-01 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 01
Sectigo Public Code Signing Root R46 #2 Chain
Validity Period: 2021-05-25 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16
DigiCert Trusted Root G4 #3 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
Sectigo Public Code Signing CA EV R36 #4 Chain
Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 33 D7 08 A8 91 40 53 19 E2 A5 BB D3 39 B9 AD 6E
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #5 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Timestamp 2024 #6 Chain
Validity Period: 2024-09-26 00:00:00 → 2035-11-25 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0B AE 66 BC 5A BA 7F 95 87 C6 F9 E9 04 E3 33 04
Shanghai Yuesong Information Technology Co., Ltd. #7 Chain
Validity Period: 2024-05-14 00:00:00 → 2025-05-14 23:59:59
Signature Algorithm: sha256RSA
Serial Number: B7 A7 CA F4 F4 60 E8 29 E9 EC 62 42 65 6E 9E BC

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
32 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware